Role management; security vulnerabilities.

Extend user/role management interface to allow role deletion.
Add filters to defend against common web Javascript attacks.
Drop Greensock code with unusable license.
Use OParent in EPSDK web application.

Issue: US324470, US342324, PORTAL-127
Change-Id: I3a10744fbbbdbda7c88d2b2e542e72e779c9b142
Signed-off-by: Christopher Lott (cl778h) <clott@research.att.com>

1 files changed, 12 insertions, 10 deletions

diff --git a/ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/runtime/ReportParamValuesForPDFExcel.java b/ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/runtime/ReportParamValuesForPDFExcel.java
index d5911cbb..c50581e4 100644
--- a/ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/runtime/ReportParamValuesForPDFExcel.java
+++ b/ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/runtime/ReportParamValuesForPDFExcel.java
@@ -52,6 +52,8 @@ import org.onap.portalsdk.analytics.util.AppConstants;
 import org.onap.portalsdk.analytics.util.DataSet;
 import org.onap.portalsdk.analytics.util.Utils;
 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
+import org.onap.portalsdk.core.util.SecurityCodecUtil;
+import org.owasp.esapi.ESAPI;
 
 public class ReportParamValuesForPDFExcel extends Hashtable {
 	
@@ -154,10 +156,10 @@ public class ReportParamValuesForPDFExcel extends Hashtable {
 									
 		 							if(sql!=null && sql.trim().length()>0){
 		 								 if(name.equals(ff.getFieldName())){
-		 									sql = Utils.replaceInString(sql, "[VALUE]", value);
+		 									sql = Utils.replaceInString(sql, "[VALUE]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(),value));
 		 								 }
 		                               if(name.equals(ff1.getFieldName())){
-		                            	   sql = Utils.replaceInString(sql, "["+ff1.getFieldDisplayName()+"]", value);
+		                            	   sql = Utils.replaceInString(sql, "["+ff1.getFieldDisplayName()+"]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(),value));
 	
 		                               } else continue;
 									}
@@ -175,10 +177,10 @@ public class ReportParamValuesForPDFExcel extends Hashtable {
 											
 				 							if(sql!=null && sql.trim().length()>0){
 				 								 if(name.equals(ff.getFieldName())){
-				 									sql = Utils.replaceInString(sql, "[VALUE]", value);
+				 									sql = Utils.replaceInString(sql, "[VALUE]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(),value));
 				 								 }
 				                               if(name.equals(ff1.getFieldName())){
-				                            	   sql = Utils.replaceInString(sql, "["+ff1.getFieldDisplayName()+"]", value);
+				                            	   sql = Utils.replaceInString(sql, "["+ff1.getFieldDisplayName()+"]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(),value));
 			
 				                               } else continue;
 											}
@@ -194,7 +196,7 @@ public class ReportParamValuesForPDFExcel extends Hashtable {
 						 if(name.length()<=0) name = ff.getFieldName();
 						 value = rr.getParamValue(name);
 						 //debugLogger.debug("Name "+ name+ " value:" + value);
-						 String paramValue = getParamValueForSQL(name, value);
+						 String paramValue = ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(), getParamValueForSQL(name, value));
 						 //debugLogger.debug("PDFEXCEL " + name+ " " + ff.getFieldName()+ " " +  value + " " + sql +" "+ paramValue);
 						 if(name!=null && name.equals(ff.getFieldName()))
 							sql = Utils.replaceInString(sql, "[VALUE]", paramValue);
@@ -206,7 +208,7 @@ public class ReportParamValuesForPDFExcel extends Hashtable {
 							FormField ff2 = null;
 							for (Iterator iter1 = rff.iterator(); iter1.hasNext();) {
 								ff2 = (FormField)iter1.next();
-								sql = Utils.replaceInString(sql, "[" + ff2.getFieldDisplayName() +"]", getParamValue(ff2.getFieldName()));
+								sql = Utils.replaceInString(sql, "[" + ff2.getFieldDisplayName() +"]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(),getParamValue(ff2.getFieldName())));
 							}
 							//debugLogger.debug("SQL Modified after replacing formfield" + sql);
 							try {
@@ -223,21 +225,21 @@ public class ReportParamValuesForPDFExcel extends Hashtable {
                                 //debugLogger.debug("B4 request " + sql);      								
 						        if(request != null ) {
 					                for (int i = 0; i < scheduleSessionParameters.length; i++) {
-					                	sql = Utils.replaceInString(sql, "[" + scheduleSessionParameters[i].toUpperCase()+"]", request.getParameter(scheduleSessionParameters[i]) );
+					                	sql = Utils.replaceInString(sql, "[" + scheduleSessionParameters[i].toUpperCase()+"]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(), request.getParameter(scheduleSessionParameters[i]) ));
 					                }
 					                for (int i = 0; i < reqParameters.length; i++) {
 					                    if(!reqParameters[i].startsWith("ff")) {
 					                    	if (request.getParameter(reqParameters[i])!=null) {
 					                    		sql = Utils.replaceInString(sql, "[" + reqParameters[i]+"]", request.getParameter(reqParameters[i]) );
-					                    		sql = Utils.replaceInString(sql, "[" + reqParameters[i].toUpperCase()+"]", request.getParameter(reqParameters[i]) );
+					                    		sql = Utils.replaceInString(sql, "[" + reqParameters[i].toUpperCase()+"]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(), request.getParameter(reqParameters[i]) ));
 					                    	}
 					                    	else {
 					                    		sql = Utils.replaceInString(sql, "[" + reqParameters[i]+"]", request.getParameter(reqParameters[i].toUpperCase()) );
-					                    		sql = Utils.replaceInString(sql, "[" + reqParameters[i].toUpperCase()+"]", request.getParameter(reqParameters[i].toUpperCase()) );
+					                    		sql = Utils.replaceInString(sql, "[" + reqParameters[i].toUpperCase()+"]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(), request.getParameter(reqParameters[i].toUpperCase()) ));
 					                    	}
 					                    }
 					                    else
-					                      sql = Utils.replaceInString(sql, "[" + reqParameters[i].toUpperCase()+"]", request.getParameter(reqParameters[i]) );   
+					                      sql = Utils.replaceInString(sql, "[" + reqParameters[i].toUpperCase()+"]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(), request.getParameter(reqParameters[i]) ));   
 					                }
 					             }
                                 //debugLogger.debug("After request " + sql);