diff options
author | 2021-06-29 16:00:54 +0800 | |
---|---|---|
committer | 2021-06-29 16:00:54 +0800 | |
commit | 732234a32c7413ccf4f49b592ff6ed3e17c7059b (patch) | |
tree | e564a455fe0ed6d3bfa1efcd716107373a8a23c7 /holmes-actions/src/main/java | |
parent | 6f99775bd30cea7a2471ba37b875067a40bd5aeb (diff) |
Trying to fix XSS issues
Change-Id: I84d8cfccabf18aa84bb2e8d1428cea0b27e8f254
Issue-ID: HOLMES-453
Signed-off-by: GuangrongFu <fu.guangrong@zte.com.cn>
Diffstat (limited to 'holmes-actions/src/main/java')
2 files changed, 10 insertions, 8 deletions
diff --git a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java index f72466d..9d42b91 100644 --- a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java +++ b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdFilter.java @@ -59,8 +59,9 @@ public class TransactionIdFilter implements Filter { String requestID = ensureTransactionIdIsPresent(requestWithTransactionId); HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse; - if (TransactionIdUtils.validate(requestID)) { - httpServletResponse.setHeader(TransactionIdUtils.REQUEST_ID_HEADER, requestID); + String validatedRequestID = TransactionIdUtils.validate(requestID); + if (validatedRequestID != null) { + httpServletResponse.setHeader(TransactionIdUtils.REQUEST_ID_HEADER, validatedRequestID); } else { log.warn("A mal-formatted request ID has been detected: {}. It will be replaced by the default ID: {}", requestID, DEFAULT_REQUEST_ID); diff --git a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java index 7d04257..9d301ec 100644 --- a/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java +++ b/holmes-actions/src/main/java/org/onap/holmes/common/utils/transactionid/TransactionIdUtils.java @@ -15,23 +15,24 @@ */ package org.onap.holmes.common.utils.transactionid; -import lombok.extern.slf4j.Slf4j; - import java.util.regex.Matcher; import java.util.regex.Pattern; -@Slf4j public class TransactionIdUtils { public static final String REQUEST_ID_HEADER = "X-TransactionID"; public static final String INVOCATIONIDID_HEADER = "X-InvocationID"; - private static final Pattern UUID_PATTERN = Pattern.compile("[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}"); + private static final Pattern UUID_PATTERN = Pattern.compile("^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$"); public static String getUUID() { return java.util.UUID.randomUUID().toString(); } - public static boolean validate(String uuid) { + public static String validate(String uuid) { Matcher matcher = UUID_PATTERN.matcher(uuid); - return matcher.matches(); + if (matcher.matches()) { + return uuid; + } + + return null; } } |