summaryrefslogtreecommitdiffstats
path: root/ecomp-sdk/epsdk-core
diff options
context:
space:
mode:
authorChristopher Lott (cl778h) <clott@research.att.com>2017-10-20 08:22:19 -0400
committerChristopher Lott (cl778h) <clott@research.att.com>2017-10-20 08:44:33 -0400
commite3982f6c2a13c903947a66d89e1af1ccbb161e5f (patch)
tree07db289541228dfaef258c267dd33635c33ebb34 /ecomp-sdk/epsdk-core
parentddd8720d597fc9053a455b10445fb253adbc4bf7 (diff)
Role management; security vulnerabilities.
Extend user/role management interface to allow role deletion. Add filters to defend against common web Javascript attacks. Drop Greensock code with unusable license. Use OParent in EPSDK web application. Issue: US324470, US342324, PORTAL-127 Change-Id: I3a10744fbbbdbda7c88d2b2e542e72e779c9b142 Signed-off-by: Christopher Lott (cl778h) <clott@research.att.com>
Diffstat (limited to 'ecomp-sdk/epsdk-core')
-rw-r--r--ecomp-sdk/epsdk-core/pom.xml6
-rw-r--r--ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementLinkService.java3
-rw-r--r--ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementMapService.java3
-rw-r--r--ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/RoleServiceCentralizedAccess.java4
-rw-r--r--ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java76
-rw-r--r--ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/YamlUtils.java3
-rw-r--r--ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/web/support/UserUtils.java1
7 files changed, 91 insertions, 5 deletions
diff --git a/ecomp-sdk/epsdk-core/pom.xml b/ecomp-sdk/epsdk-core/pom.xml
index 9be09a7c..d9993110 100644
--- a/ecomp-sdk/epsdk-core/pom.xml
+++ b/ecomp-sdk/epsdk-core/pom.xml
@@ -322,6 +322,12 @@
<version>1.0.0</version>
</dependency>
+ <dependency>
+ <groupId>org.owasp.esapi</groupId>
+ <artifactId>esapi</artifactId>
+ <version>2.1.0.1</version>
+ </dependency>
+
<!-- UEB was originally named Cambria -->
<dependency>
<groupId>com.att.nsa</groupId>
diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementLinkService.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementLinkService.java
index e096d832..4d06d827 100644
--- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementLinkService.java
+++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementLinkService.java
@@ -44,6 +44,7 @@ import java.util.HashMap;
import java.util.List;
import java.util.Map;
+import org.apache.commons.io.FilenameUtils;
import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
import org.onap.portalsdk.core.util.SystemProperties;
import org.onap.portalsdk.core.util.YamlUtils;
@@ -68,7 +69,7 @@ public class ElementLinkService {
relFilePath = SystemProperties.getProperty("customCallFlow_path");
else
relFilePath = SystemProperties.getProperty("element_map_file_path");
- final String yamlDirPath = new File(args[0], relFilePath).getPath();
+ final String yamlDirPath = FilenameUtils.normalize(new File(args[0], relFilePath).getPath());
String callFlowBusinessYml = "";
String callFlowStep = "";
diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementMapService.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementMapService.java
index e838e783..75f3dc8e 100644
--- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementMapService.java
+++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementMapService.java
@@ -47,6 +47,7 @@ import java.util.Map;
import java.util.Set;
import java.util.TreeSet;
+import org.apache.commons.io.FilenameUtils;
import org.apache.commons.lang.StringUtils;
import org.onap.portalsdk.core.domain.support.Container;
import org.onap.portalsdk.core.domain.support.Domain;
@@ -205,7 +206,7 @@ public class ElementMapService {
*/
public String buildElementMapYaml(String args[]) throws IOException {
- final String yamlDirPath = new File(args[2], filePath).getPath();
+ final String yamlDirPath = FilenameUtils.normalize(new File(args[2], filePath).getPath());
if (args != null && args.length > 4) {
if (args[3] != null)
networkToscaYml = args[3] + ".yml";
diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/RoleServiceCentralizedAccess.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/RoleServiceCentralizedAccess.java
index 3ef7cb8b..777968e5 100644
--- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/RoleServiceCentralizedAccess.java
+++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/RoleServiceCentralizedAccess.java
@@ -134,8 +134,8 @@ public class RoleServiceCentralizedAccess implements RoleService {
@Override
public void deleteRole(String loginId, Role domainRole) throws IOException {
- String roleName = domainRole.getName().replaceAll(" ", "%20");
- restApiRequestBuilder.deleteViaRest("/deleteRole/" + roleName, true, null, loginId);
+ Long roleId = domainRole.getId();
+ restApiRequestBuilder.deleteViaRest("v2/deleteRole/" + roleId, true, null, loginId);
}
@Override
diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java
new file mode 100644
index 00000000..c3e00c3f
--- /dev/null
+++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java
@@ -0,0 +1,76 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+package org.onap.portalsdk.core.util;
+
+import org.apache.commons.lang.StringUtils;
+import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
+import org.owasp.esapi.codecs.Codec;
+import org.owasp.esapi.codecs.MySQLCodec;
+import org.owasp.esapi.codecs.MySQLCodec.Mode;
+import org.owasp.esapi.codecs.OracleCodec;
+
+public class SecurityCodecUtil {
+
+ private static final EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(SecurityCodecUtil.class);
+
+ private static final String MYSQL_DB = "mysql";
+ private static final String ORACLE_DB = "oracle";
+ private static final String MARIA_DB = "mariadb";
+ private static Codec instance = null;
+
+ public static Codec getCodec() {
+ try {
+ if (null == instance) {
+ if (StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), MYSQL_DB)
+ || StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER),
+ MARIA_DB)) {
+ instance = new MySQLCodec(Mode.STANDARD);
+
+ } else if (StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER),
+ ORACLE_DB)) {
+ instance = new OracleCodec();
+ }
+ }
+
+ } catch (Exception ex) {
+ logger.error(EELFLoggerDelegate.errorLogger, "getCodec() failed", ex);
+ }
+ return instance;
+
+ }
+} \ No newline at end of file
diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/YamlUtils.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/YamlUtils.java
index 38bd2075..5072e5a2 100644
--- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/YamlUtils.java
+++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/YamlUtils.java
@@ -43,6 +43,7 @@ import java.io.FileWriter;
import java.io.IOException;
import java.util.Map;
+import org.apache.commons.io.FilenameUtils;
import org.yaml.snakeyaml.Yaml;
import org.yaml.snakeyaml.representer.Representer;
@@ -71,7 +72,7 @@ public class YamlUtils {
@SuppressWarnings("unchecked")
public static Map<String, Object> readYamlFile(String filePath, String fileName) throws IOException {
- FileReader reader = new FileReader(filePath + File.separator + fileName);
+ FileReader reader = new FileReader(FilenameUtils.normalize(filePath + File.separator + fileName));
Map<String, Object> callFlowBs = (Map<String, Object>) yaml.load(reader);
reader.close();
return callFlowBs;
diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/web/support/UserUtils.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/web/support/UserUtils.java
index 89f34050..bd7d5ed5 100644
--- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/web/support/UserUtils.java
+++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/web/support/UserUtils.java
@@ -346,6 +346,7 @@ public class UserUtils {
userJson.setOrgId(user.getOrgId());
userJson.setPhone(user.getPhone());
userJson.setOrgUserId(user.getOrgUserId());
+ userJson.setActive(user.getActive());
Set<EcompRole> ecompRoles = new TreeSet<>();
for (Role role : user.getRoles()) {
ecompRoles.add(convertToEcompRole(role));