1 files changed, 0 insertions, 185 deletions
diff --git a/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/filter/SecurityXssFilter.java b/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/filter/SecurityXssFilter.java
deleted file mode 100644
index 703019f9..00000000
--- a/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/filter/SecurityXssFilter.java
+++ /dev/null
@@ -1,185 +0,0 @@
-/*-
- * ============LICENSE_START==========================================
- * ONAP Portal
- * ===================================================================
- * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
- * Modifications Copyright (c) 2019 Samsung
- * ===================================================================
- *
- * Unless otherwise specified, all software contained herein is licensed
- * under the Apache License, Version 2.0 (the "License");
- * you may not use this software except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *             http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Unless otherwise specified, all documentation contained herein is licensed
- * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
- * you may not use this documentation except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *             https://creativecommons.org/licenses/by/4.0/
- *
- * Unless required by applicable law or agreed to in writing, documentation
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * ============LICENSE_END============================================
- *
- * 
- */
-
-package org.onap.portalapp.filter;
-
-import java.io.BufferedReader;
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.nio.charset.StandardCharsets;
-import java.util.Enumeration;
-
-import javax.servlet.FilterChain;
-import javax.servlet.ReadListener;
-import javax.servlet.ServletInputStream;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletRequestWrapper;
-import javax.servlet.http.HttpServletResponse;
-
-import org.apache.commons.io.IOUtils;
-import org.apache.commons.lang.StringUtils;
-import org.apache.http.HttpStatus;
-import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
-import org.springframework.web.filter.OncePerRequestFilter;
-
-public class SecurityXssFilter extends OncePerRequestFilter {
-
-	private EELFLoggerDelegate sxLogger = EELFLoggerDelegate.getLogger(SecurityXssFilter.class);
-
-	private static final String APPLICATION_JSON = "application/json";
-
-	private static final String ERROR_BAD_REQUEST = "{\"error\":\"BAD_REQUEST\"}";
-
-	private SecurityXssValidator validator = SecurityXssValidator.getInstance();
-
-	public class RequestWrapper extends HttpServletRequestWrapper {
-
-		private ByteArrayOutputStream cachedBytes;
-
-		public RequestWrapper(HttpServletRequest request) {
-			super(request);
-		}
-
-		@Override
-		public ServletInputStream getInputStream() throws IOException {
-			if (cachedBytes == null)
-				cacheInputStream();
-
-			return new CachedServletInputStream();
-		}
-
-		@Override
-		public BufferedReader getReader() throws IOException {
-			return new BufferedReader(new InputStreamReader(getInputStream()));
-		}
-
-		private void cacheInputStream() throws IOException {
-			cachedBytes = new ByteArrayOutputStream();
-			IOUtils.copy(super.getInputStream(), cachedBytes);
-		}
-
-		public class CachedServletInputStream extends ServletInputStream {
-			private ByteArrayInputStream input;
-
-			public CachedServletInputStream() {
-				input = new ByteArrayInputStream(cachedBytes.toByteArray());
-			}
-
-			@Override
-			public int read() throws IOException {
-				return input.read();
-			}
-
-			@Override
-			public boolean isFinished() {
-				return false;
-			}
-
-			@Override
-			public boolean isReady() {
-				return false;
-			}
-
-			@Override
-			public void setReadListener(ReadListener readListener) {
-				// do nothing
-			}
-		}
-	}
-
-	@Override
-	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
-			throws IOException {
-		StringBuilder requestURL = new StringBuilder(request.getRequestURL().toString());
-		String queryString = request.getQueryString();
-		String requestUrl;
-
-		if (queryString == null) {
-			requestUrl = requestURL.toString();
-		} else {
-			requestUrl = requestURL.append('?').append(queryString).toString();
-		}
-
-		validateRequest(requestUrl, response);
-		StringBuilder headerValues = new StringBuilder();
-		Enumeration<String> headerNames = request.getHeaderNames();
-
-		while (headerNames.hasMoreElements()) {
-			String key = headerNames.nextElement();
-			String value = request.getHeader(key);
-			headerValues.append(value);
-		}
-
-		validateRequest(headerValues.toString(), response);
-
-		if (validateRequestType(request)) {
-			request = new RequestWrapper(request);
-			String requestData = IOUtils.toString(request.getInputStream(), StandardCharsets.UTF_8.toString());
-			validateRequest(requestData, response);
-		}
-
-		try {
-			filterChain.doFilter(request, response);
-		} catch (Exception e) {
-			sxLogger.warn(EELFLoggerDelegate.errorLogger, "Handling bad request", e);
-			response.sendError(org.springframework.http.HttpStatus.BAD_REQUEST.value(), "Handling bad request");
-		}
-	}
-
-	private boolean validateRequestType(HttpServletRequest request) {
-		return (request.getMethod().equalsIgnoreCase("POST") || request.getMethod().equalsIgnoreCase("PUT")
-				|| request.getMethod().equalsIgnoreCase("DELETE"));
-	}
-	
-	private void validateRequest(String text, HttpServletResponse response) throws IOException {
-		try {
-			if (StringUtils.isNotBlank(text) && validator.denyXSS(text)) {
-				response.setContentType(APPLICATION_JSON);
-				response.setStatus(HttpStatus.SC_BAD_REQUEST);
-				response.getWriter().write(ERROR_BAD_REQUEST);
-				throw new SecurityException(ERROR_BAD_REQUEST);
-			}
-		} catch (Exception e) {
-			sxLogger.error(EELFLoggerDelegate.errorLogger, "doFilterInternal() failed due to BAD_REQUEST", e);
-			response.getWriter().close();
-		}
-	}
-}