#399

backend/app/controllers/post_imports_controller.rb

@@ -18,10 +18,12 @@ class PostImportsController < ApplicationController
 
   def preview
     parsed = parsed_params
-    url_column = params[:url_column].presence || (parsed[:columns].length == 1 ? 0 : nil)
-    return render_bad_request('URL 列を選択してください．') if url_column.nil?
+    raw_url_column = params[:url_column].presence || (parsed[:columns].length == 1 ? 0 : nil)
+    return render_bad_request('URL 列を選択してください．') if raw_url_column.nil?
+    url_column = Integer(raw_url_column, exception: false)
+    return render_bad_request('URL 列が不正です．') if url_column.nil? || url_column.negative? || url_column >= parsed[:columns].length
 
-    rows = PostImportPreviewer.new(parsed:, url_column:, mappings: mappings_params,
+    rows = PostImportPreviewer.new(parsed:, url_column:, mappings: mappings_params(parsed[:columns].length),
                                    existing: params[:existing]).preview
     render json: parsed.slice(:columns).merge(rows:)
   rescue ArgumentError => e
@@ -81,7 +83,7 @@ class PostImportsController < ApplicationController
     { columns: columns.map { |column| column.slice('key', 'label') }, rows: parsed_rows }
   end
 
-  def mappings_params
+  def mappings_params column_count
     mappings = params[:mappings]
     return { } if mappings.blank?
     raise ArgumentError, '列割当ての形式が不正です．' unless mappings.is_a?(ActionController::Parameters)
@@ -102,9 +104,13 @@ class PostImportsController < ApplicationController
       kind = value['kind'].presence || 'columns'
       raise ArgumentError, '列割当ての種別が不正です．' unless kind.in?(['columns', 'fixed'])
       columns = value['columns']
-      unless columns.nil? || (columns.is_a?(Array) && columns.all? { |index| Integer(index, exception: false)&.>= 0 })
+      unless columns.nil? || (columns.is_a?(Array) && columns.all? { |index|
+        parsed = Integer(index, exception: false)
+        parsed && parsed >= 0 && parsed < column_count
+      })
         raise ArgumentError, '列番号が不正です．'
       end
+      raise ArgumentError, '列番号が重複しています．' if Array(columns).uniq.length != Array(columns).length
       raise ArgumentError, '固定値が不正です．' if kind == 'fixed' && !value['value'].is_a?(String)
 
       result[field] = { 'kind' => kind, 'value' => value['value'].to_s,
@@ -118,8 +124,9 @@ class PostImportsController < ApplicationController
 
     normalised_rows = rows.map do |row|
       value = ActionController::Parameters.new(row).permit(:source_row, :sourceRow, :url, :metadata_url, :metadataUrl,
-                                                            attributes: {}, provenance: {}, tag_sources: {},
-                                                            fetch_warnings: [], validation_warnings: [])
+                                                            attributes: {}, provenance: {}, tag_sources: {}, tagSources: {},
+                                                            fetch_warnings: [], fetchWarnings: [],
+                                                            validation_warnings: [], validationWarnings: [])
       normalised = value.to_h.deep_transform_keys { _1.to_s.underscore }
       attributes = normalised.fetch('attributes', { })
       provenance = normalised.fetch('provenance', { })