diff options
author | Dominik Mizyn <d.mizyn@samsung.com> | 2019-10-21 13:03:55 +0200 |
---|---|---|
committer | Dominik Mizyn <d.mizyn@samsung.com> | 2019-10-21 13:04:06 +0200 |
commit | be638f25cb9d7021ba6b58a6d3baa5cca134c56f (patch) | |
tree | 7cbe22ea55404f92b9d3e20b19f31c1a95ddc789 /ecomp-portal-BE-common/src/test | |
parent | 606a1248b23a738071e9798354cebb04fe04c54d (diff) |
Reflected XSS vulnerability in saveNotification form fix.
javax.validation.Validator used to fix this vulnerability.
Issue-ID: OJSI-22
Change-Id: I5837e333f640a398ab6b25e8a0b9f611bb7d3af9
Signed-off-by: Dominik Mizyn <d.mizyn@samsung.com>
Diffstat (limited to 'ecomp-portal-BE-common/src/test')
-rw-r--r-- | ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/ExternalAppsRestfulControllerTest.java | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/ExternalAppsRestfulControllerTest.java b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/ExternalAppsRestfulControllerTest.java index d8f98bb9..d6cb42a6 100644 --- a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/ExternalAppsRestfulControllerTest.java +++ b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/ExternalAppsRestfulControllerTest.java @@ -296,6 +296,47 @@ public class ExternalAppsRestfulControllerTest { assertEquals(543L, createdNofification.getRoleIds().get(0).longValue()); } + @Test + public void publishNotificationXSSTest() throws Exception { + // input + EpNotificationItem notificationItem = new EpNotificationItem(); + List<Long> roleList = new ArrayList<Long>(); + Long role1 = 1L; + roleList.add(role1); + notificationItem.setRoleIds(roleList); + notificationItem.setPriority(1L); + notificationItem.setMsgHeader("<script>alert(‘XSS’)</script>"); + notificationItem.setMsgDescription("Test Description"); + Date currentDate = new Date(); + Calendar c = Calendar.getInstance(); + c.setTime(currentDate); + c.add(Calendar.DATE, 1); + Date currentDatePlusOne = c.getTime(); + notificationItem.setStartTime(currentDate); + notificationItem.setEndTime(currentDatePlusOne); + + // mock calls + Mockito.when(mockedRequest.getHeader("uebkey")).thenReturn("RxH3983AHiyBOQmj"); + Map<String, String> params = new HashMap<>(); + params.put("appKey", "RxH3983AHiyBOQmj"); + List<EPApp> apps = new ArrayList<>(); + EPApp app = new EPApp(); + app.setId(123L); + apps.add(app); + Mockito.when(DataAccessService.executeNamedQuery("getMyAppDetailsByUebKey", params, null)).thenReturn(apps); + EPRole role = new EPRole(); + role.setId(543L); + Mockito.when(epRoleService.getRole(123L, 1L)).thenReturn(role); + + // run + Mockito.when(userNotificationService.saveNotification(notificationItem)).thenReturn("Test"); + PortalAPIResponse response = externalAppsRestfulController.publishNotification(mockedRequest, notificationItem); + // verify answer + assertNotNull(response); + assertEquals("error", response.getStatus()); + assertEquals("failed", response.getMessage()); + } + @Test public void publishNotificationTest_EmptyAppHeader() throws Exception { // input |