diff --git a/backend/app/controllers/post_imports_controller.rb b/backend/app/controllers/post_imports_controller.rb
index cc3a220..855e2b4 100644
--- a/backend/app/controllers/post_imports_controller.rb
+++ b/backend/app/controllers/post_imports_controller.rb
@@ -18,10 +18,12 @@ class PostImportsController < ApplicationController
 
   def preview
     parsed = parsed_params
-    url_column = params[:url_column].presence || (parsed[:columns].length == 1 ? 0 : nil)
-    return render_bad_request('URL 列を選択してください．') if url_column.nil?
+    raw_url_column = params[:url_column].presence || (parsed[:columns].length == 1 ? 0 : nil)
+    return render_bad_request('URL 列を選択してください．') if raw_url_column.nil?
+    url_column = Integer(raw_url_column, exception: false)
+    return render_bad_request('URL 列が不正です．') if url_column.nil? || url_column.negative? || url_column >= parsed[:columns].length
 
-    rows = PostImportPreviewer.new(parsed:, url_column:, mappings: mappings_params,
+    rows = PostImportPreviewer.new(parsed:, url_column:, mappings: mappings_params(parsed[:columns].length),
                                    existing: params[:existing]).preview
     render json: parsed.slice(:columns).merge(rows:)
   rescue ArgumentError => e
@@ -81,7 +83,7 @@ class PostImportsController < ApplicationController
     { columns: columns.map { |column| column.slice('key', 'label') }, rows: parsed_rows }
   end
 
-  def mappings_params
+  def mappings_params column_count
     mappings = params[:mappings]
     return { } if mappings.blank?
     raise ArgumentError, '列割当ての形式が不正です．' unless mappings.is_a?(ActionController::Parameters)
@@ -102,9 +104,13 @@ class PostImportsController < ApplicationController
       kind = value['kind'].presence || 'columns'
       raise ArgumentError, '列割当ての種別が不正です．' unless kind.in?(['columns', 'fixed'])
       columns = value['columns']
-      unless columns.nil? || (columns.is_a?(Array) && columns.all? { |index| Integer(index, exception: false)&.>= 0 })
+      unless columns.nil? || (columns.is_a?(Array) && columns.all? { |index|
+        parsed = Integer(index, exception: false)
+        parsed && parsed >= 0 && parsed < column_count
+      })
         raise ArgumentError, '列番号が不正です．'
       end
+      raise ArgumentError, '列番号が重複しています．' if Array(columns).uniq.length != Array(columns).length
       raise ArgumentError, '固定値が不正です．' if kind == 'fixed' && !value['value'].is_a?(String)
 
       result[field] = { 'kind' => kind, 'value' => value['value'].to_s,
@@ -118,8 +124,9 @@ class PostImportsController < ApplicationController
 
     normalised_rows = rows.map do |row|
       value = ActionController::Parameters.new(row).permit(:source_row, :sourceRow, :url, :metadata_url, :metadataUrl,
-                                                            attributes: {}, provenance: {}, tag_sources: {},
-                                                            fetch_warnings: [], validation_warnings: [])
+                                                            attributes: {}, provenance: {}, tag_sources: {}, tagSources: {},
+                                                            fetch_warnings: [], fetchWarnings: [],
+                                                            validation_warnings: [], validationWarnings: [])
       normalised = value.to_h.deep_transform_keys { _1.to_s.underscore }
       attributes = normalised.fetch('attributes', { })
       provenance = normalised.fetch('provenance', { })
diff --git a/backend/app/services/post_import_previewer.rb b/backend/app/services/post_import_previewer.rb
index 93b132d..80fc5d7 100644
--- a/backend/app/services/post_import_previewer.rb
+++ b/backend/app/services/post_import_previewer.rb
@@ -22,6 +22,7 @@ class PostImportPreviewer
       tag_sources = row[:tag_sources]&.stringify_keys || initial_tag_sources(attributes, provenance)
       tag_sources['manual'] = attributes['tags'].to_s if provenance['tags'] == 'manual'
       url = row[:url].presence || values[@url_column].to_s.strip
+      provenance['url'] ||= row[:url].present? ? 'manual' : 'mapped'
       url_for_metadata = normalised_url(url) || url
       existing_post = normalised_url(url).present? && Post.exists?(url: normalised_url(url))
       if existing_post && @existing == 'skip'
@@ -33,7 +34,6 @@ class PostImportPreviewer
       end
       url_changed = row[:metadata_url].present? && row[:metadata_url] != url_for_metadata
       clear_automatic_values!(attributes, provenance, tag_sources) if url_changed
-      provenance['url'] ||= row[:url].present? ? 'manual' : 'mapped'
       attributes['url'] = url
       fetch_warnings = Array(row[:fetch_warnings]).dup
       should_fetch =