From 8df9c4d2a1ac8fcbf76a38a4bb8a2e42b590ae18 Mon Sep 17 00:00:00 2001 From: "david.mcweeney" Date: Tue, 27 Jul 2021 15:53:14 +0100 Subject: DMAAP-DR Header Injection fix Signed-off-by: david.mcweeney Change-Id: I5eb00945762064a5beeb5ce9c57e24243364c238 Issue-ID: DMAAP-1624 --- .../src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'datarouter-node/src/main') diff --git a/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java b/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java index 0d030683..27fa5f3e 100644 --- a/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java +++ b/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java @@ -253,6 +253,13 @@ public class NodeServlet extends HttpServlet { return; } fileid = fileid.substring(18); + if (req.getHeader("X-DMAAP-DR-PUBLISH-ID") != null && !req.getHeader("X-DMAAP-DR-PUBLISH-ID").matches("^[a-zA-Z0-9_]+$")) { + String reason = "Error validating header"; + eelfLogger.error(reason); + resp.sendError(HttpServletResponse.SC_BAD_REQUEST, reason); + eelfLogger.info(EelfMsgs.EXIT); + return; + } pubid = req.getHeader("X-DMAAP-DR-PUBLISH-ID"); user = "datartr"; // SP6 : Added usr as datartr to avoid null entries for internal routing targets = config.parseRouting(req.getHeader("X-DMAAP-DR-ROUTING")); -- cgit 1.2.3-korg