Fix sonar Security Hotspots

Issue-ID: CCSDK-3491
Signed-off-by: sliard <samuel.liard@gmail.com>
Change-Id: I33787ccca2a8acd8085db6b2a915e8f2ac2511ec
Signed-off-by: Dan Timoney <dtimoney@att.com>
Signed-off-by: highstreetherbert <herbert.eiselt@highstreet-technologies.com>

3 files changed, 28 insertions, 8 deletions

diff --git a/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/dao/MessageDaoImpl.java b/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/dao/MessageDaoImpl.java
index f04ea6259..e9a9ed6d2 100644
--- a/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/dao/MessageDaoImpl.java
+++ b/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/dao/MessageDaoImpl.java
@@ -66,19 +66,33 @@ public class MessageDaoImpl implements MessageDao {
 
     @Override
     public void updateMessageStarted(long messageId, Date timestamp) {
-        updateMessageStatus("started_timestamp", messageId, null, timestamp);
+        // duplicate code with updateMessageCompleted to avoid SQL injection issue for sonar
+        try (Connection con = dataSource.getConnection()) {
+            try {
+                con.setAutoCommit(false);
+                String sql = "UPDATE message SET started_timestamp = ? WHERE message_id = ?";
+                try (PreparedStatement ps = con.prepareStatement(sql)) {
+                    ps.setTimestamp(1, new Timestamp(timestamp.getTime()));
+                    ps.setLong(2, messageId);
+                    ps.executeUpdate();
+                }
+                con.commit();
+            } catch (SQLException ex) {
+                con.rollback();
+                throw ex;
+            }
+        } catch (SQLException e) {
+            throw new RuntimeException("Error updating message status in DB: " + e.getMessage(), e);
+        }
     }
 
     @Override
     public void updateMessageCompleted(long messageId, String resolution, Date timestamp) {
-        updateMessageStatus("completed_timestamp", messageId, resolution, timestamp);
-    }
-
-    private void updateMessageStatus(String timestampColumn, long messageId, String resolution, Date timestamp) {
+        // duplicate code with updateMessageStarted to avoid SQL injection issue for sonar
         try (Connection con = dataSource.getConnection()) {
             try {
                 con.setAutoCommit(false);
-                String sql = "UPDATE message SET " + timestampColumn + " = ? WHERE message_id = ?";
+                String sql = "UPDATE message SET completed_timestamp = ? WHERE message_id = ?";
                 try (PreparedStatement ps = con.prepareStatement(sql)) {
                     ps.setTimestamp(1, new Timestamp(timestamp.getTime()));
                     ps.setLong(2, messageId);
@@ -92,6 +106,7 @@ public class MessageDaoImpl implements MessageDao {
         } catch (SQLException e) {
             throw new RuntimeException("Error updating message status in DB: " + e.getMessage(), e);
         }
+
     }
 
     @Override
diff --git a/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/impl/MessageInterceptorImpl.java b/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/impl/MessageInterceptorImpl.java
index 89f29b327..a07b3c4e7 100644
--- a/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/impl/MessageInterceptorImpl.java
+++ b/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/impl/MessageInterceptorImpl.java
@@ -180,10 +180,12 @@ public class MessageInterceptorImpl implements MessageInterceptor {
     private Event waitForNewAction(int holdTime) {
         long startTime = System.currentTimeMillis();
         long currentTime = startTime;
-        while (currentTime - startTime <= (holdTime + 1) * 1000) {
+        while (currentTime - startTime <= (holdTime + 1) * 1000L) {
             try {
                 Thread.sleep(5000);
-            } catch (Exception e) {
+            } catch (InterruptedException e) {
+                log.info("Break sleep : " + e.getMessage());
+                Thread.currentThread().interrupt();
             }
 
             MessageAction nextAction = messageDao.getNextAction(message.getMessageId());
diff --git a/lib/doorman/src/test/java/org/onap/ccsdk/features/lib/doorman/it/MessageQueueTest.java b/lib/doorman/src/test/java/org/onap/ccsdk/features/lib/doorman/it/MessageQueueTest.java
index b2f69dbcf..5fc06cb3c 100644
--- a/lib/doorman/src/test/java/org/onap/ccsdk/features/lib/doorman/it/MessageQueueTest.java
+++ b/lib/doorman/src/test/java/org/onap/ccsdk/features/lib/doorman/it/MessageQueueTest.java
@@ -104,6 +104,7 @@ public class MessageQueueTest {
                 try {
                     Thread.sleep(startTime);
                 } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
                 }
 
                 MessageData r = interceptor.processRequest(request);
@@ -112,6 +113,7 @@ public class MessageQueueTest {
                     try {
                         Thread.sleep(processTime);
                     } catch (InterruptedException e) {
+                        Thread.currentThread().interrupt();
                     }
 
                     interceptor.processResponse(response);
@@ -158,6 +160,7 @@ public class MessageQueueTest {
             try {
                 Thread.sleep(processTime);
             } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
             }
         }
     }