IQSS / IQSS/dataverse

Variable metadata for restricted files visible in search results

Open
#11,751 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Type: Bug
Dominant language
Java
Stars
1.1k
Forks
564
Avg merge
2d 2h
Merged PRs (30d)
29

Description

If a restricted Excel file, with variable information is uploaded, these variables are saved in the file metadata.
When you search for this variable, it pops up in the search result.

What steps does it take to reproduce the issue?
Upload and restrict a file that has variable information in it. The Tabular file ingest must be enabled. The variable information will be extracted from the files.
Do a search for one of the variables in the file (be sure to log out first.)
The search results will also include the restricted file.

I could reproduce this on demo.dataverse.org, version 6.7.1.
Search for "engine", and you will find my restricted file in the search results: https://demo.dataverse.org/dataverse/demo?q=%22engine%22&types=files&sort=score&order=desc&page=1

Image
  • When does this issue occur?
    Using basic search box.

  • Which page(s) does it occurs on?
    Search results page.

  • What happens?
    The search results will also include the restricted file.

  • What did you expect to happen?

Users who are not logged in should not be able to see which variables are used within the restricted files.

Which version of Dataverse are you using?
6.5, and 6.71 (Harvard demo environment)

Any related open or closed issues to this bug report?
Not that I know of.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with Tabular file ingest enabled: upload a restricted Excel file containing variables, log out, and search for one of them. Trace the search-results path and metadata indexing or access checks; done means unauthenticated users no longer see restricted files through variable searches.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, search, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.