summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorConor Ward <conor.ward@ericsson.com>2018-09-15 10:33:20 +0000
committerConor Ward <conor.ward@ericsson.com>2018-09-17 14:45:34 +0000
commit47613cbd6f6b96c4b1b5de9eb35997b4bc7f1574 (patch)
treee07387b106675984f43c8f78b0bb8356cce2454b
parent1298e6487340fcb1644c4a0a7e06026d156bdf8f (diff)
Fix GroupServlet Vulnerabilities
Change-Id: I51c0546dcdbbc059db277744218f2b00a2001556 Signed-off-by: Conor Ward <conor.ward@ericsson.com> Issue-ID: DMAAP-775
-rw-r--r--datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/GroupServlet.java97
1 files changed, 58 insertions, 39 deletions
diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/GroupServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/GroupServlet.java
index 8537ff4b..96a9924f 100644
--- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/GroupServlet.java
+++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/GroupServlet.java
@@ -26,18 +26,15 @@ package org.onap.dmaap.datarouter.provisioning;
import java.io.IOException;
import java.io.InvalidObjectException;
-import java.util.Collection;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.json.JSONObject;
-import org.onap.dmaap.datarouter.authz.AuthorizationResponse;
-import org.onap.dmaap.datarouter.provisioning.BaseServlet.ContentHeader;
import org.onap.dmaap.datarouter.provisioning.beans.EventLogRecord;
import org.onap.dmaap.datarouter.provisioning.beans.Group;
-import org.onap.dmaap.datarouter.provisioning.beans.Subscription;
-import org.onap.dmaap.datarouter.provisioning.utils.JSONUtilities;
+
+import static org.onap.dmaap.datarouter.provisioning.utils.HttpServletUtils.sendResponseError;
/**
* This servlet handles provisioning for the &lt;groups&gt; which is generated by the provisioning
@@ -53,13 +50,13 @@ public class GroupServlet extends ProxyServlet {
* DELETE on the &lt;GRUPS&gt; -- not supported.
*/
@Override
- public void doDelete(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+ public void doDelete(HttpServletRequest req, HttpServletResponse resp) {
String message = "DELETE not allowed for the GROUPS.";
EventLogRecord elr = new EventLogRecord(req);
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, message);
+ sendResponseError(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, message, eventlogger);
}
/**
* GET on the the list of groups to a feed/sub.
@@ -67,18 +64,22 @@ public class GroupServlet extends ProxyServlet {
* document for details on how this method should be invoked.
*/
@Override
- public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+ public void doGet(HttpServletRequest req, HttpServletResponse resp) {
EventLogRecord elr = new EventLogRecord(req);
String message = isAuthorizedForProvisioning(req);
if (message != null) {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_FORBIDDEN);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_FORBIDDEN, message);
+ sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
return;
}
if (isProxyServer()) {
- super.doGet(req, resp);
+ try {
+ super.doGet(req, resp);
+ } catch (IOException ioe) {
+ eventlogger.error("IOException" + ioe.getMessage());
+ }
return;
}
String bhdr = req.getHeader(BEHALF_HEADER);
@@ -87,7 +88,7 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
@@ -122,7 +123,7 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
@@ -132,7 +133,11 @@ public class GroupServlet extends ProxyServlet {
eventlogger.info(elr);
resp.setStatus(HttpServletResponse.SC_OK);
resp.setContentType(GROUPFULL_CONTENT_TYPE);
- resp.getOutputStream().print(gup.asJSONObject().toString());
+ try {
+ resp.getOutputStream().print(gup.asJSONObject().toString());
+ } catch (IOException ioe) {
+ eventlogger.error("IOException" + ioe.getMessage());
+ }
// Display a list of Groups
/*Collection<Group> list = Group.getGroupById(groupid);
@@ -149,18 +154,22 @@ public class GroupServlet extends ProxyServlet {
* PUT on the &lt;GROUPS&gt; -- not supported.
*/
@Override
- public void doPut(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+ public void doPut(HttpServletRequest req, HttpServletResponse resp) {
EventLogRecord elr = new EventLogRecord(req);
String message = isAuthorizedForProvisioning(req);
if (message != null) {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_FORBIDDEN);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_FORBIDDEN, message);
+ sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
return;
}
if (isProxyServer()) {
- super.doPut(req, resp);
+ try {
+ super.doPut(req, resp);
+ } catch (IOException ioe) {
+ eventlogger.error("IOException" + ioe.getMessage());
+ }
return;
}
String bhdr = req.getHeader(BEHALF_HEADER);
@@ -169,7 +178,7 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
int groupid = getIdFromPath(req);
@@ -178,7 +187,7 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
Group oldgup = Group.getGroupById(groupid);
@@ -187,7 +196,7 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_NOT_FOUND);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_NOT_FOUND, message);
+ sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
return;
}
// Check with the Authorizer
@@ -208,7 +217,7 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message);
+ sendResponseError(resp, HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message, eventlogger);
return;
}
JSONObject jo = getJSONfromInput(req);
@@ -217,12 +226,12 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
if (intlogger.isDebugEnabled())
intlogger.debug(jo.toString());
- Group gup = null;
+ Group gup;
try {
gup = new Group(jo);
} catch (InvalidObjectException e) {
@@ -230,17 +239,15 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
gup.setGroupid(oldgup.getGroupid());
-
-
Group gb2 = Group.getGroupMatching(gup, oldgup.getGroupid());
if (gb2 != null) {
eventlogger.warn("PROV0011 Creating a duplicate Group: "+gup.getName());
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Duplicate Group:"+gup.getName());
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "Duplicate Group:"+gup.getName(), eventlogger);
return;
}
@@ -251,13 +258,17 @@ public class GroupServlet extends ProxyServlet {
eventlogger.info(elr);
resp.setStatus(HttpServletResponse.SC_OK);
resp.setContentType(GROUPFULL_CONTENT_TYPE);
- resp.getOutputStream().print(gup.asJSONObject().toString());
+ try {
+ resp.getOutputStream().print(gup.asJSONObject().toString());
+ } catch (IOException ioe) {
+ eventlogger.error("IOException" + ioe.getMessage());
+ }
provisioningDataChanged();
} else {
// Something went wrong with the UPDATE
elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG);
+ sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);
}
}
/**
@@ -266,18 +277,22 @@ public class GroupServlet extends ProxyServlet {
* document for details on how this method should be invoked.
*/
@Override
- public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+ public void doPost(HttpServletRequest req, HttpServletResponse resp) {
EventLogRecord elr = new EventLogRecord(req);
String message = isAuthorizedForProvisioning(req);
if (message != null) {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_FORBIDDEN);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_FORBIDDEN, message);
+ sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
return;
}
if (isProxyServer()) {
- super.doPost(req, resp);
+ try {
+ super.doPost(req, resp);
+ } catch (IOException ioe) {
+ eventlogger.error("IOException" + ioe.getMessage());
+ }
return;
}
String bhdr = req.getHeader(BEHALF_HEADER);
@@ -286,7 +301,7 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
/*int feedid = getIdFromPath(req);
@@ -327,7 +342,7 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message);
+ sendResponseError(resp, HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message, eventlogger);
return;
}
JSONObject jo = getJSONfromInput(req);
@@ -336,13 +351,13 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
if (intlogger.isDebugEnabled())
intlogger.debug(jo.toString());
- Group gup = null;
+ Group gup;
try {
gup = new Group(jo);
} catch (InvalidObjectException e) {
@@ -350,7 +365,7 @@ public class GroupServlet extends ProxyServlet {
elr.setMessage(message);
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
//gup.setFeedid(feedid);
@@ -361,7 +376,7 @@ public class GroupServlet extends ProxyServlet {
if (gb2 != null) {
eventlogger.warn("PROV0011 Creating a duplicate Group: "+gup.getName());
elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
- resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Duplicate Group:"+gup.getName());
+ sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "Duplicate Group:"+gup.getName(), eventlogger);
return;
}
@@ -373,13 +388,17 @@ public class GroupServlet extends ProxyServlet {
eventlogger.info(elr);
resp.setStatus(HttpServletResponse.SC_CREATED);
resp.setContentType(GROUPFULL_CONTENT_TYPE);
- resp.getOutputStream().print(gup.asJSONObject().toString());
+ try {
+ resp.getOutputStream().print(gup.asJSONObject().toString());
+ } catch (IOException ioe) {
+ eventlogger.error("IOException" + ioe.getMessage());
+ }
provisioningDataChanged();
} else {
// Something went wrong with the INSERT
elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
eventlogger.info(elr);
- resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG);
+ sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);
}
}
}