Trying to fix XSS issues

Change-Id: I84d8cfccabf18aa84bb2e8d1428cea0b27e8f254
Issue-ID: HOLMES-453
Signed-off-by: GuangrongFu <fu.guangrong@zte.com.cn>

2 files changed, 10 insertions, 8 deletions

diff --git a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java
index f72466d..9d42b91 100644
--- a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java
+++ b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java
@@ -59,8 +59,9 @@ public class TransactionIdFilter implements Filter {
 
         String requestID = ensureTransactionIdIsPresent(requestWithTransactionId);
         HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse;
-        if (TransactionIdUtils.validate(requestID)) {
-            httpServletResponse.setHeader(TransactionIdUtils.REQUEST_ID_HEADER, requestID);
+        String validatedRequestID = TransactionIdUtils.validate(requestID);
+        if (validatedRequestID != null) {
+            httpServletResponse.setHeader(TransactionIdUtils.REQUEST_ID_HEADER, validatedRequestID);
         } else {
             log.warn("A mal-formatted request ID has been detected: {}. It will be replaced by the default ID: {}",
                     requestID, DEFAULT_REQUEST_ID);
diff --git a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java
index 7d04257..9d301ec 100644
--- a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java
+++ b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java
@@ -15,23 +15,24 @@
  */
 package org.onap.holmes.common.utils.transactionid;
 
-import lombok.extern.slf4j.Slf4j;
-
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-@Slf4j
 public class TransactionIdUtils {
     public static final String REQUEST_ID_HEADER = "X-TransactionID";
     public static final String INVOCATIONIDID_HEADER = "X-InvocationID";
-    private static final Pattern UUID_PATTERN = Pattern.compile("[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}");
+    private static final Pattern UUID_PATTERN = Pattern.compile("^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$");
 
     public static String getUUID() {
         return java.util.UUID.randomUUID().toString();
     }
 
-    public static boolean validate(String uuid) {
+    public static String validate(String uuid) {
         Matcher matcher = UUID_PATTERN.matcher(uuid);
-        return matcher.matches();
+        if (matcher.matches()) {
+            return uuid;
+        }
+
+        return null;
     }
 }