Custom forms with an external action that have project field or any request info field as input generate an error on action run

Products

• VMware Aria Suite

Issue/Introduction

VMware have released patches on January 29th 2024 to resolve this issue. Please see the solution section below for details

• This issue is documented in the release notes for Aria Automation 8.16
• Older versions of Aria Automation that have been patched to mitigate the vulnerability documented in VMSA-2024-0001 are also impacted.
• Catalog items with a custom form that include an external action (field/validation) that have the Project field as input generate an error when the action is ran:
• When importing content, you may see the following in the UI regarding actions failing to save in a Content Source: 0/4.
  • The error for content sources that contain workflows with Project as an input:

    Error downloading catalog item '/workflow/UUID' (Error: Content provider error)

• Errors also occur when actions are bound to the '_catalogItemName' request info field and are similar to the below examples:

  • Cannot execute external actions due to validation errors [Request info field with name: 'project' does not exist.]

  • Action execution not allowed.; Some data cannot be retrieved. If the problem persists, contact your system administrator. Failed request: ******

Example: 

Environment

VMware Aria Automation Orchestrator 8.x

Resolution

Solution
VMware have released patches for all supported versions of Aria Automation to resolve this issue
 

Aria Automation Version	Patch
8.11.2	vrlcm-vra-8.11.2-8.11.2.30135.patch
8.12.2	vrlcm-vra-8.12.2-8.12.2.31375.patch
8.13.1	vrlcm-vra-8.13.1-8.13.1.32392.patch
8.14.1	vrlcm-vra-8.14.1-8.14.1.33507.patch
8.16	vrlcm-vra-8.16.0-8.16.0.33716.patch

 

Please see KB 96098 for full details on how to install these patches 


Workaround (Only to be used if patching the environment is not feasible)

There is no need to explicitly pass the project as action input. When a VMware Aria Automation Orchestrator action execution is started, the project id is implicitly passed in as a context parameter. Instead of having an input for the project in the action, use the context parameter called _projectId.

Example:

Project Field

The action receives one input called project.

1. Remove that input.
2. In the action script, create a variable called project and assign it with the context parameter value:

   var project = System.getContext().getParameter("_projectId");

3. Save the action.
4. In the catalog item custom form designer, re-select the updated action.
5. Save the modified custom form.

Request Info Field  (e.g. C​​​atalog Item Name)

1. Custom form binds a request field to an action that has Request Info field as an input.

2. Switch the field to a constant with the actual value (e.g. Catalog Item name).

Content Source Imports and Updates

1. Implement the provided workaround prior to importing the content.

Regex Constraint

1. If you encounter form errors and your form includes one or more fields with a regex constraint, ensure that the regex adheres to both JAVA and JavaScript compliance. When this adjustment is made, the issue will be resolved. Example error message: “Some data cannot be retrieved. If the problem persists, contact your system administrator. Failed request: <action name>”