From f67bc2db9676c54192a019852594a29f33816534 Mon Sep 17 00:00:00 2001 From: amshegokar Date: Tue, 11 Sep 2018 20:20:27 +0530 Subject: Security vulnerabilities identified in CLM scan Mapper: security vulnerabilities identified in CLM scan Change-Id: I2b977e99e4ad6d1aae24e0d441da6002c28ab0ac Issue-ID: DCAEGEN2-769 Signed-off-by: amshegokar --- UniversalVesAdapter/.classpath | 11 +++++++ UniversalVesAdapter/.project | 11 +++++++ .../.settings/org.eclipse.jdt.core.prefs | 1 + UniversalVesAdapter/pom.xml | 14 +++++---- .../service/VESAdapterInitializer.java | 35 ++++++++++++++++++++-- .../src/main/resources/application.properties | 12 ++++---- pom.xml | 2 +- snmpmapper/pom.xml | 22 ++++++++++---- .../src/main/resources/application.properties | 9 ++++-- 9 files changed, 94 insertions(+), 23 deletions(-) diff --git a/UniversalVesAdapter/.classpath b/UniversalVesAdapter/.classpath index 6d7587a..c77b3a1 100644 --- a/UniversalVesAdapter/.classpath +++ b/UniversalVesAdapter/.classpath @@ -27,5 +27,16 @@ + + + + + + + + + + + diff --git a/UniversalVesAdapter/.project b/UniversalVesAdapter/.project index 473a65c..1123cab 100644 --- a/UniversalVesAdapter/.project +++ b/UniversalVesAdapter/.project @@ -20,6 +20,16 @@ + + net.sf.eclipsecs.core.CheckstyleBuilder + + + + + org.springframework.ide.eclipse.boot.validation.springbootbuilder + + + org.eclipse.m2e.core.maven2Builder @@ -27,6 +37,7 @@ + net.sf.eclipsecs.core.CheckstyleNature org.springframework.ide.eclipse.core.springnature org.eclipse.jdt.core.javanature org.eclipse.m2e.core.maven2Nature diff --git a/UniversalVesAdapter/.settings/org.eclipse.jdt.core.prefs b/UniversalVesAdapter/.settings/org.eclipse.jdt.core.prefs index 714351a..78b2bfc 100644 --- a/UniversalVesAdapter/.settings/org.eclipse.jdt.core.prefs +++ b/UniversalVesAdapter/.settings/org.eclipse.jdt.core.prefs @@ -2,4 +2,5 @@ eclipse.preferences.version=1 org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.8 org.eclipse.jdt.core.compiler.compliance=1.8 org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning +org.eclipse.jdt.core.compiler.processAnnotations=enabled org.eclipse.jdt.core.compiler.source=1.8 diff --git a/UniversalVesAdapter/pom.xml b/UniversalVesAdapter/pom.xml index cd5e489..1342ec3 100644 --- a/UniversalVesAdapter/pom.xml +++ b/UniversalVesAdapter/pom.xml @@ -84,7 +84,7 @@ org.springframework.boot spring-boot-starter-web - 2.0.3.RELEASE + 2.0.4.RELEASE org.springframework.boot @@ -95,9 +95,13 @@ org.springframework.data spring-data-commons - 2.0.6.RELEASE + 2.0.8.RELEASE + + + org.codehaus.groovy + groovy-all + 2.4.14 - com.jayway.jsonpath json-path @@ -108,7 +112,7 @@ com.fasterxml.jackson.core jackson-databind - 2.9.5 + 2.9.6 @@ -130,7 +134,7 @@ xerces xercesImpl - 2.11.0-atlassian-01 + 2.12.0 diff --git a/UniversalVesAdapter/src/main/java/org/onap/universalvesadapter/service/VESAdapterInitializer.java b/UniversalVesAdapter/src/main/java/org/onap/universalvesadapter/service/VESAdapterInitializer.java index f92511e..ca1bcc9 100644 --- a/UniversalVesAdapter/src/main/java/org/onap/universalvesadapter/service/VESAdapterInitializer.java +++ b/UniversalVesAdapter/src/main/java/org/onap/universalvesadapter/service/VESAdapterInitializer.java @@ -79,11 +79,40 @@ public class VESAdapterInitializer implements CommandLineRunner, Ordered { } else { - - LOGGER.info(">>>Static configuration to be used"); - + final String url = "http://localhost:8085/start"; + final String USER_AGENT = "Mozilla/5.0"; + + try { + URL obj = new URL(url); + HttpURLConnection httpURLConnection = (HttpURLConnection) obj.openConnection(); + + // optional default is GET + httpURLConnection.setRequestMethod("GET"); + + // add request header + httpURLConnection.setRequestProperty("User-Agent", USER_AGENT); + int responseCode = httpURLConnection.getResponseCode(); + LOGGER.info("Sending 'GET' request to URL : " + url); + LOGGER.info("Response Code : " + responseCode); + BufferedReader in = new BufferedReader(new InputStreamReader(httpURLConnection.getInputStream())); + String inputLine; + StringBuffer response = new StringBuffer(); + + while ((inputLine = in.readLine()) != null) { + response.append(inputLine); + } + in.close(); + + // print result + LOGGER.info("The result is :" + response.toString()); + + } catch (Exception e) { + LOGGER.error("Error occured due to :" + e.getMessage()); + e.printStackTrace(); + } + } } diff --git a/UniversalVesAdapter/src/main/resources/application.properties b/UniversalVesAdapter/src/main/resources/application.properties index c2dec51..c940da4 100644 --- a/UniversalVesAdapter/src/main/resources/application.properties +++ b/UniversalVesAdapter/src/main/resources/application.properties @@ -8,11 +8,11 @@ mapperConfig.file=../UniversalVesAdapter/src/main/resources/MapperConfig.json dmaap.mr_props=DMaapMR.properties #DEV Machine DB Details -spring.datasource.url=jdbc:postgresql://10.49.16.19:5432/dummy -spring.datasource.username=postgres -spring.datasource.password=root +#spring.datasource.url=jdbc:postgresql://10.49.16.19:5432/dummy +#spring.datasource.username=postgres +#spring.datasource.password=root #Lab Details -#spring.datasource.url=jdbc:postgresql://10.53.172.129:5432/dummy -#spring.datasource.username=ngpuser -#spring.datasource.password=root \ No newline at end of file +spring.datasource.url=jdbc:postgresql://10.53.172.129:5432/dummy +spring.datasource.username=ngpuser +spring.datasource.password=root \ No newline at end of file diff --git a/pom.xml b/pom.xml index f2c805f..7342310 100644 --- a/pom.xml +++ b/pom.xml @@ -67,7 +67,7 @@ 2.2.0 2.2.0 - 4.5.2 + 4.5.6 3.5 1.0.0 diff --git a/snmpmapper/pom.xml b/snmpmapper/pom.xml index 4306ae3..0180e6a 100644 --- a/snmpmapper/pom.xml +++ b/snmpmapper/pom.xml @@ -25,20 +25,20 @@ - org.springframework.webflow - spring-webflow - 2.5.0.RELEASE - + org.springframework.webflow + spring-webflow + 2.5.0.RELEASE + org.springframework.boot spring-boot-starter-thymeleaf - 2.0.3.RELEASE + 2.0.4.RELEASE org.springframework.boot spring-boot-starter-web - 2.0.3.RELEASE + 2.0.4.RELEASE @@ -52,6 +52,16 @@ spring-boot-starter-data-jpa 2.0.3.RELEASE + + org.springframework + spring-core + 5.0.5.RELEASE + + + org.springframework + spring-expression + 5.0.9.RELEASE + org.postgresql postgresql diff --git a/snmpmapper/src/main/resources/application.properties b/snmpmapper/src/main/resources/application.properties index cf4f33c..2121542 100644 --- a/snmpmapper/src/main/resources/application.properties +++ b/snmpmapper/src/main/resources/application.properties @@ -1,7 +1,12 @@ server.port=9090 -spring.datasource.url=jdbc:postgresql://10.49.16.19:5432/dummy -spring.datasource.username=postgres +#spring.datasource.url=jdbc:postgresql://10.49.16.19:5432/dummy +#spring.datasource.username=postgres +#spring.datasource.password=root + +spring.datasource.url=jdbc:postgresql://10.53.172.129:5432/dummy +spring.datasource.username=ngpuser spring.datasource.password=root + spring.jpa.properties.hibernate.jdbc.lob.non_contextual_creation=true spring.jpa.properties.hibernate.temp.use_jdbc_metadata_defaults=false spring.servlet.multipart.enabled=true -- cgit 1.2.3-korg