diff options
Diffstat (limited to 'ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java')
-rw-r--r-- | ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java | 86 |
1 files changed, 86 insertions, 0 deletions
diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java index e2317e416..142f72b97 100644 --- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java +++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java @@ -36,6 +36,7 @@ import javax.servlet.http.HttpServletResponse; import org.apache.commons.compress.utils.IOUtils; import org.onap.policy.common.logging.flexlogger.FlexLogger; import org.onap.policy.common.logging.flexlogger.Logger; +import org.onap.policy.pap.xacml.rest.DisctionaryNames; import org.onap.policy.rest.dao.CommonClassDao; import org.onap.policy.rest.jpa.ActionList; import org.onap.policy.rest.jpa.ActionPolicyDict; @@ -104,6 +105,14 @@ public class DictionaryImportController { response.getWriter().write("Error"); return; } + + // fix Fortify Path Manipulation issue + if(!isValidDictionaryName(dictionaryName)){ + LOGGER.error("dictionaryName is invalid"); + response.setStatus(HttpServletResponse.SC_BAD_REQUEST); + response.getWriter().write("Error"); + return; + } boolean dictionaryImportExists = false; try{ @@ -710,4 +719,81 @@ public class DictionaryImportController { response.getWriter().write("Error"); } } + + public boolean isValidDictionaryName(String dictionaryName){ + + if(dictionaryName.startsWith(DisctionaryNames.Attribute.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ActionPolicyDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.OnapName.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.MSPolicyDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.VNFType.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.VSCLAction.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ClosedLoopService.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ClosedLoopSite.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.PEPOptions.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.VarbindDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.BRMSParamDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.BRMSControllerDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.BRMSDependencyDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.Settings.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.PrefixList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.SecurityZone.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.Zone.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ServiceList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ServiceGroup.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.AddressGroup.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ProtocolList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ActionList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.TermList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.SearchCriteria.toString())){ + return true; + } + return false; + } }
\ No newline at end of file |