diff options
author | 2019-04-30 11:29:06 +0200 | |
---|---|---|
committer | 2019-05-30 08:55:47 +0200 | |
commit | 3264d36e04f57e7f9d407b49c1253f73c4bf5d72 (patch) | |
tree | ed20e442864995b432758268c445093144ac1ac6 /ecomp-portal-BE-common/src/main/java | |
parent | ba546e970d779a5e87a07b3058a85e1446c39129 (diff) |
Fix sql injection vulnerability
Use a variable binding instead of concatenation.
Add new test for function 'createLocalUserIfNecessary'.
Issue-ID: OJSI-174
Change-Id: Iddd65893bb2cb16c90d4f8db59816fdf261874bc
Signed-off-by: Dominik Orliński <d.orlinski@samsung.com>
Diffstat (limited to 'ecomp-portal-BE-common/src/main/java')
-rw-r--r-- | ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java index 5d9761ce..aaaf91bd 100644 --- a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java +++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java @@ -176,10 +176,10 @@ public class UserRolesCommonServiceImpl { * * @param userId */ - protected void createLocalUserIfNecessary(String userId) { + protected boolean createLocalUserIfNecessary(String userId) { if (StringUtils.isEmpty(userId)) { logger.error(EELFLoggerDelegate.errorLogger, "createLocalUserIfNecessary : empty userId!"); - return; + return false; } Session localSession = null; Transaction transaction = null; @@ -188,7 +188,10 @@ public class UserRolesCommonServiceImpl { transaction = localSession.beginTransaction(); @SuppressWarnings("unchecked") List<EPUser> userList = localSession - .createQuery("from " + EPUser.class.getName() + " where orgUserId='" + userId + "'").list(); + .createQuery("from :name where orgUserId=:userId") + .setParameter("name",EPUser.class.getName()) + .setParameter("userId",userId) + .list(); if (userList.size() == 0) { EPUser client = searchService.searchUserByUserId(userId); if (client == null) { @@ -202,9 +205,11 @@ public class UserRolesCommonServiceImpl { } } transaction.commit(); + return true; } catch (Exception e) { EPLogUtil.logEcompError(logger, EPAppMessagesEnum.BeDaoSystemError, e); EcompPortalUtils.rollbackTransaction(transaction, "searchOrCreateUser rollback, exception = " + e); + return false; } finally { EcompPortalUtils.closeLocalSession(localSession, "searchOrCreateUser"); } |