diff options
author | GuangrongFu <fu.guangrong@zte.com.cn> | 2021-06-08 13:59:18 +0800 |
---|---|---|
committer | GuangrongFu <fu.guangrong@zte.com.cn> | 2021-06-08 14:06:16 +0800 |
commit | be5ca2b68e80688677d75e5f688199511745570b (patch) | |
tree | 11715da7718c00dcf014bfe72f90e78f07b1d1a2 /holmes-actions/src/main/java/org/onap | |
parent | 4242b93bdf5079fee5339a50d8126e4ea56ad9b6 (diff) |
Trying to fix the XSS problem
Change-Id: I7cb2604d886dba0c13c5c182c59f7d0991bd3ab6
Issue-ID: HOLMES-453
Signed-off-by: GuangrongFu <fu.guangrong@zte.com.cn>
Diffstat (limited to 'holmes-actions/src/main/java/org/onap')
2 files changed, 36 insertions, 22 deletions
diff --git a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java index 3b12399..f72466d 100644 --- a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java +++ b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java @@ -1,12 +1,12 @@ /** - * Copyright 2018 ZTE Corporation. - * + * Copyright 2018 - 2021 ZTE Corporation. + * <p> * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * + * <p> + * http://www.apache.org/licenses/LICENSE-2.0 + * <p> * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -15,15 +15,6 @@ */ package org.onap.holmes.common.utils.transactionid; -import java.io.IOException; -import javax.servlet.Filter; -import javax.servlet.FilterChain; -import javax.servlet.FilterConfig; -import javax.servlet.ServletException; -import javax.servlet.ServletRequest; -import javax.servlet.ServletResponse; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; import lombok.extern.slf4j.Slf4j; import org.apache.commons.lang3.StringUtils; import org.jvnet.hk2.annotations.Service; @@ -31,6 +22,12 @@ import org.slf4j.MDC; import org.slf4j.Marker; import org.slf4j.MarkerFactory; +import javax.servlet.*; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.util.UUID; + @Service @Slf4j @@ -40,19 +37,21 @@ public class TransactionIdFilter implements Filter { public static final Marker ENTRY = MarkerFactory.getMarker("ENTRY"); public static final Marker EXIT = MarkerFactory.getMarker("EXIT"); + private static final String DEFAULT_REQUEST_ID = UUID.randomUUID().toString(); + static { INVOKE_SYNCHRONOUS = MarkerFactory.getMarker("INVOKE"); INVOKE_SYNCHRONOUS.add(MarkerFactory.getMarker("SYNCHRONOUS")); } @Override - public void init(FilterConfig filterConfig) throws ServletException { + public void init(FilterConfig filterConfig) { } @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, - FilterChain filterChain) throws IOException, ServletException { + FilterChain filterChain) throws IOException, ServletException { HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest; AddHeadersHttpServletRequestWrapper requestWithTransactionId = new AddHeadersHttpServletRequestWrapper( httpServletRequest); @@ -60,10 +59,16 @@ public class TransactionIdFilter implements Filter { String requestID = ensureTransactionIdIsPresent(requestWithTransactionId); HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse; - httpServletResponse.setHeader(TransactionIdUtils.REQUEST_ID_HEADER, requestID); + if (TransactionIdUtils.validate(requestID)) { + httpServletResponse.setHeader(TransactionIdUtils.REQUEST_ID_HEADER, requestID); + } else { + log.warn("A mal-formatted request ID has been detected: {}. It will be replaced by the default ID: {}", + requestID, DEFAULT_REQUEST_ID); + requestID = DEFAULT_REQUEST_ID; + } String invocationID = TransactionIdUtils.getUUID(); - httpServletResponse.setHeader(TransactionIdUtils.INVOCATIONIDID_HEADER,invocationID); + httpServletResponse.setHeader(TransactionIdUtils.INVOCATIONIDID_HEADER, invocationID); MDC.put("RequestID", requestID); MDC.put("InvocationID", invocationID); diff --git a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java index be61b92..7d04257 100644 --- a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java +++ b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java @@ -1,12 +1,12 @@ /** * Copyright 2018 ZTE Corporation. - * + * <p> * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * + * <p> + * http://www.apache.org/licenses/LICENSE-2.0 + * <p> * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -17,12 +17,21 @@ package org.onap.holmes.common.utils.transactionid; import lombok.extern.slf4j.Slf4j; +import java.util.regex.Matcher; +import java.util.regex.Pattern; + @Slf4j public class TransactionIdUtils { public static final String REQUEST_ID_HEADER = "X-TransactionID"; public static final String INVOCATIONIDID_HEADER = "X-InvocationID"; + private static final Pattern UUID_PATTERN = Pattern.compile("[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}"); public static String getUUID() { return java.util.UUID.randomUUID().toString(); } + + public static boolean validate(String uuid) { + Matcher matcher = UUID_PATTERN.matcher(uuid); + return matcher.matches(); + } } |