From 6945b75aac0e6bc2bad6f824769b32842f06bc46 Mon Sep 17 00:00:00 2001 From: Liard Samuel Date: Fri, 8 Oct 2021 09:21:18 +0200 Subject: Fix sonar Security Hotspots Issue-ID: CCSDK-3491 Signed-off-by: sliard Change-Id: I33787ccca2a8acd8085db6b2a915e8f2ac2511ec Signed-off-by: Dan Timoney Signed-off-by: highstreetherbert --- .../features/lib/doorman/dao/MessageDaoImpl.java | 27 +++++++++++++++++----- .../lib/doorman/impl/MessageInterceptorImpl.java | 6 +++-- .../features/lib/doorman/it/MessageQueueTest.java | 3 +++ 3 files changed, 28 insertions(+), 8 deletions(-) (limited to 'lib/doorman') diff --git a/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/dao/MessageDaoImpl.java b/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/dao/MessageDaoImpl.java index f04ea6259..e9a9ed6d2 100644 --- a/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/dao/MessageDaoImpl.java +++ b/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/dao/MessageDaoImpl.java @@ -66,19 +66,33 @@ public class MessageDaoImpl implements MessageDao { @Override public void updateMessageStarted(long messageId, Date timestamp) { - updateMessageStatus("started_timestamp", messageId, null, timestamp); + // duplicate code with updateMessageCompleted to avoid SQL injection issue for sonar + try (Connection con = dataSource.getConnection()) { + try { + con.setAutoCommit(false); + String sql = "UPDATE message SET started_timestamp = ? WHERE message_id = ?"; + try (PreparedStatement ps = con.prepareStatement(sql)) { + ps.setTimestamp(1, new Timestamp(timestamp.getTime())); + ps.setLong(2, messageId); + ps.executeUpdate(); + } + con.commit(); + } catch (SQLException ex) { + con.rollback(); + throw ex; + } + } catch (SQLException e) { + throw new RuntimeException("Error updating message status in DB: " + e.getMessage(), e); + } } @Override public void updateMessageCompleted(long messageId, String resolution, Date timestamp) { - updateMessageStatus("completed_timestamp", messageId, resolution, timestamp); - } - - private void updateMessageStatus(String timestampColumn, long messageId, String resolution, Date timestamp) { + // duplicate code with updateMessageStarted to avoid SQL injection issue for sonar try (Connection con = dataSource.getConnection()) { try { con.setAutoCommit(false); - String sql = "UPDATE message SET " + timestampColumn + " = ? WHERE message_id = ?"; + String sql = "UPDATE message SET completed_timestamp = ? WHERE message_id = ?"; try (PreparedStatement ps = con.prepareStatement(sql)) { ps.setTimestamp(1, new Timestamp(timestamp.getTime())); ps.setLong(2, messageId); @@ -92,6 +106,7 @@ public class MessageDaoImpl implements MessageDao { } catch (SQLException e) { throw new RuntimeException("Error updating message status in DB: " + e.getMessage(), e); } + } @Override diff --git a/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/impl/MessageInterceptorImpl.java b/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/impl/MessageInterceptorImpl.java index 89f29b327..a07b3c4e7 100644 --- a/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/impl/MessageInterceptorImpl.java +++ b/lib/doorman/src/main/java/org/onap/ccsdk/features/lib/doorman/impl/MessageInterceptorImpl.java @@ -180,10 +180,12 @@ public class MessageInterceptorImpl implements MessageInterceptor { private Event waitForNewAction(int holdTime) { long startTime = System.currentTimeMillis(); long currentTime = startTime; - while (currentTime - startTime <= (holdTime + 1) * 1000) { + while (currentTime - startTime <= (holdTime + 1) * 1000L) { try { Thread.sleep(5000); - } catch (Exception e) { + } catch (InterruptedException e) { + log.info("Break sleep : " + e.getMessage()); + Thread.currentThread().interrupt(); } MessageAction nextAction = messageDao.getNextAction(message.getMessageId()); diff --git a/lib/doorman/src/test/java/org/onap/ccsdk/features/lib/doorman/it/MessageQueueTest.java b/lib/doorman/src/test/java/org/onap/ccsdk/features/lib/doorman/it/MessageQueueTest.java index b2f69dbcf..5fc06cb3c 100644 --- a/lib/doorman/src/test/java/org/onap/ccsdk/features/lib/doorman/it/MessageQueueTest.java +++ b/lib/doorman/src/test/java/org/onap/ccsdk/features/lib/doorman/it/MessageQueueTest.java @@ -104,6 +104,7 @@ public class MessageQueueTest { try { Thread.sleep(startTime); } catch (InterruptedException e) { + Thread.currentThread().interrupt(); } MessageData r = interceptor.processRequest(request); @@ -112,6 +113,7 @@ public class MessageQueueTest { try { Thread.sleep(processTime); } catch (InterruptedException e) { + Thread.currentThread().interrupt(); } interceptor.processResponse(response); @@ -158,6 +160,7 @@ public class MessageQueueTest { try { Thread.sleep(processTime); } catch (InterruptedException e) { + Thread.currentThread().interrupt(); } } } -- cgit 1.2.3-korg