Prohibit creation of attachments without taskId and processInstanceId

[PHWaechtler]

Environment (Required on creation)

Observed on current master, ie 7.23.0-SNAPSHOT.

TODO: clarify backports

Description (Required on creation; please attach any relevant screenshots, stacktraces, log files, etc. to the ticket)

See this discussion for more detail.

We document that upon creation of attachments, either taskId or processInstanceId has to be provided. However, this is not being validated in the BE- there we are currently just confirming the taskID and processInstanceId is not null. An empty string could still be used however.

Steps to reproduce (Required on creation)

Create an attachment where both the taskId is an empty string and the processInstanceId is also an empty string.

Observed Behavior (Required on creation)

Observe that no error is returned and an attachment is created.

Expected behavior (Required on creation)

It is not possible to create an attachment without both taskId and processInstanceId. We should return an error with a message that explains these requirements to the user.

Root Cause (Required on prioritization)

In the BE we are currently just confirming the taskID is not null. Since its an empty string this will pass, leading to task being null. We do check for the task being null but then again we just validate that processInstanceId is not null. Since processInstanceId is not null but an empty string, we continue with the creation.

Solution Ideas

Validate both against null and emtpy strings and enforce that at least one of the two parameters is neither null nor empty.

Hints

Code
Context

Links

This is related to #3545

Breakdown

Pull Requests

Preview Give feedback

No tasks being tracked yet.

Dev2QA handover

• Does this ticket need a QA test and the testing goals are not clear from the description? Add a Dev2QA handover comment