#399

backend/app/controllers/post_imports_controller.rb

@@ -78,7 +78,7 @@ class PostImportsController < ApplicationController
     rows = Array(params[:rows])
     raise ArgumentError, '取込件数が多すぎます．' if rows.length > PostImportSourceParser::MAX_ROWS
 
-    rows.map do |row|
+    normalised_rows = rows.map do |row|
       value = ActionController::Parameters.new(row).permit(:source_row, :sourceRow, :url, :metadata_url, :metadataUrl,
                                                             attributes: {}, provenance: {}, tag_sources: {},
                                                             fetch_warnings: [], validation_warnings: [])
@@ -109,5 +109,12 @@ class PostImportsController < ApplicationController
 
       normalised.symbolize_keys
     end
+    source_rows = normalised_rows.map { _1[:source_row] }
+    if source_rows.any? { |value| Integer(value, exception: false).to_i <= 0 } ||
+       source_rows.uniq.length != source_rows.length
+      raise ArgumentError, '元行番号が不正です．'
+    end
+
+    normalised_rows
   end
 end