Merge pull request #22546 from mvdbeek/merge-collection-fix

[26.0] Fix crash merging structurally invalid nested collections

Author: jmchilton

lib/galaxy/managers/collections.py

@@ -638,10 +638,7 @@ def __recursively_create_collections_for_elements(
 
         new_elements = {}
         for key, element in elements.items():
-            if isinstance(element, DatasetCollection):
-                continue
-
-            if element.get("src") != "new_collection":
+            if not isinstance(element, dict) or element.get("src") != "new_collection":
                 continue
 
             # element is a dict with src new_collection and

lib/galaxy_test/api/test_tools.py

@@ -23,6 +23,7 @@
 from galaxy_test.base import rules_test_data
 from galaxy_test.base.api_asserts import (
     assert_error_code_is,
+    assert_error_message_contains,
     assert_file_looks_like_xlsx,
     assert_has_keys,
     assert_status_code_is,
@@ -810,6 +811,24 @@ def test_zip_list_inputs(self):
             )
             assert zipped_hdca["collection_type"] == "list:paired"
 
+    @skip_without_tool("__MERGE_COLLECTION__")
+    def test_merge_collection_rejects_structurally_invalid_inputs(self):
+        with self.dataset_populator.test_history(require_new=False) as history_id:
+            list_paired_id = self.dataset_collection_populator.create_list_of_pairs_in_history(
+                history_id, wait=True
+            ).json()["outputs"][0]["id"]
+            plain_list_id = self.dataset_collection_populator.create_list_in_history(
+                history_id, contents=["a", "b"], wait=True
+            ).json()["outputs"][0]["id"]
+            self.dataset_populator.wait_for_history(history_id, assert_ok=True)
+            inputs = {
+                "inputs_0|input": {"src": "hdca", "id": list_paired_id},
+                "inputs_1|input": {"src": "hdca", "id": plain_list_id},
+            }
+            response = self._run("__MERGE_COLLECTION__", history_id, inputs, assert_ok=False)
+            assert_status_code_is(response, 400)
+            assert_error_message_contains(response, "must be a sub-collection")
+
     @skip_without_tool("__EXTRACT_DATASET__")
     @skip_without_tool("cat_data_and_sleep")
     def test_database_operation_tool_with_pending_inputs(self):