From ef894c20e5f68a57df46c32199637e0d6d7b7917 Mon Sep 17 00:00:00 2001
From: MarekSpodBiedry <73122968+MarekSpodBiedry@users.noreply.github.com>
Date: Wed, 14 Oct 2026 19:31:01 +0200
Subject: [PATCH] Reject a list data validation that has no formula1 (#1303)

---
 crates/engine/src/cmd/data.rs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/crates/engine/src/cmd/data.rs b/crates/engine/src/cmd/data.rs
index 383624b70..c467b9efa 100644
--- a/crates/engine/src/cmd/data.rs
+++ b/crates/engine/src/cmd/data.rs
@@ -951,6 +951,9 @@ fn validation(s: &mut Session, p: &Json) -> Result<Json> {
         "custom" => ValidationKind::Custom,
         _ => ValidationKind::Any,
     };
+    if kind == ValidationKind::List && str_param(p, "formula1").is_none_or(|f| f.trim().trim_start_matches('=').is_empty()) {
+        return Err(bad("data.validation", "a list validation needs `formula1`"));
+    }
     let dv = Validation {
         ranges: ranges.clone(),
         kind,
@@ -1345,6 +1348,17 @@ mod tests {
         }
     }
 
+    #[test]
+    fn list_validation_without_formula1_is_an_error() {
+        let mut s = Session::new();
+        s.new_workbook();
+        assert!(s.execute("data.validation", json!({"range": "A1:A3", "type": "list", "source": "\"a,b,c\""})).is_err());
+        assert!(s.execute("data.validation", json!({"range": "A1:A3", "type": "list"})).is_err());
+        assert!(s.doc().unwrap().wb.active().unwrap().validations.is_empty());
+        s.execute("data.validation", json!({"range": "A1:A3", "type": "list", "formula1": "\"a,b,c\""})).unwrap();
+        assert_eq!(s.execute("data.validate", json!({"cell": "A1", "input": "a"})).unwrap()["ok"], json!(true));
+    }
+
     #[test]
     fn partial_validation_edits_keep_the_rest_of_the_old_rule() {
         let mut s = Session::new();