Merge "XSS Vulnerability fix in AppContactUsController"

1 files changed, 33 insertions, 1 deletions

diff --git a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/AppContactUsControllerTest.java b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/AppContactUsControllerTest.java
index b08a8769..f2b2d3da 100644
--- a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/AppContactUsControllerTest.java
+++ b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/AppContactUsControllerTest.java
@@ -78,7 +78,7 @@ public class AppContactUsControllerTest extends MockitoTestSuite{
 	AppContactUsService contactUsService = new AppContactUsServiceImpl();
 
 	@InjectMocks
-	AppContactUsController appContactUsController = new AppContactUsController();
+	AppContactUsController appContactUsController;
 
 	@Before
 	public void setup() {
@@ -233,6 +233,25 @@ public class AppContactUsControllerTest extends MockitoTestSuite{
 	}
 
 	@Test
+	public void saveXSSTest() throws Exception {
+		PortalRestResponse<String> actualSaveAppContactUS = null;
+
+		AppContactUsItem contactUs = new AppContactUsItem();
+		contactUs.setAppId((long) 1);
+		contactUs.setAppName("<meta content=\"&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)\" http-equiv=\"refresh\"/>");
+		contactUs.setDescription("Test");
+		contactUs.setContactName("Test");
+		contactUs.setContactEmail("person@onap.org");
+		contactUs.setUrl("Test_URL");
+		contactUs.setActiveYN("Y");
+
+		Mockito.when(contactUsService.saveAppContactUs(contactUs)).thenReturn("FAILURE");
+		actualSaveAppContactUS = appContactUsController.save(contactUs);
+		assertEquals("AppName is not valid.", actualSaveAppContactUS.getResponse());
+		assertEquals("failure", actualSaveAppContactUS.getMessage());
+	}
+
+	@Test
 	public void saveExceptionTest() throws Exception {
 		PortalRestResponse<String> actualSaveAppContactUS = null;
 
@@ -270,6 +289,19 @@ public class AppContactUsControllerTest extends MockitoTestSuite{
 	}
 
 	@Test
+	public void saveAllXSSTest() throws Exception {
+
+		List<AppContactUsItem> contactUs = mockResponse();
+		AppContactUsItem appContactUsItem = new AppContactUsItem();
+		appContactUsItem.setActiveYN("<script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script>");
+		contactUs.add(appContactUsItem);
+		PortalRestResponse<String> actualSaveAppContactUS = null;
+		Mockito.when(contactUsService.saveAppContactUs(contactUs)).thenReturn("failure");
+		actualSaveAppContactUS = appContactUsController.save(contactUs);
+		assertEquals("failure", actualSaveAppContactUS.getMessage());
+	}
+
+	@Test
 	public void saveAllExceptionTest() throws Exception {
 
 		List<AppContactUsItem> contactUs = mockResponse();