diff options
19 files changed, 260 insertions, 570 deletions
diff --git a/ncomp-utils-java-extra/pom.xml b/ncomp-utils-java-extra/pom.xml index 7740f13..99b2e09 100644 --- a/ncomp-utils-java-extra/pom.xml +++ b/ncomp-utils-java-extra/pom.xml @@ -10,6 +10,10 @@ + + + + <properties> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <maven.compiler.target>1.7</maven.compiler.target> @@ -29,7 +33,6 @@ - <build> <plugins> diff --git a/ncomp-utils-java-extra/src/main/java/org/openecomp/ncomp/utils/extra/FileTail.java b/ncomp-utils-java-extra/src/main/java/org/openecomp/ncomp/utils/extra/FileTail.java index 623733d..c0c2e33 100644 --- a/ncomp-utils-java-extra/src/main/java/org/openecomp/ncomp/utils/extra/FileTail.java +++ b/ncomp-utils-java-extra/src/main/java/org/openecomp/ncomp/utils/extra/FileTail.java @@ -173,22 +173,26 @@ public class FileTail { continue; } RandomAccessFile rf = new RandomAccessFile(file, "r"); - rf.seek(p); - String line = null; - while ((line = rf.readLine()) != null) { - if (line.length() == 0) - continue; - if (logger.isDebugEnabled()) - logger.debug("New line from file: " + f + " " + line); - p = rf.getFilePointer(); - try { - handler.newLine(file.getAbsolutePath(),line,context); - } catch (Exception e) { - logger.warn("Handler error: " + f + " " + e + " line=" + line); - e.printStackTrace(); + try { + rf.seek(p); + String line = null; + while ((line = rf.readLine()) != null) { + if (line.length() == 0) + continue; + if (logger.isDebugEnabled()) + logger.debug("New line from file: " + f + " " + line); + p = rf.getFilePointer(); + try { + handler.newLine(file.getAbsolutePath(),line,context); + } catch (Exception e) { + logger.warn("Handler error: " + f + " " + e + " line=" + line); + e.printStackTrace(); + } } } - rf.close(); + finally { + rf.close(); + } } synchronized (this) { filePointerMap.put(f, p); diff --git a/ncomp-utils-java/pom.xml b/ncomp-utils-java/pom.xml index 595d692..94f65d0 100644 --- a/ncomp-utils-java/pom.xml +++ b/ncomp-utils-java/pom.xml @@ -10,6 +10,10 @@ + + + + <properties> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <maven.compiler.target>1.7</maven.compiler.target> @@ -30,8 +34,7 @@ - -<build> + <build> <plugins> <plugin> <groupId>org.sonatype.plugins</groupId> @@ -114,6 +117,16 @@ <artifactId>snakeyaml</artifactId> <version>1.15</version> </dependency> + <dependency> + <groupId>commons-io</groupId> + <artifactId>commons-io</artifactId> + <version>2.5</version> + </dependency> + <dependency> + <groupId>com.mikesamuel</groupId> + <artifactId>json-sanitizer</artifactId> + <version>[1.0,)</version> + </dependency> </dependencies> @@ -131,28 +144,28 @@ <site> <id>ecomp-site</id> <url>${site.url}</url> - </site> - </distributionManagement> - - <reporting> - <plugins> - <plugin> - <groupId>org.apache.maven.plugins</groupId> - <artifactId>maven-javadoc-plugin</artifactId> - <version>2.10.4</version> - <configuration> - <failOnError>false</failOnError> - <doclet>org.umlgraph.doclet.UmlGraphDoc</doclet> - <docletArtifact> - <groupId>org.umlgraph</groupId> - <artifactId>umlgraph</artifactId> - <version>5.6</version> - </docletArtifact> - <additionalparam>-views</additionalparam> - <useStandardDocletOptions>true</useStandardDocletOptions> - </configuration> - </plugin> - </plugins> - </reporting> + </site> + </distributionManagement> + + <reporting> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-javadoc-plugin</artifactId> + <version>2.10.4</version> + <configuration> + <failOnError>false</failOnError> + <doclet>org.umlgraph.doclet.UmlGraphDoc</doclet> + <docletArtifact> + <groupId>org.umlgraph</groupId> + <artifactId>umlgraph</artifactId> + <version>5.6</version> + </docletArtifact> + <additionalparam>-views</additionalparam> + <useStandardDocletOptions>true</useStandardDocletOptions> + </configuration> + </plugin> + </plugins> + </reporting> </project> diff --git a/ncomp-utils-java/src/main/java/org/json/HTTP.java b/ncomp-utils-java/src/main/java/org/json/HTTP.java index ef37d2d..d3f03f7 100644 --- a/ncomp-utils-java/src/main/java/org/json/HTTP.java +++ b/ncomp-utils-java/src/main/java/org/json/HTTP.java @@ -95,7 +95,7 @@ public class HTTP { String t; t = x.nextToken(); - if (t.toUpperCase().startsWith("HTTP")) { + if (t.length() > 3 && t.substring(0,4).equalsIgnoreCase("HTTP")) { // Response diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/CryptoUtils.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/CryptoUtils.java index df35eb9..034bc03 100644 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/CryptoUtils.java +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/CryptoUtils.java @@ -91,7 +91,7 @@ public class CryptoUtils { public static InputStream getInputStream(final InputStream in, final EncryptionType type, final String key) { final Cipher aes; - logger.debug("crypto in stream:" + PropertyUtil.replaceForLogForcingProtection(type) + " " + PropertyUtil.replaceForLogForcingProtection(key)); + logger.debug("crypto in stream:" + p(type) + " " + p(key)); try { aes = Cipher.getInstance("AES/ECB/PKCS5Padding"); switch (type) { @@ -109,6 +109,11 @@ public class CryptoUtils { throw new RuntimeException("encryption failed:" + e); } } + + private static String p(Object v) { + return SecurityUtils.logForcingProtection(v); + } + public static OutputStream getOutputStream(final OutputStream out, final EncryptionType type, final String key) { final Cipher aes; @@ -141,7 +146,7 @@ public class CryptoUtils { ByteArrayOutputStream o = new ByteArrayOutputStream(); InputStream in = null; try { - in = new FileInputStream(FileUtils.safeFileName(fileName)); + in = new FileInputStream(SecurityUtils.safeFileName(fileName)); FileUtils.copyStream(in, o); } catch (IOException e) { throw new RuntimeException("getKey failed:" + e); @@ -167,8 +172,8 @@ public class CryptoUtils { } if (command.equals("file")) { EncryptionType t = EncryptionType.valueOf(args[1].toUpperCase()); - InputStream in = new FileInputStream(FileUtils.safeFileName(args[2])); - OutputStream out = new FileOutputStream(FileUtils.safeFileName(args[3])); + InputStream in = new FileInputStream(SecurityUtils.safeFileName(args[2])); + OutputStream out = new FileOutputStream(SecurityUtils.safeFileName(args[3])); try { in = getInputStream(in, t, args[4]); FileUtils.copyStream(in, out); @@ -195,7 +200,7 @@ public class CryptoUtils { PrivateKey privateKey = keyPair.getPrivate(); FileOutputStream out = null; try { - out = new FileOutputStream(FileUtils.safeFileName(key + ".private")); + out = new FileOutputStream(SecurityUtils.safeFileName(key + ".private")); out.write(encode64(privateKey.getEncoded()).getBytes()); } catch (Exception e) { e.printStackTrace(); @@ -205,7 +210,7 @@ public class CryptoUtils { out.close(); } try { - out = new FileOutputStream(FileUtils.safeFileName(key + ".public")); + out = new FileOutputStream(SecurityUtils.safeFileName(key + ".public")); out.write(encode64(publicKey.getEncoded()).getBytes()); } catch (Exception e) { e.printStackTrace(); @@ -244,7 +249,7 @@ public class CryptoUtils { InputStream fis = null; MessageDigest complete = null; try { - fis = new FileInputStream(FileUtils.safeFileName(filename)); + fis = new FileInputStream(SecurityUtils.safeFileName(filename)); byte[] buffer = new byte[1024]; complete = MessageDigest.getInstance("MD5"); int numRead; diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/CryptoUtilsTest.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/CryptoUtilsTest.java index a8d2021..fd4671a 100644 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/CryptoUtilsTest.java +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/CryptoUtilsTest.java @@ -68,23 +68,27 @@ public class CryptoUtilsTest extends TestCase { digest.update("foobar".getBytes()); SecretKeySpec key1 = new SecretKeySpec(digest.digest(), 0, 16, "AES"); aes.init(Cipher.ENCRYPT_MODE, key1); - InputStream in = new FileInputStream("test/Test.txt"); - in = new CipherInputStream(in, aes); - FileOutputStream out = new FileOutputStream("test/Encrypted.txt"); + InputStream in = null; + FileOutputStream out = null; try { - FileUtils.copyStream(in, out); + in = new FileInputStream("test/Test.txt"); + CipherInputStream in2 = new CipherInputStream(in, aes); + out = new FileOutputStream("test/Encrypted.txt"); + FileUtils.copyStream(in2, out); } finally { if (in != null) in.close(); if (out != null) out.close(); } + in = null; + out = null; aes.init(Cipher.DECRYPT_MODE, key1); - in = new FileInputStream("test/Encrypted.txt"); - in = new CipherInputStream(in, aes); - out = new FileOutputStream("test/Decrypted.txt"); try { - FileUtils.copyStream(in, out); + in = new FileInputStream("test/Encrypted.txt"); + CipherInputStream in2 = new CipherInputStream(in, aes); + out = new FileOutputStream("test/Decrypted.txt"); + FileUtils.copyStream(in2, out); } finally { if (in != null) in.close(); @@ -95,25 +99,35 @@ public class CryptoUtilsTest extends TestCase { } @SuppressWarnings("resource") public void test_streams_2() throws Exception { - InputStream in = new FileInputStream("test/Test.txt"); - in = getInputStream(in, EncryptionType.ENCRYPT, k); - FileOutputStream out = new FileOutputStream("test/Encrypted.txt"); + InputStream in = null; + InputStream in2 = null; + FileOutputStream out = null; try { - FileUtils.copyStream(in, out); + in = new FileInputStream("test/Test.txt"); + in2 = getInputStream(in, EncryptionType.ENCRYPT, k); + out = new FileOutputStream("test/Encrypted.txt"); + FileUtils.copyStream(in2, out); } finally { if (in != null) in.close(); + if (in2 != null) + in2.close(); if (out != null) out.close(); } - in = new FileInputStream("test/Encrypted.txt"); - in = getInputStream(in, EncryptionType.DECRYPT, k); - out = new FileOutputStream("test/Decrypted.txt"); + in = null; + in2 = null; + out = null; try { - FileUtils.copyStream(in, out); + in = new FileInputStream("test/Encrypted.txt"); + in2 = getInputStream(in, EncryptionType.DECRYPT, k); + out = new FileOutputStream("test/Decrypted.txt"); + FileUtils.copyStream(in2, out); } finally { if (in != null) in.close(); + if (in2 != null) + in2.close(); if (out != null) out.close(); } diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/DiffUtilTest.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/DiffUtilTest.java index 9369372..d7f8187 100644 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/DiffUtilTest.java +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/DiffUtilTest.java @@ -149,12 +149,12 @@ public class DiffUtilTest extends TestCase { assertEquals("editDist random 1000 0.01", d1,d2); d2 = DiffUtil.editDistSimple(alist, blist); assertEquals("editDistSimple random 1000 0.01", d1,d2); - d1 = gentest(120, alist, blist, 1000, 0.1, 0.1, 0.1); + d1 = gentest(SecurityUtils.inSecureSeed(120), alist, blist, 1000, 0.1, 0.1, 0.1); d2 = DiffUtil.editDistStats(alist, blist); assertEquals("editDist random 1000 0.1", 265,d2); d2 = DiffUtil.editDistSimple(alist, blist); assertEquals("editDistSimple random 1000 0.1", 265,d2); - d1 = gentest(130, alist, blist, 10000, 0.01, 0.01, 0.01); + d1 = gentest(SecurityUtils.inSecureSeed(130), alist, blist, 10000, 0.01, 0.01, 0.01); d2 = DiffUtil.editDistStats(alist, blist); assertEquals("editDist random 10000 0.01", 296, d2); // d2 = DiffUtil.editDistSimple(alist, blist); diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/PropertyUtil.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/PropertyUtil.java index 56710a3..c5e0bdd 100644 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/PropertyUtil.java +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/PropertyUtil.java @@ -70,19 +70,19 @@ public class PropertyUtil { } for (Object k : System.getProperties().keySet()) { - Object v = props.get(k); + Object v = props.get(p(k)); if (v != null) { - logger.info("Overwriting property from system property: " + replaceForLogForcingProtection(k) + " = " + replaceForLogForcingProtection(v)); + logger.info("Overwriting property from system property: " + p(k) + " = " + p(v)); } props.put(k, System.getProperties().get(k)); } - String hostname = InetAddress.getLocalHost().getHostName(); + String hostname = SecurityUtils.getHostName(); props.put("user.hostname", hostname); return props; } - public static String replaceForLogForcingProtection(Object v) { - return v.toString().replace("\n", "NEWLINE"); + private static String p(Object v) { + return SecurityUtils.logForcingProtection(v); } } diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/SecurityUtils.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/SecurityUtils.java new file mode 100644 index 0000000..73fa377 --- /dev/null +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/SecurityUtils.java @@ -0,0 +1,71 @@ +package org.openecomp.ncomp.utils; + +import java.io.File; +import java.net.InetAddress; +import java.net.UnknownHostException; +import java.util.List; + +public class SecurityUtils { + public static String whiteList(String str, List<String> l, String reason) { + if (l.contains(str)) { + return str; + } + throw new RuntimeException("String not trusted: " + str + " " + reason); + } + public static double inSecureRandom() { + return (Math.random()*100.0)/100; + } + public static long inSecureSeed(long seed) { + return seed; + } + public static String logForcingProtection(Object v) { + return v.toString().replace("\n", "NEWLINE"); + } + + public static File createSafeFile(File dir, String fname) { + String fname2 = dir.getAbsolutePath() + "/" + fname; + return new File(safeFileName(fname2)); + } + + public static String safeFileName(String file) { + // creating file with safer creation. + if (file.contains("../")) + throw new RuntimeException("File name contain ..: " + file); + if (file.contains("\n")) + throw new RuntimeException("File name contain newline: " + file); + return file; + } + + public static File safeFile(File file) { + // creating file with safer creation. + if (file.getAbsolutePath().contains("..")) + throw new RuntimeException("File name contain ..: " + file.getAbsolutePath()); + return file; + } + public static String getHostName() { + try { + return InetAddress.getLocalHost().getHostName(); + } catch (UnknownHostException e) { + e.printStackTrace(); + throw new RuntimeException("HOSTNAME-UNKNOWN"); + } + } + public static String getHostAddress() { + try { + return InetAddress.getLocalHost().getHostAddress(); + } catch (UnknownHostException e) { + e.printStackTrace(); + throw new RuntimeException("HOSTNAME-UNKNOWN"); + } + } + public static String getCanonicalHostName() { + try { + return InetAddress.getLocalHost().getCanonicalHostName(); + } catch (UnknownHostException e) { + e.printStackTrace(); + throw new RuntimeException("HOSTNAME-UNKNOWN"); + } + } + + +} diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/emf/EReader.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/emf/EReader.java deleted file mode 100644 index fda7f13..0000000 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/emf/EReader.java +++ /dev/null @@ -1,118 +0,0 @@ - -/*- - * ============LICENSE_START========================================== - * OPENECOMP - DCAE - * =================================================================== - * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. - * =================================================================== - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * ============LICENSE_END============================================ - */ - -package org.openecomp.ncomp.utils.emf; - -import java.io.BufferedReader; -import java.io.File; -import java.io.IOException; -import java.util.Iterator; - -import org.eclipse.emf.ecore.EObject; - -import org.openecomp.ncomp.webservice.utils.FileUtils; - -public class EReader<T extends EObject> implements Iterator<T>, Iterable<T> { - private EStringUtil<T> util = null; - private BufferedReader reader; - private String fileName; - private String line; - private T e = null; - - public EReader(String fileName2, EStringUtil<T> u, boolean isFilename) { - util = u; - fileName = fileName2; - if (isFilename) - reader = FileUtils.filename2reader(fileName2, u.errors); - else - reader = FileUtils.cmd2reader(fileName2); - } - public EReader(String fileName2, EStringUtil<T> u) { - util = u; - fileName = fileName2; - reader = FileUtils.filename2reader(fileName2, u.errors); - } - - public EReader(File file, EStringUtil<T> u) { - util = u; - fileName = file.getName(); - reader = FileUtils.filename2reader(fileName, u.errors); - } - - /** - * - * @return An T object for the next line (null if empty). Note the object is - * not a new object. Uses EcoreUtils.copy if needed. - */ - private T findNext() { - line = null; - try { - if (reader == null) - return null; - line = reader.readLine(); - if (line == null) { - reader.close(); - reader = null; - } - } catch (IOException e) { - // TODO Auto-generated catch block - e.printStackTrace(); - } - if (line == null) - return null; - try { - return util.str2ecore(line); - } catch (Exception e) { - throw new RuntimeException("Read error in " + fileName + " : " + e); - } - } - - public String getFileName() { - return fileName; - } - @Override - public boolean hasNext() { - if (e != null) return true; - e = findNext(); - // TODO Auto-generated method stub - return e != null; - } - @Override - public void remove() { - throw new RuntimeException("Can not remove from a reader"); - } - @Override - public T next() { - if (e != null) { - T ee = e; - e = null; - return ee; - } - return findNext(); - } - @Override - public Iterator<T> iterator() { - return this; - } - public String getLine() { - return line; - } -} diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/emf/EStringUtil.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/emf/EStringUtil.java index e8e86da..3686621 100644 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/emf/EStringUtil.java +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/emf/EStringUtil.java @@ -23,6 +23,7 @@ package org.openecomp.ncomp.utils.emf; import java.io.BufferedReader; import java.io.IOException; +import java.util.Arrays; import java.util.List; import org.eclipse.emf.common.util.BasicEList; @@ -37,6 +38,7 @@ import org.eclipse.emf.ecore.resource.ResourceSet; import org.eclipse.emf.ecore.resource.impl.ResourceSetImpl; import org.eclipse.emf.ecore.util.EcoreUtil; import org.eclipse.emf.ecore.xmi.impl.XMIResourceFactoryImpl; +import org.openecomp.ncomp.utils.SecurityUtils; import org.openecomp.ncomp.webservice.utils.ErrorMap; import org.openecomp.ncomp.webservice.utils.FileUtils; @@ -194,14 +196,9 @@ public class EStringUtil<T extends EObject> { } // ensure that not arbitary regexp is evaluated: Denial of Service: Regular Expression + private List<String> allowedDelimeter = Arrays.asList("\\|",",",":","\t"); private String checkRegexp(String regexp) { - switch (regexp) { - case "\\|": - case ":": - case "\t": - case ",": return regexp; - } - throw new RuntimeException("Regexp not trusted: " + regexp); + return SecurityUtils.whiteList(regexp,allowedDelimeter,"Denial of Service: Regular Expression"); } private String fixValue(EDataType t, String v) { diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/maps/InetPrefix.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/maps/InetPrefix.java deleted file mode 100644 index ce1866f..0000000 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/maps/InetPrefix.java +++ /dev/null @@ -1,88 +0,0 @@ - -/*- - * ============LICENSE_START========================================== - * OPENECOMP - DCAE - * =================================================================== - * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. - * =================================================================== - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * ============LICENSE_END============================================ - */ - -package org.openecomp.ncomp.utils.maps; - -import java.net.InetAddress; - -import org.openecomp.ncomp.webservice.utils.IpUtils; - -public class InetPrefix { - @Override - public int hashCode() { - final int prime = 31; - int result = 1; - result = prime * result + ((ip == null) ? 0 : ip.hashCode()); - result = prime * result + maskLength; - return result; - } - @Override - public boolean equals(Object obj) { - if (this == obj) - return true; - if (obj == null) - return false; - if (getClass() != obj.getClass()) - return false; - InetPrefix other = (InetPrefix) obj; - if (ip == null) { - if (other.ip != null) - return false; - } else if (!ip.equals(other.ip)) - return false; - if (maskLength != other.maskLength) - return false; - return true; - } - public InetPrefix(InetAddress ip, int maskLength) { - this.ip = IpUtils.mask(ip, maskLength); - this.maskLength = maskLength; - } - public InetPrefix(String s) { - String a[] = s.split("/"); - if (a.length == 2 && IpUtils.isIp(a[0])) { - this.maskLength = Integer.parseInt(a[1]); - this.ip = IpUtils.mask(IpUtils.toInetAddress(a[0]), maskLength); - return; - } - throw new RuntimeException("bad prefix" + s); - } - public InetAddress getIp() { - return ip; - } - protected void setIp(InetAddress ip) { - this.ip = ip; - } - public int getMaskLength() { - return maskLength; - } - protected void setMaskLength(int maskLength) { - this.maskLength = maskLength; - } - private InetAddress ip; - private int maskLength; - @Override - public String toString() { - return ip.getHostAddress() + "/" + maskLength; - } - - -} diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/maps/PersistedHashMap.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/maps/PersistedHashMap.java index 0ccf713..814c91e 100644 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/maps/PersistedHashMap.java +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/utils/maps/PersistedHashMap.java @@ -22,6 +22,7 @@ package org.openecomp.ncomp.utils.maps; import java.io.Serializable; +import java.util.Arrays; import java.util.HashMap; import org.openecomp.ncomp.webservice.utils.FileUtils; @@ -36,7 +37,7 @@ public class PersistedHashMap<K extends Serializable, V extends Serializable> ex this.file = file; HashMap<K, V> m = null; try { - m = (HashMap<K, V>) FileUtils.file2object(file); + m = (HashMap<K, V>) FileUtils.file2object(file,Arrays.asList(PersistedDateHashMap.class.getName())); } catch (Exception e) { } if (m != null) diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/ByteBufferUtils.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/ByteBufferUtils.java index fbb0550..366d210 100644 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/ByteBufferUtils.java +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/ByteBufferUtils.java @@ -71,7 +71,7 @@ public class ByteBufferUtils { ip = 256 * ip + getInt(buf); ip = 256 * ip + getInt(buf); ip = 256 * ip + getInt(buf); - if (debug ) System.out.println ( "getIpInt: " + IpUtils.toString(ip)); +// if (debug ) System.out.println ( "getIpInt: " + IpUtils.toString(ip)); return ip; } diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/FileUtils.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/FileUtils.java index 7c2e16d..6bc90f6 100644 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/FileUtils.java +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/FileUtils.java @@ -60,6 +60,8 @@ import org.eclipse.emf.ecore.util.Diagnostician; import org.eclipse.emf.ecore.xmi.XMLResource; import org.eclipse.emf.ecore.xmi.impl.XMIResourceFactoryImpl; import org.eclipse.emf.ecore.xmi.util.XMLProcessor; +import org.openecomp.ncomp.utils.SecurityUtils; +import org.apache.commons.io.serialization.ValidatingObjectInputStream; public class FileUtils { public static final Logger logger = Logger.getLogger("org.openecomp.ncomp.utils.io"); @@ -109,7 +111,7 @@ public class FileUtils { resource.getContents().add(ecore); // error = validate(req,0); // if (error != null) throw new Exception("Bad request"); - FileOutputStream fos = new FileOutputStream(FileUtils.safeFileName(fileName)); + FileOutputStream fos = new FileOutputStream(SecurityUtils.safeFileName(fileName)); Map<String, Object> options = new HashMap<String, Object>(); // gz is misleading, but supported for backwards compatibility if (fileName.endsWith("zip") || fileName.endsWith("gz")) { @@ -127,7 +129,7 @@ public class FileUtils { init(); Resource resource = resourceSet.createResource(URI.createURI(fileName)); resource.getContents().addAll(ecores); - FileOutputStream fos = new FileOutputStream(FileUtils.safeFileName(fileName)); + FileOutputStream fos = new FileOutputStream(SecurityUtils.safeFileName(fileName)); Map<String, Object> options = new HashMap<String, Object>(); // gz is misleading, but supported for backwards compatibility if (fileName.endsWith("zip") || fileName.endsWith("gz")) { @@ -162,7 +164,7 @@ public class FileUtils { } static public EObject file2ecore_old(String fileName, boolean unload, boolean useCommonRS) { - File file = new File(FileUtils.safeFileName(fileName)); + File file = new File(SecurityUtils.safeFileName(fileName)); if (!file.exists()) { throw new RuntimeException("File does not exists: " + fileName); } @@ -212,7 +214,7 @@ public class FileUtils { } static public EList<EObject> file2ecores(String fileName, boolean unload, boolean useCommonRS) { - File file = new File(FileUtils.safeFileName(fileName)); + File file = new File(SecurityUtils.safeFileName(fileName)); if (!file.exists()) { throw new RuntimeException("File does not exists: " + fileName); } @@ -240,11 +242,11 @@ public class FileUtils { try { resource.load(options); } catch (IOException e1) { - logger.error("I/O error loading " + safeFileName(fileName) + " : " + e1.getMessage()); + logger.error("I/O error loading " + SecurityUtils.safeFileName(fileName) + " : " + e1.getMessage()); e1.printStackTrace(); return res; } catch (Exception e1) { - logger.error("Content error loading " + safeFileName(fileName) + " : " + e1.getMessage()); + logger.error("Content error loading " + SecurityUtils.safeFileName(fileName) + " : " + e1.getMessage()); e1.printStackTrace(); return res; } @@ -301,10 +303,10 @@ public class FileUtils { public static InputStream filename2stream(String fileName, ErrorMap errors) { InputStream res = null; - File aFile = new File(FileUtils.safeFileName(fileName)); + File aFile = new File(SecurityUtils.safeFileName(fileName)); if (!aFile.canRead()) { // try to see if a file with .gz extention exists. - aFile = new File(FileUtils.safeFileName(fileName + ".gz")); + aFile = new File(SecurityUtils.safeFileName(fileName + ".gz")); if (aFile.canRead()) return filename2stream(fileName + ".gz", errors); if (errors != null) @@ -315,7 +317,7 @@ public class FileUtils { logger.debug("Reading " + fileName); if (fileName.endsWith(".gz")) { try { - res = new GZIPInputStream(new FileInputStream(FileUtils.safeFileName(fileName)), 524288); + res = new GZIPInputStream(new FileInputStream(SecurityUtils.safeFileName(fileName)), 524288); } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); @@ -384,7 +386,7 @@ public class FileUtils { public static OutputStreamWriter filename2writer(String filename, boolean gzip) { try { - File f = new File(FileUtils.safeFileName(filename)); + File f = new File(SecurityUtils.safeFileName(filename)); if (f.exists()) f.delete(); String p = f.getParent(); if (p != null) { @@ -392,10 +394,10 @@ public class FileUtils { d.mkdirs(); } if (gzip) { - OutputStream s = new GZIPOutputStream(new FileOutputStream(FileUtils.safeFileName(filename)), 524288); + OutputStream s = new GZIPOutputStream(new FileOutputStream(SecurityUtils.safeFileName(filename)), 524288); return new OutputStreamWriter(s); } else - return new FileWriter(FileUtils.safeFileName(filename)); + return new FileWriter(SecurityUtils.safeFileName(filename)); } catch (IOException e) { e.printStackTrace(); return null; @@ -403,7 +405,7 @@ public class FileUtils { } private static void find(String dirName, String regex, List<String> res) { - File dir = new File(FileUtils.safeFileName(dirName)); + File dir = new File(SecurityUtils.safeFileName(dirName)); String[] children = dir.list(); if (children == null) { // Either dir does not exist or is not a directory @@ -411,7 +413,7 @@ public class FileUtils { for (int i = 0; i < children.length; i++) { // Get filename of file or directory String ff = dirName + "/" + children[i]; - File f = new File(FileUtils.safeFileName(ff)); + File f = new File(SecurityUtils.safeFileName(ff)); if (f.isDirectory()) { find(ff, regex, res); } else { @@ -432,7 +434,7 @@ public class FileUtils { public static void ecore2xmlfile(XMLProcessor x, EObject doc, String filename) { FileOutputStream fos = null; try { - fos = new FileOutputStream(FileUtils.safeFileName(filename)); + fos = new FileOutputStream(SecurityUtils.safeFileName(filename)); ResourceSet resourceSet = new ResourceSetImpl(); resourceSet.getResourceFactoryRegistry().getExtensionToFactoryMap() @@ -456,12 +458,12 @@ public class FileUtils { } public static void mkdirForFile(String filename) { - File f = new File(FileUtils.safeFileName(filename)); + File f = new File(SecurityUtils.safeFileName(filename)); f.getParentFile().mkdirs(); } public static boolean uptodate(String filename, String interval) { - File file = new File(FileUtils.safeFileName(filename)); + File file = new File(SecurityUtils.safeFileName(filename)); if (!file.exists()) return false; Date now = new Date(); @@ -471,15 +473,15 @@ public class FileUtils { } public static void touch(String filename) throws IOException { - File file = new File(FileUtils.safeFileName(filename)); + File file = new File(SecurityUtils.safeFileName(filename)); file.createNewFile(); Date now = new Date(); file.setLastModified(now.getTime()); } public static void copyFile(String sourceFile, String destFile) throws IOException { - File from = new File(FileUtils.safeFileName(sourceFile)); - File to = new File(FileUtils.safeFileName(destFile)); + File from = new File(SecurityUtils.safeFileName(sourceFile)); + File to = new File(SecurityUtils.safeFileName(destFile)); copyFile(from, to); } @@ -491,8 +493,8 @@ public class FileUtils { FileChannel source = null; FileChannel destination = null; try { - source = new FileInputStream(FileUtils.safeFile(sourceFile)).getChannel(); - destination = new FileOutputStream(FileUtils.safeFile(destFile)).getChannel(); + source = new FileInputStream(SecurityUtils.safeFile(sourceFile)).getChannel(); + destination = new FileOutputStream(SecurityUtils.safeFile(destFile)).getChannel(); destination.transferFrom(source, 0, source.size()); } finally { if (source != null) { @@ -510,7 +512,7 @@ public class FileUtils { destDir.mkdirs(); } for (File f : sourceDir.listFiles()) { - File dest = createSafeFile(destDir, f.getName()); + File dest = SecurityUtils.createSafeFile(destDir, f.getName()); if (f.isDirectory()) { copyDirectory(f, dest); continue; @@ -542,12 +544,17 @@ public class FileUtils { dir.delete(); } - public static Object file2object(String filename) { + public static Object file2object(String filename, List<String> whiteList) { try { InputStream in = filename2stream(filename, null); if (in == null) return null; - ObjectInputStream r = new ObjectInputStream(in); + ValidatingObjectInputStream r = new ValidatingObjectInputStream(in); + whiteList.add("java.util.*"); + whiteList.add("java.lang.*"); + for (String s : whiteList) { + r.accept(s); + } Object o; try { o = r.readObject(); @@ -565,10 +572,10 @@ public class FileUtils { // TODO Auto-generated method stub try { String f = filename + ".tmp"; - File f1 = new File(safeFileName(f)); - File f2 = new File(safeFileName(filename)); + File f1 = new File(SecurityUtils.safeFileName(f)); + File f2 = new File(SecurityUtils.safeFileName(filename)); if (!f1.getParentFile().exists()) f1.getParentFile().mkdirs(); - ObjectOutputStream w = new ObjectOutputStream(new FileOutputStream(safeFileName(f))); + ObjectOutputStream w = new ObjectOutputStream(new FileOutputStream(SecurityUtils.safeFileName(f))); try { w.writeObject(o); w.flush(); @@ -628,26 +635,6 @@ public class FileUtils { } } - public static File createSafeFile(File dir, String fname) { - String fname2 = dir.getAbsolutePath() + "/" + fname; - return new File(safeFileName(fname2)); - } - - public static String safeFileName(String file) { - // creating file with safer creation. - if (file.contains("../")) - throw new RuntimeException("File name contain ..: " + file); - if (file.contains("\n")) - throw new RuntimeException("File name contain newline: " + file); - return file; - } - - private static File safeFile(File file) { - // creating file with safer creation. - if (file.getAbsolutePath().contains("..")) - throw new RuntimeException("File name contain ..: " + file.getAbsolutePath()); - return file; - } public static Thread copyStreamThread(final InputStream inputStream, final OutputStream outputStream) { Thread t = new Thread() { diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/IpUtils.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/IpUtils.java deleted file mode 100644 index 62da451..0000000 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/IpUtils.java +++ /dev/null @@ -1,217 +0,0 @@ - -/*- - * ============LICENSE_START========================================== - * OPENECOMP - DCAE - * =================================================================== - * Copyright (c) 2017 AT&T Intellectual Property. All rights reserved. - * =================================================================== - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * ============LICENSE_END============================================ - */ - -package org.openecomp.ncomp.webservice.utils; - -import java.net.InetAddress; -import java.net.UnknownHostException; -import java.util.Arrays; -import java.util.StringTokenizer; -import java.util.regex.Pattern; - -public class IpUtils { - public static long toLong(String Ip) { - long res = 0; - try { - StringTokenizer tokens = new StringTokenizer(Ip, "."); - for (int i = 0; i < 4; i++) { - int t = Integer.parseInt(tokens.nextToken()); - if (t < 0 || t > 255) { - throw new RuntimeException("Bad IP: " + Ip); - } - res = 256 * res + t; - } - } catch (Exception e) { - throw new RuntimeException("Bad IP: " + Ip); - } - return res; - } - - public static int toInt(String Ip) { - long x = toLong(Ip); - // if (x<(1<<31)) return (int) x; - // TODO: does this really work?? - // System.out.println(Ip + " " + x); - return (int) x; - } - - public static String toString(int i) { - return ((i >> 24) & 0xFF) + "." + ((i >> 16) & 0xFF) + "." + ((i >> 8) & 0xFF) + "." + (i & 0xFF); - } - - public static int mask2masklen(String string) { - // 255.255.255.252 -> 30 - if (!isIp(string)) { - return Integer.parseInt(string); - } - if (isIpv6(string)) { - throw new RuntimeException("IPv6 is not supported, just use mask length"); - } - StringTokenizer st = new StringTokenizer(string,"."); - int len = 0; - for (int j = 0; j < 4; j++) { - int i = Integer.parseInt(st.nextToken()); - for (int x = 0; x < 8; x++) { - if ((i >> x) % 2 == 1) { - len += 8 - x; - break; - } - - } - } - return len; - } - - private static int[] maskvals = {0,32,31,6,30,9,5,-1,29,16,8,2,4,21,-1,19,28, - 25,15,-1,7,10,1,17,3,22,20,26,-1,11,18,23,27,12,24,13,14}; - - public static int mask2masklen (int ip) { - // This works because 2 is a primitive root mod 37! - // The negation is because % is remainder, not modulus - int indx = -(ip % 37); - if (indx < 0) return -1; // caution for non-masks - return maskvals[indx]; - } - - public static String toPrefixString(int ip, int len) { - ip = (ip >> (32-len)) << (32-len); - return IpUtils.toString(ip) + "/" + len; - } - - private static Pattern ipv4Pattern = Pattern.compile("\\d*\\.\\d*\\.\\d*\\.\\d*"); - public static boolean isIpv4(String to) { - if (to.isEmpty()) return false; - char c = to.charAt(0); - if (c > '9' || c < '0') return false; - return ipv4Pattern.matcher(to).matches(); - } - private static Pattern ipv6Pattern = Pattern.compile("[0-9a-fA-F]*:[0-9a-fA-F]*:[0-9a-fA-F:]*"); - public static boolean isIpv6(String to) { - // bad heuristic but likely works most of the time. - return ipv6Pattern.matcher(to).matches(); - } - - public static boolean isIp(String to) { - return isIpv6(to) || isIpv4(to); - } - static int numBad = 0; - public static InetAddress toInetAddress(String string) { - if (!isIp(string)) return null; - try { - return InetAddress.getByName(string); - } catch (UnknownHostException e) { - if (numBad > 1000) { - e.printStackTrace(); - // We exit here since it is important not to do lots of DNS lookups - // We should validate that the string is a valid IP somehow. - System.exit(-3); - } - } - return null; - } - - public static String toPrefixString(InetAddress ip, int len) { - return mask(ip, len).getHostAddress() + "/" + len; - } - public static String toString(InetAddress ip) { - return ip.getHostAddress(); - } - public static InetAddress mask(InetAddress ip, int prefixMask) { - int oddBits = prefixMask % 8; - int nMaskBytes = prefixMask/8 + (oddBits == 0 ? 0 : 1); - byte[] mask = new byte[nMaskBytes]; -// byte[] addr = Arrays.copyOf(ip.getAddress(), ip.getAddress().length); -// To make this Java 5 compactible. - byte[] addr = new byte[ip.getAddress().length]; - for (int i =0 ; i < ip.getAddress().length ; i ++) - addr[i]=ip.getAddress()[i]; - Arrays.fill(mask, 0, oddBits == 0 ? mask.length : mask.length - 1, (byte)0xFF); - if (oddBits != 0) { - int finalByte = (1 << oddBits) - 1; - finalByte <<= 8-oddBits; - mask[mask.length - 1] = (byte) finalByte; - } - for (int i=0; i < mask.length; i++) { - addr[i] = (byte) (addr[i] & mask[i]); - } - for (int i=nMaskBytes; i < addr.length; i++) { - addr[i] = 0; - } - try { - return InetAddress.getByAddress(addr); - } catch (UnknownHostException e) { - e.printStackTrace(); - System.exit(2); - } - return null; - } - - public static int mask (int ip, int masklen) { - if (masklen == 0) return 0; - return ip & -(1 << (32-masklen)); - } - - public static String defaultPrefix(String tmVersion) { - if (tmVersion.equals("6")) { - return "::/0"; - } - return "0.0.0.0/0"; - } - - public static boolean containedIn(InetAddress ip, InetAddress ip2, int mask) { - return (mask(ip, mask).equals(mask(ip2, mask))); - } - - public static InetAddress anonymize(InetAddress ip) { - byte[] a = ip.getAddress(); - byte[] a2 = Arrays.copyOf(a, a.length); - a2[a.length-1] = (byte) (a2[a.length-1] ^ 17); - try { - return InetAddress.getByAddress(a2); - } catch (UnknownHostException e) { - e.printStackTrace(); - System.exit(3); - } - return null; - } - - public static boolean isIpv4(InetAddress ip) { - return ip.getAddress().length == 4; - } - - public static String firstIp(String prefix) { - String a[] = prefix.split("/"); - int ip = toInt(a[0]); - int len = Integer.parseInt(a[1]); - ip = mask(ip,len); - return toString(ip); - } - - public static String lastIp(String prefix) { - String a[] = prefix.split("/"); - int ip = toInt(a[0]); - int len = Integer.parseInt(a[1]); - if (len == 0) return "255.255.255.255"; - ip = mask(ip,len) + (1 << (32-len)) - 1; - return toString(ip); - } - -} diff --git a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/JsonUtils.java b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/JsonUtils.java index 0fbb1d9..0c2da49 100644 --- a/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/JsonUtils.java +++ b/ncomp-utils-java/src/main/java/org/openecomp/ncomp/webservice/utils/JsonUtils.java @@ -47,6 +47,8 @@ import org.openecomp.ncomp.utils.PropertyUtil; import org.openecomp.ncomp.utils.StringUtil; import org.yaml.snakeyaml.Yaml; +import com.google.json.JsonSanitizer; + public class JsonUtils { public static final Logger logger = Logger.getLogger(JsonUtils.class); HashMap<String, List<String>> features = new HashMap<String, List<String>>(); @@ -296,7 +298,7 @@ public class JsonUtils { in.close(); buf.close(); } - return new JSONObject(buf.toString()); + return new JSONObject(JsonSanitizer.sanitize(buf.toString())); } public static JSONObject file2json(String file, Properties props, String prefix) throws IOException { @@ -313,7 +315,7 @@ public class JsonUtils { String s = buf.toString().replaceAll("##.*", ""); try { s = StringUtil.expandUsingProperties(s, props, prefix); - return new JSONObject(s); + return new JSONObject(JsonSanitizer.sanitize(s)); } catch (JSONException e) { logger.debug("bad JSON String" + s + " " + e); throw e; @@ -345,7 +347,7 @@ public class JsonUtils { if (out.toString().length() == 0) return null; String s = out.toString().replaceAll("##.*", ""); try { - return new JSONObject(s); + return new JSONObject(JsonSanitizer.sanitize(s)); } catch (JSONException e) { logger.debug("bad JSON String" + s + " " + e); throw e; diff --git a/ncomp-utils-journaling/pom.xml b/ncomp-utils-journaling/pom.xml index 9741775..ba76351 100644 --- a/ncomp-utils-journaling/pom.xml +++ b/ncomp-utils-journaling/pom.xml @@ -10,6 +10,10 @@ + + + + <properties> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <maven.compiler.target>1.7</maven.compiler.target> @@ -30,6 +34,8 @@ + + <build> <plugins> @@ -95,6 +101,13 @@ <dependency> + <groupId>commons-io</groupId> + <artifactId>commons-io</artifactId> + <version>2.5</version> + </dependency> + + + <dependency> <groupId>commons-cli</groupId> <artifactId>commons-cli</artifactId> <version>1.3</version> diff --git a/ncomp-utils-journaling/src/main/java/org/openecomp/ncomp/utils/journaling/JournalingObject.java b/ncomp-utils-journaling/src/main/java/org/openecomp/ncomp/utils/journaling/JournalingObject.java index 0be2649..6a41f5d 100644 --- a/ncomp-utils-journaling/src/main/java/org/openecomp/ncomp/utils/journaling/JournalingObject.java +++ b/ncomp-utils-journaling/src/main/java/org/openecomp/ncomp/utils/journaling/JournalingObject.java @@ -35,6 +35,7 @@ import java.util.ArrayList; import java.util.Date; import java.util.HashMap; import java.util.List; +import java.util.ServiceConfigurationError; import org.apache.commons.cli.CommandLine; import org.apache.commons.cli.CommandLineParser; @@ -46,8 +47,7 @@ import org.apache.commons.cli.ParseException; import org.apache.commons.io.serialization.ValidatingObjectInputStream; import org.apache.log4j.Logger; import org.json.JSONObject; - -import org.openecomp.ncomp.webservice.utils.FileUtils; +import org.openecomp.ncomp.utils.SecurityUtils; public abstract class JournalingObject { public static final Logger logger = Logger.getLogger(JournalingObject.class); @@ -94,7 +94,7 @@ public abstract class JournalingObject { dir.mkdirs(); logger.info("creating journaling data structure: " + o.getClass().getName() + " " + dir); File logFile = saveObjectFile(dir, "log.dat"); - File snapshotFile = FileUtils.createSafeFile(dir, "snapshot.dat"); + File snapshotFile = SecurityUtils.createSafeFile(dir, "snapshot.dat"); if (snapshotFile.exists()) { JournalingObject oo = initFromSnapshot(snapshotFile); if (oo != null) { @@ -192,13 +192,11 @@ public abstract class JournalingObject { case SET_METHOD: { try { Field fld = this.getClass().getDeclaredField(e.pname); - fld.setAccessible(true); logAttributeValue(e.pname, e.value); fld.set(this, e.value); } catch (Exception e1) { // TODO Auto-generated catch block - logger.error("Unable to set attribute: " + this.getClass().getName() + " " + e1); - logger.debug("Unable to set attribute: " + e.pname + " " + this.getClass().getName() + " " + e1); + logger.error("Unable to set attribute: " + p(e.pname) + " " + this.getClass().getName() + " " + e1); } return; } @@ -214,6 +212,10 @@ public abstract class JournalingObject { c.play(e, index - 1); } + private String p(String s) { + return SecurityUtils.logForcingProtection(s); + } + protected String eventToString(JournalingEvent e) { switch (e.method) { case SET_METHOD: @@ -235,8 +237,8 @@ public abstract class JournalingObject { } finally { out.close(); } - File f = FileUtils.createSafeFile(dir, fName); - File t = FileUtils.createSafeFile(dir, tName); + File f = SecurityUtils.createSafeFile(dir, fName); + File t = SecurityUtils.createSafeFile(dir, tName); if (f.exists()) { f.delete(); } @@ -279,7 +281,7 @@ public abstract class JournalingObject { snapShotInterval = i; lastSnapShot = new Date(); // make sure snapshots time are randomized and not happening at the same time. - lastSnapShot.setTime(lastSnapShot.getTime()-(long) (i*Math.random())); + lastSnapShot.setTime(lastSnapShot.getTime()-(long) (i*SecurityUtils.inSecureRandom())); } public int getLogSize() { @@ -348,8 +350,8 @@ public abstract class JournalingObject { static private File saveObjectFile(File dir, String fname, Date now) { String fname2 = fname + "." + now.getTime() + "." + num++; - File f1 = FileUtils.createSafeFile(dir, fname); - File f2 = FileUtils.createSafeFile(dir, fname2); + File f1 = SecurityUtils.createSafeFile(dir, fname); + File f2 = SecurityUtils.createSafeFile(dir, fname2); if (f1.exists()) { if (f2.exists()) { f2.delete(); @@ -363,7 +365,7 @@ public abstract class JournalingObject { } static private ObjectOutputStream getObjectFile(File dir, String fname) { - File f1 = FileUtils.createSafeFile(dir, fname); + File f1 = SecurityUtils.createSafeFile(dir, fname); ObjectOutputStream s = null; try { s = new ObjectOutputStream(new BufferedOutputStream(new FileOutputStream(f1))); @@ -377,10 +379,12 @@ public abstract class JournalingObject { int numEvents = 0; Object o = null; try { - FileInputStream fin = new FileInputStream(file); - ValidatingObjectInputStream in = new ValidatingObjectInputStream(fin); - addAccept(in); + FileInputStream fin = null; + ValidatingObjectInputStream in = null; try { + fin = new FileInputStream(file); + in = new ValidatingObjectInputStream(fin); + addAccept(in); while (true) { try { o = in.readUnshared(); @@ -409,7 +413,6 @@ public abstract class JournalingObject { } catch (EOFException e) { logger.debug("initFromLog failed: " + file + " numEvents=" + numEvents + " o=" + o); } catch (Exception e) { - System.err.println(e); logger.debug("initFromLog failed: " + file + " numEvents=" + numEvents + " o=" + o); e.printStackTrace(); } |