-
v7.14.1 Stable
gitea-actions
released this
2026-09-17 16:34:55 +00:00 | 0 commits to main since this releaseData Controller for SAS - v7.14.1
Released 17 September 2026.
This is a hardening and security release: it closes an XSS vector, tightens service input validation, and delivers a broad set of reliability fixes for jobs and searches on SAS Viya. There are no new features; the goal is a more robust and safer DC for existing installs.
For installation / upgrade instructions, visit https://docs.datacontroller.io/
Highlights
Security hardening
Two classes of issue are addressed. Upgrade is recommended for all users.
- Escaped cell values in status renderers. Cell values in the stage/submit status tables were written into the page as raw HTML. A data value containing markup (which can arrive from a dataset served to the Viewer or Editor, or from a typed edit) was parsed and executed by the browser. Values are now escaped before rendering, so data is always shown as inert text. Because the payload travels inside ordinary table data, an attack required only write access to some source table plus a reviewer opening the screen - no reviewer error required.
- Validated the target-table input on the stagedata and loadfile services. The
libref.datasetidentifier submitted by the client is now sanitised the same way as on the data-fetch service (via %mp_validatecol) and the service aborts on an invalid value, preventing code injection through the target-table identifier. - Removed unused client credential fields from the deploy screen. The deploy client_id/client_secret fields were read from browser storage but never used by any deploy flow; the dead code is gone, so no credential-shaped value lingers in browser storage.
Reliability fixes (Viya)
Several fixes resolve real failure modes when running DC on SAS Viya:
- Refresh catalog now returns a proper response. The refresh-catalog service wrote raw HTML to the output stream instead of JSON, so API consumers of the admin service got no usable output and aborted. It now returns a structured JSON response like the other admin services.
- Full table search returns the full row cap. When a search matched at least the maximum number of rows (DC_MAXOBS_WEBVIEW), the Viewer showed one row fewer than the cap (499 instead of 500) and the row count disagreed with the rows displayed. The search cap is now aligned with the plain view.
- Missing macro dependency declared. stagedata and loadfile call %mp_validatecol() but did not declare the macro in their headers, so on a live estate the compiled service could abort with "Apparent invocation of macro MP_VALIDATECOL not resolved" and fail the staging operation.
- Graceful handling of canceled child jobs. On Viya, when a child job is canceled, the calling program could be aborted with it, failing screens that batch child jobs (for example restore). Bumped @sasjs/core to 5.2.8, whose job-flow/job-log handling survives canceled children.
Also in this release
- Pre-commit secrets scan. The repo's pre-commit hook now runs a gitleaks scan on staged changes - a contributor-facing hardening, listed for completeness.
- Estate-config hardening for the test suite (batch tests run on the reusable compute context; chunked deploy retries on cold-start timeouts) - test infrastructure only, no product behaviour change.
- Dependency refreshes (sasjs/core 5.2.8, sasjs/cli 4.20.4) and assorted doc corrections.
Dependencies
- @sasjs/core 5.2.8 (from 5.2.0)
- @sasjs/cli 4.20.4 (from 4.20.3 or earlier)
Notes for administrators
No configuration change is required on upgrade. Two behaviours to be aware of:
- Admin API consumers must now parse refreshcatalog's response as JSON (previously the response body was HTML regardless; it was unusable for parsing before, so this is a fix, not a breaking change).
- The remaining items in the release are behaviour-neutral for administrators.
For installation instructions, please visit https://docs.datacontroller.io/
Downloads