From be10935d9bd9f08f17a9d23c46865f54b914cf21 Mon Sep 17 00:00:00 2001 From: guangxingwang Date: Wed, 21 Feb 2018 14:09:04 -0600 Subject: Fix Fortify Path Manipulation Issue Fix Fortify path manipulation issue by adding a validation on dictionary name. Issue-ID: POLICY-541 Change-Id: I87492b0d80bf96bebfc029d7d164cdd20ca5ef0f Signed-off-by: guangxingwang --- .../policy/pap/xacml/rest/DisctionaryNames.java | 56 ++++++++++++++ .../controller/DictionaryImportController.java | 86 ++++++++++++++++++++++ 2 files changed, 142 insertions(+) create mode 100644 ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/DisctionaryNames.java (limited to 'ONAP-PAP-REST/src/main') diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/DisctionaryNames.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/DisctionaryNames.java new file mode 100644 index 000000000..f0dfa0ad2 --- /dev/null +++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/DisctionaryNames.java @@ -0,0 +1,56 @@ +/*- + * ============LICENSE_START======================================================= + * ONAP-Logging + * ================================================================================ + * Copyright (C) 2018 AT&T Intellectual Property. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + + +package org.onap.policy.pap.xacml.rest; + +/** + * + * MessageCodes contains all the valid Dictionary names + * + */ +public enum DisctionaryNames { + + Attribute, + ActionPolicyDictionary, + OnapName, + MSPolicyDictionary, + VNFType, + VSCLAction, + ClosedLoopService, + ClosedLoopSite, + PEPOptions, + VarbindDictionary, + BRMSParamDictionary, + BRMSControllerDictionary, + BRMSDependencyDictionary, + Settings, + PrefixList, + SecurityZone, + Zone, + ServiceList, + ServiceGroup, + AddressGroup, + ProtocolList, + ActionList, + TermList, + SearchCriteria +} + diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java index e2317e416..142f72b97 100644 --- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java +++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java @@ -36,6 +36,7 @@ import javax.servlet.http.HttpServletResponse; import org.apache.commons.compress.utils.IOUtils; import org.onap.policy.common.logging.flexlogger.FlexLogger; import org.onap.policy.common.logging.flexlogger.Logger; +import org.onap.policy.pap.xacml.rest.DisctionaryNames; import org.onap.policy.rest.dao.CommonClassDao; import org.onap.policy.rest.jpa.ActionList; import org.onap.policy.rest.jpa.ActionPolicyDict; @@ -104,6 +105,14 @@ public class DictionaryImportController { response.getWriter().write("Error"); return; } + + // fix Fortify Path Manipulation issue + if(!isValidDictionaryName(dictionaryName)){ + LOGGER.error("dictionaryName is invalid"); + response.setStatus(HttpServletResponse.SC_BAD_REQUEST); + response.getWriter().write("Error"); + return; + } boolean dictionaryImportExists = false; try{ @@ -710,4 +719,81 @@ public class DictionaryImportController { response.getWriter().write("Error"); } } + + public boolean isValidDictionaryName(String dictionaryName){ + + if(dictionaryName.startsWith(DisctionaryNames.Attribute.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ActionPolicyDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.OnapName.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.MSPolicyDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.VNFType.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.VSCLAction.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ClosedLoopService.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ClosedLoopSite.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.PEPOptions.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.VarbindDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.BRMSParamDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.BRMSControllerDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.BRMSDependencyDictionary.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.Settings.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.PrefixList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.SecurityZone.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.Zone.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ServiceList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ServiceGroup.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.AddressGroup.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ProtocolList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.ActionList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.TermList.toString())){ + return true; + } + if(dictionaryName.startsWith(DisctionaryNames.SearchCriteria.toString())){ + return true; + } + return false; + } } \ No newline at end of file -- cgit 1.2.3-korg