JIRA External System Import (JIM) can create new options for locked custom fields

Background:

JIRA includes JIRA Importers Plugin (JIM). This is what provides the import functions seen in JIRA Administration "External System Import"

• This includes options to import from CSV, JSON, FogBugz, Mantis, and others.

JIRA includes custom fields and the ability for custom fields to be "managed" or "locked." These are fields that are created by JIRA Applications or plugins. They are locked to prevent them from being changed.

Problem Behavior:

Import using JIRA Importers Plugin is capable of adding new options to locked custom fields.

Expected Behavior:

Locked fields cannot be modified by import. Field must be unlocked in order for it to be modified through UI or through any method except for those provided by the plugin or application that is managing the field.

Example problem caused by this behavior:

During import the Epic Status custom field gets modified to include additional options. This causes JIRA Software boards to show epics that are marked as "Done"

• See Epics marked as Epic Status = Done continue to appear on the Agile Board for additional details regarding this behavior.

Steps to reproduce

Reproduced in 7.9.1 with JIM 8.0.10.

• Create new instance with JIRA Software project
• Create CSV for importing, include Epic Status and at least one issue with Epic Status of "Open"
• Import CSV - On the field selection screen map the CSV Epic Status field to the Epic Status field in JIRA (do not map field value)
• Observe that new option has been added to the locked Epic Status custom field. This "Open" option causes the behavior described in the KB article linked above.