Role management; security vulnerabilities.

Extend user/role management interface to allow role deletion.
Add filters to defend against common web Javascript attacks.
Drop Greensock code with unusable license.
Use OParent in EPSDK web application.

Issue: US324470, US342324, PORTAL-127
Change-Id: I3a10744fbbbdbda7c88d2b2e542e72e779c9b142
Signed-off-by: Christopher Lott (cl778h) <clott@research.att.com>

1 files changed, 76 insertions, 0 deletions

diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java
new file mode 100644
index 00000000..c3e00c3f
--- /dev/null
+++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java
@@ -0,0 +1,76 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *             http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *             https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+package org.onap.portalsdk.core.util;
+
+import org.apache.commons.lang.StringUtils;
+import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
+import org.owasp.esapi.codecs.Codec;
+import org.owasp.esapi.codecs.MySQLCodec;
+import org.owasp.esapi.codecs.MySQLCodec.Mode;
+import org.owasp.esapi.codecs.OracleCodec;
+
+public class SecurityCodecUtil {
+
+	private static final EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(SecurityCodecUtil.class);
+
+	private static final String MYSQL_DB = "mysql";
+	private static final String ORACLE_DB = "oracle";
+	private static final String MARIA_DB = "mariadb";
+	private static Codec instance = null;
+
+	public static Codec getCodec() {
+		try {
+			if (null == instance) {
+				if (StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), MYSQL_DB)
+						|| StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER),
+								MARIA_DB)) {
+					instance = new MySQLCodec(Mode.STANDARD);
+
+				} else if (StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER),
+						ORACLE_DB)) {
+					instance = new OracleCodec();
+				}
+			}
+
+		} catch (Exception ex) {
+			logger.error(EELFLoggerDelegate.errorLogger, "getCodec() failed", ex);
+		}
+		return instance;
+
+	}
+}
\ No newline at end of file