diff options
author | Christopher Lott (cl778h) <clott@research.att.com> | 2017-10-20 08:22:19 -0400 |
---|---|---|
committer | Christopher Lott (cl778h) <clott@research.att.com> | 2017-10-20 08:44:33 -0400 |
commit | e3982f6c2a13c903947a66d89e1af1ccbb161e5f (patch) | |
tree | 07db289541228dfaef258c267dd33635c33ebb34 /ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/ElementModelController.java | |
parent | ddd8720d597fc9053a455b10445fb253adbc4bf7 (diff) |
Role management; security vulnerabilities.
Extend user/role management interface to allow role deletion.
Add filters to defend against common web Javascript attacks.
Drop Greensock code with unusable license.
Use OParent in EPSDK web application.
Issue: US324470, US342324, PORTAL-127
Change-Id: I3a10744fbbbdbda7c88d2b2e542e72e779c9b142
Signed-off-by: Christopher Lott (cl778h) <clott@research.att.com>
Diffstat (limited to 'ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/ElementModelController.java')
-rw-r--r-- | ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/ElementModelController.java | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/ElementModelController.java b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/ElementModelController.java index 34e4db7d..aa327850 100644 --- a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/ElementModelController.java +++ b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/ElementModelController.java @@ -40,6 +40,7 @@ package org.onap.portalapp.controller.sample; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import org.apache.commons.io.FilenameUtils; import org.onap.portalsdk.core.controller.RestrictedBaseController; import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate; import org.onap.portalsdk.core.service.ElementLinkService; @@ -57,11 +58,11 @@ public class ElementModelController extends RestrictedBaseController { @RequestMapping(value = { "/elementMapLayout" }, method = RequestMethod.GET, produces = "text/plain") public String layout(HttpServletRequest request, HttpServletResponse response) throws Exception { - String collapseDomains = request.getParameter("collapsedDomains"); - String expandDomains = request.getParameter("expandedDomains"); + String collapseDomains = FilenameUtils.normalize(request.getParameter("collapsedDomains")); + String expandDomains = FilenameUtils.normalize(request.getParameter("expandedDomains")); - String contentFileName = request.getParameter("contentFileName"); - String layoutFileName = request.getParameter("layoutFileName"); + String contentFileName = FilenameUtils.normalize(request.getParameter("contentFileName")); + String layoutFileName = FilenameUtils.normalize(request.getParameter("layoutFileName")); final String realPath = request.getServletContext().getRealPath("/"); logger.debug(EELFLoggerDelegate.debugLogger, "layout: servlet context real path: {}", realPath); @@ -76,8 +77,8 @@ public class ElementModelController extends RestrictedBaseController { @RequestMapping(value = { "/elementMapLink" }, method = RequestMethod.GET, produces = "text/plain") public String callflow(HttpServletRequest request, HttpServletResponse response) throws Exception { - String callFlowName = request.getParameter("callFlowName"); - String callFlowStep = request.getParameter("callFlowStep"); + String callFlowName = FilenameUtils.normalize(request.getParameter("callFlowName")); + String callFlowStep = FilenameUtils.normalize(request.getParameter("callFlowStep")); final String realPath = request.getServletContext().getRealPath("/"); logger.debug(EELFLoggerDelegate.debugLogger, "callflow: servlet context real path: {}", realPath); |