diff options
Diffstat (limited to 'ecomp-sdk/epsdk-app-common')
9 files changed, 204 insertions, 163 deletions
diff --git a/ecomp-sdk/epsdk-app-common/db-scripts/EcompSdkDMLMySql_2_5_Common.sql b/ecomp-sdk/epsdk-app-common/db-scripts/EcompSdkDMLMySql_2_5_Common.sql index 50221612..c158719b 100644 --- a/ecomp-sdk/epsdk-app-common/db-scripts/EcompSdkDMLMySql_2_5_Common.sql +++ b/ecomp-sdk/epsdk-app-common/db-scripts/EcompSdkDMLMySql_2_5_Common.sql @@ -135,35 +135,66 @@ INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('tab3.htm',' INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('tab4.htm','menu_tab'); INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('raptor.htm','view_reports'); INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('raptor_blob_extract.htm','view_reports'); -INSERT INTO fn_restricted_url VALUES('admin','menu_admin'); -INSERT INTO fn_restricted_url VALUES('get_role','menu_admin'); -INSERT INTO fn_restricted_url VALUES('get_role_functions','menu_admin'); -INSERT INTO fn_restricted_url VALUES('role_list/*','menu_admin'); -INSERT INTO fn_restricted_url VALUES('role_function_list/*','menu_admin'); -INSERT INTO fn_restricted_url VALUES('addRole','menu_admin'); -INSERT INTO fn_restricted_url VALUES('addRoleFunction','menu_admin'); -INSERT INTO fn_restricted_url VALUES('removeRole','menu_admin'); -INSERT INTO fn_restricted_url VALUES('removeRoleFunction','menu_admin'); -INSERT INTO fn_restricted_url VALUES('profile/*','menu_admin'); -INSERT INTO fn_restricted_url VALUES('samplePage','menu_sample'); -INSERT INTO fn_restricted_url VALUES('workflows','menu_admin'); -INSERT INTO fn_restricted_url VALUES('workflows/list','menu_admin'); -INSERT INTO fn_restricted_url VALUES('workflows/addWorkflow','menu_admin'); -INSERT INTO fn_restricted_url VALUES('workflows/saveCronJob','menu_admin'); -INSERT INTO fn_restricted_url VALUES('workflows/editWorkflow','menu_admin'); -INSERT INTO fn_restricted_url VALUES('workflows/removeWorkflow','menu_admin'); -INSERT INTO fn_restricted_url VALUES('workflows/removeAllWorkflows','menu_admin'); -INSERT INTO fn_restricted_url VALUES('role/saveRole.htm','menu_admin'); -INSERT INTO fn_restricted_url VALUES('post_search/process','menu_admin'); -INSERT INTO fn_restricted_url VALUES('post_search/search','menu_admin'); -INSERT INTO fn_restricted_url VALUES('post_search/search','menu_profile'); -INSERT INTO fn_restricted_url VALUES('report/wizard/retrieve_def_tab_wise_data/*','menu_reports'); -INSERT INTO fn_restricted_url VALUES('report/wizard/retrieve_form_tab_wise_data/*','menu_reports'); -INSERT INTO fn_restricted_url VALUES('report/wizard/retrieve_sql_tab_wise_data/*','menu_reports'); -INSERT INTO fn_restricted_url VALUES('report/wizard/security/*','menu_reports'); -INSERT INTO fn_restricted_url VALUES('report/wizard/copy_report/*','menu_reports'); -INSERT INTO fn_restricted_url VALUES('report/wizard/save_def_tab_data/*','menu_reports'); -INSERT INTO fn_restricted_url VALUES('report/wizard/retrieve_data/true','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('admin','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('get_role','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('get_role_functions','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('role_list/*','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('role_function_list/*','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('addRole','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('addRoleFunction','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('removeRole','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('removeRoleFunction','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('profile/*','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('samplePage','menu_sample'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('workflows','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('workflows/list','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('workflows/addWorkflow','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('workflows/saveCronJob','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('workflows/editWorkflow','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('workflows/removeWorkflow','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('workflows/removeAllWorkflows','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('role/saveRole.htm','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('post_search/process','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('post_search/search','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('post_search/search','menu_profile'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/retrieve_def_tab_wise_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/retrieve_form_tab_wise_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/retrieve_sql_tab_wise_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/security/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/copy_report/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/save_def_tab_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/retrieve_data/true','menu_reports'); + +-- new for Dublin +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('novamap_controller.htm','menu_map'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('/report*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('/report/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('/report/wizard/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('/report/wizard/retrieve_col_tab_wise_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('/report/wizard/retrieve_sql_tab_wise_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/security/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/security/addReportRole','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/security/addReportUser','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/drill_down_param/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/get_report_log/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/getDrillDownReportList','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/list_child_report_col/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/list_child_report_ff/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/list_columns','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/list_formfields','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/retrieve_col_tab_wise_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/retrieve_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/retrieve_form_tab_wise_data/*/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/retrieveTotalForTheColList','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report_blob_extract.htm','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report_email_attachment.htm','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report_search.htm','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report2.htm','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('sample_heat_map.htm','menu_tab'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('sample_heat_map_no_header.htm','menu_tab'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('serviceModels','menu_admin'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('welcome','menu_reports'); -- fn_role Insert into fn_role (ROLE_ID,ROLE_NAME,ACTIVE_YN,PRIORITY) values (16,'Standard User','Y',5); @@ -2878,4 +2909,4 @@ INSERT INTO demo_util_chart (TRAFFIC_DATE,UTIL_PERC ) VALUES (str_to_date('2016- INSERT INTO demo_util_chart (TRAFFIC_DATE,UTIL_PERC ) VALUES (str_to_date('2016-03-07','%Y-%m-%d'),61.86667); INSERT INTO demo_util_chart (TRAFFIC_DATE,UTIL_PERC ) VALUES (str_to_date('2016-03-08','%Y-%m-%d'),62.00000); -commit;
\ No newline at end of file +commit; diff --git a/ecomp-sdk/epsdk-app-common/db-scripts/EcompSdkDMLMySql_2_6_Common.sql b/ecomp-sdk/epsdk-app-common/db-scripts/EcompSdkDMLMySql_2_6_Common.sql index 2ff2dc26..66637e62 100644 --- a/ecomp-sdk/epsdk-app-common/db-scripts/EcompSdkDMLMySql_2_6_Common.sql +++ b/ecomp-sdk/epsdk-app-common/db-scripts/EcompSdkDMLMySql_2_6_Common.sql @@ -135,6 +135,11 @@ INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('tab3.htm',' INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('tab4.htm','menu_tab'); INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('raptor.htm','view_reports'); INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('raptor_blob_extract.htm','view_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/add_formfield_tab_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/save_formfield_tab_data/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/retrieve_form_tab_wise_data/*/delete','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/list_child_report_col/*','menu_reports'); +INSERT INTO fn_restricted_url (restricted_url, function_cd) VALUES ('report/wizard/list_child_report_ff/*','menu_reports'); INSERT INTO fn_restricted_url VALUES('admin','menu_admin'); INSERT INTO fn_restricted_url VALUES('get_role','menu_admin'); INSERT INTO fn_restricted_url VALUES('get_role_functions','menu_admin'); diff --git a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/core/RoleFunctionListController.java b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/core/RoleFunctionListController.java index 699e83ca..4ac5f37a 100644 --- a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/core/RoleFunctionListController.java +++ b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/core/RoleFunctionListController.java @@ -67,6 +67,7 @@ import com.fasterxml.jackson.databind.ObjectMapper; public class RoleFunctionListController extends RestrictedBaseController { private static final EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(RoleFunctionListController.class); + private static final String SUCCESS = "SUCCESS"; @Autowired private RoleService service; @@ -117,7 +118,7 @@ public class RoleFunctionListController extends RestrictedBaseController { RoleFunction domainRoleFunction = service.getRoleFunction(user.getOrgUserId(), code); domainRoleFunction.setName(availableRoleFunction.getName()); domainRoleFunction.setCode(code); - restCallStatus = "success"; + restCallStatus = SUCCESS; service.saveRoleFunction(user.getOrgUserId(), domainRoleFunction); } catch (Exception e) { logger.error(EELFLoggerDelegate.errorLogger, "saveRoleFunction failed", e); @@ -141,7 +142,7 @@ public class RoleFunctionListController extends RestrictedBaseController { RoleFunction availableRoleFunction = mapper.readValue(data, RoleFunction.class); String code = availableRoleFunction.getCode(); List<RoleFunction> currentRoleFunction = service.getRoleFunctions(user.getOrgUserId()); - restCallStatus = "success"; + restCallStatus = SUCCESS; for (RoleFunction roleF : currentRoleFunction) { if (roleF.getCode().equals(code)) { restCallStatus = "code exists"; @@ -177,7 +178,7 @@ public class RoleFunctionListController extends RestrictedBaseController { service.deleteRoleFunction(user.getOrgUserId(), domainRoleFunction); logger.info(EELFLoggerDelegate.auditLogger, "Remove role function " + domainRoleFunction.getName()); - restCallStatus = "success"; + restCallStatus = SUCCESS; } catch (Exception e) { logger.error(EELFLoggerDelegate.errorLogger, "removeRoleFunction failed", e); throw new IOException(e); diff --git a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/core/UsageListController.java b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/core/UsageListController.java index 04c1f2bc..fabc06bf 100644 --- a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/core/UsageListController.java +++ b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/core/UsageListController.java @@ -65,6 +65,8 @@ public class UsageListController extends RestrictedBaseController { private static final EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(UsageListController.class); + private static final String ACTIVE_USERS = "activeUsers"; + private void addUsers2jsonArray(JSONArray ja,HashMap activeUsers,String httpSessionId) { List<UserRowBean> rows = UsageUtils.getActiveUsers(activeUsers); @@ -96,10 +98,10 @@ public class UsageListController extends RestrictedBaseController { Map<String, Object> model = new HashMap<>(); HttpSession httpSession = request.getSession(); - HashMap activeUsers = (HashMap) httpSession.getServletContext().getAttribute("activeUsers"); + HashMap activeUsers = (HashMap) httpSession.getServletContext().getAttribute(ACTIVE_USERS); if (activeUsers.size() == 0) { activeUsers.put(httpSession.getId(), httpSession); - httpSession.getServletContext().setAttribute("activeUsers", activeUsers); + httpSession.getServletContext().setAttribute(ACTIVE_USERS, activeUsers); } JSONArray ja = new JSONArray(); @@ -119,10 +121,10 @@ public class UsageListController extends RestrictedBaseController { public void getUsageList(HttpServletRequest request, HttpServletResponse response) { HttpSession httpSession = request.getSession(); - HashMap activeUsers = (HashMap) httpSession.getServletContext().getAttribute("activeUsers"); + HashMap activeUsers = (HashMap) httpSession.getServletContext().getAttribute(ACTIVE_USERS); if (activeUsers.size() == 0) { activeUsers.put(httpSession.getId(), httpSession); - httpSession.getServletContext().setAttribute("activeUsers", activeUsers); + httpSession.getServletContext().setAttribute(ACTIVE_USERS, activeUsers); } JSONArray ja = new JSONArray(); try { @@ -144,7 +146,7 @@ public class UsageListController extends RestrictedBaseController { @SuppressWarnings("rawtypes") @RequestMapping(value = { "/usage_list/removeSession" }, method = RequestMethod.GET) public void removeSession(HttpServletRequest request, HttpServletResponse response) throws IOException { - HashMap activeUsers = (HashMap) request.getSession().getServletContext().getAttribute("activeUsers"); + HashMap activeUsers = (HashMap) request.getSession().getServletContext().getAttribute(ACTIVE_USERS); UserRowBean data = new UserRowBean(); data.setSessionId(request.getParameter("deleteSessionId")); UsageUtils.getActiveUsersAfterDelete(activeUsers, data); diff --git a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/CollaborationController.java b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/CollaborationController.java index 93a6f74f..18cd6a6a 100644 --- a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/CollaborationController.java +++ b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/CollaborationController.java @@ -56,7 +56,7 @@ public class CollaborationController extends RestrictedBaseController{ @RequestMapping(value = {"/collaboration" }, method = RequestMethod.GET) public ModelAndView view(HttpServletRequest request) { - Map<String, Object> model = new HashMap<String, Object>(); + Map<String, Object> model = new HashMap<>(); User user = UserUtils.getUserSession(request); model.put("name",(user.getFirstName() + " " + (user.getLastName() != null? user.getLastName().substring(0,1): "" ))); @@ -64,7 +64,7 @@ public class CollaborationController extends RestrictedBaseController{ } @RequestMapping(value = {"/openCollaboration" }, method = RequestMethod.GET) public ModelAndView openCollaboration(HttpServletRequest request) { - Map<String, Object> model = new HashMap<String, Object>(); + Map<String, Object> model = new HashMap<>(); User user = UserUtils.getUserSession(request); model.put("name",(user.getFirstName() + " " + (user.getLastName() != null? user.getLastName().substring(0,1): "" ))); diff --git a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/NetMapController.java b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/NetMapController.java index 38ae6ee8..f3f739f4 100644 --- a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/NetMapController.java +++ b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/NetMapController.java @@ -58,7 +58,7 @@ public class NetMapController extends RestrictedBaseController { @RequestMapping(value = { "/net_map" }, method = RequestMethod.GET) public ModelAndView plot(HttpServletRequest request) { - Map<String, Object> model = new HashMap<String, Object>(); + Map<String, Object> model = new HashMap<>(); model.put("frame_int", "net_map_int"); // This view resolves to page frame_insert.jsp return new ModelAndView("frame_insert", model); diff --git a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/PostDroolsController.java b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/PostDroolsController.java index 43d548f9..cf7fa06a 100644 --- a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/PostDroolsController.java +++ b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/PostDroolsController.java @@ -109,7 +109,7 @@ public class PostDroolsController extends RestrictedBaseController { } @RequestMapping(value = { "/post_drools/execute" }, method = RequestMethod.POST) - public ModelAndView search(HttpServletRequest request, HttpServletResponse response) throws Exception { + public ModelAndView search(HttpServletRequest request, HttpServletResponse response) { try { ObjectMapper mapper = new ObjectMapper(); mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false); diff --git a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/SamplePageController.java b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/SamplePageController.java index 26a4e444..5adaf66e 100644 --- a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/SamplePageController.java +++ b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/controller/sample/SamplePageController.java @@ -58,10 +58,8 @@ public class SamplePageController extends RestrictedBaseController { @RequestMapping(value = { "/samplePage" }, method = RequestMethod.GET) public ModelAndView plot(HttpServletRequest request) { - Map<String, Object> model = new HashMap<String, Object>(); - /*model.put("frame_int", "net_map_int"); - // This view resolves to page frame_insert.jsp - return new ModelAndView("frame_insert", model);*/ + Map<String, Object> model = new HashMap<>(); + return new ModelAndView("samplePage", "model", model); } diff --git a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/util/SecurityXssValidator.java b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/util/SecurityXssValidator.java index 8a2cf3e7..ef53d16e 100644 --- a/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/util/SecurityXssValidator.java +++ b/ecomp-sdk/epsdk-app-common/src/main/java/org/onap/portalapp/util/SecurityXssValidator.java @@ -33,7 +33,7 @@ * * ============LICENSE_END============================================ * - * + * */ package org.onap.portalapp.util; @@ -42,7 +42,6 @@ import java.util.List; import java.util.concurrent.locks.Lock; import java.util.concurrent.locks.ReentrantLock; import java.util.regex.Pattern; - import org.apache.commons.lang.NotImplementedException; import org.apache.commons.lang.StringUtils; import org.apache.commons.lang3.StringEscapeUtils; @@ -51,157 +50,162 @@ import org.onap.portalsdk.core.util.SystemProperties; import org.owasp.esapi.ESAPI; import org.owasp.esapi.codecs.Codec; import org.owasp.esapi.codecs.MySQLCodec; -import org.owasp.esapi.codecs.OracleCodec; import org.owasp.esapi.codecs.MySQLCodec.Mode; +import org.owasp.esapi.codecs.OracleCodec; public class SecurityXssValidator { - private EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(SecurityXssValidator.class); - - private static final String MYSQL_DB = "mysql"; - private static final String ORACLE_DB = "oracle"; - private static final String MARIA_DB = "mariadb"; - private static final int FLAGS = Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL; - - static SecurityXssValidator validator = null; - private static Codec instance; - private static final Lock lock = new ReentrantLock(); - - public static SecurityXssValidator getInstance() { - - if (validator == null) { - lock.lock(); - try { - if (validator == null) - validator = new SecurityXssValidator(); - } finally { - lock.unlock(); - } - } - return validator; - } + private EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(SecurityXssValidator.class); - private SecurityXssValidator() { - // Avoid anything between script tags - XSS_INPUT_PATTERNS.add(Pattern.compile("<script>(.*?)</script>", FLAGS)); + private static final String MYSQL_DB = "mysql"; + private static final String ORACLE_DB = "oracle"; + private static final String MARIA_DB = "mariadb"; + private static final int FLAGS = Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL; - // avoid iframes - XSS_INPUT_PATTERNS.add(Pattern.compile("<iframe(.*?)>(.*?)</iframe>", FLAGS)); + static SecurityXssValidator validator = null; + private static Codec instance; + private static final Lock lock = new ReentrantLock(); - // Avoid anything in a src='...' type of expression - XSS_INPUT_PATTERNS.add(Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", FLAGS)); + private List<Pattern> xssInputPatterns = new ArrayList<>(); - XSS_INPUT_PATTERNS.add(Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", FLAGS)); + private SecurityXssValidator() { + // Avoid anything between script tags + xssInputPatterns.add(Pattern.compile("<script>(.*?)</script>", FLAGS)); - XSS_INPUT_PATTERNS.add(Pattern.compile("src[\r\n]*=[\r\n]*([^>]+)", FLAGS)); + // avoid iframes + xssInputPatterns.add(Pattern.compile("<iframe(.*?)>(.*?)</iframe>", FLAGS)); - // Remove any lonesome </script> tag - XSS_INPUT_PATTERNS.add(Pattern.compile("</script>", FLAGS)); + // Avoid anything in a src='...' type of expression + xssInputPatterns.add(Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", FLAGS)); - XSS_INPUT_PATTERNS.add(Pattern.compile(".*(<script>|</script>).*", FLAGS)); + xssInputPatterns.add(Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", FLAGS)); - XSS_INPUT_PATTERNS.add(Pattern.compile(".*(<iframe>|</iframe>).*", FLAGS)); + xssInputPatterns.add(Pattern.compile("src[\r\n]*=[\r\n]*([^>]+)", FLAGS)); - // Remove any lonesome <script ...> tag - XSS_INPUT_PATTERNS.add(Pattern.compile("<script(.*?)>", FLAGS)); + // Remove any lonesome </script> tag + xssInputPatterns.add(Pattern.compile("</script>", FLAGS)); - // Avoid eval(...) expressions - XSS_INPUT_PATTERNS.add(Pattern.compile("eval\\((.*?)\\)", FLAGS)); + xssInputPatterns.add(Pattern.compile(".*(<script>|</script>).*", FLAGS)); - // Avoid expression(...) expressions - XSS_INPUT_PATTERNS.add(Pattern.compile("expression\\((.*?)\\)", FLAGS)); + xssInputPatterns.add(Pattern.compile(".*(<iframe>|</iframe>).*", FLAGS)); - // Avoid javascript:... expressions - XSS_INPUT_PATTERNS.add(Pattern.compile(".*(javascript:|vbscript:).*", FLAGS)); + // Remove any lonesome <script ...> tag + xssInputPatterns.add(Pattern.compile("<script(.*?)>", FLAGS)); - // Avoid onload= expressions - XSS_INPUT_PATTERNS.add(Pattern.compile(".*(onload(.*?)=).*", FLAGS)); - } + // Avoid eval(...) expressions + xssInputPatterns.add(Pattern.compile("eval\\((.*?)\\)", FLAGS)); - private List<Pattern> XSS_INPUT_PATTERNS = new ArrayList<Pattern>(); + // Avoid expression(...) expressions + xssInputPatterns.add(Pattern.compile("expression\\((.*?)\\)", FLAGS)); - /** - * * This method takes a string and strips out any potential script injections. - * - * @param value - * @return String - the new "sanitized" string. - */ - public String stripXSS(String value) { + // Avoid javascript:... expressions + xssInputPatterns.add(Pattern.compile(".*(javascript:|vbscript:).*", FLAGS)); - try { + // Avoid onload= expressions + xssInputPatterns.add(Pattern.compile(".*(onload(.*?)=).*", FLAGS)); + } - if (StringUtils.isNotBlank(value)) { + public static SecurityXssValidator getInstance() { - value = StringEscapeUtils.escapeHtml4(value); + if (validator == null) { + lock.lock(); + try { + if (validator == null) { + validator = new SecurityXssValidator(); + } + } finally { + lock.unlock(); + } + } - value = ESAPI.encoder().canonicalize(value); + return validator; + } - // Avoid null characters - value = value.replaceAll("\0", ""); + /** + * * This method takes a string and strips out any potential script injections. + * + * @return String - the new "sanitized" string. + */ + public String stripXSS(String value) { - for (Pattern xssInputPattern : XSS_INPUT_PATTERNS) { - value = xssInputPattern.matcher(value).replaceAll(""); - } - } + try { - } catch (Exception e) { - logger.error(EELFLoggerDelegate.errorLogger, "stripXSS() failed", e); - } + if (StringUtils.isNotBlank(value)) { - return value; - } + value = StringEscapeUtils.escapeHtml4(value); - public Boolean denyXSS(String value) { - Boolean flag = Boolean.FALSE; - try { - if (StringUtils.isNotBlank(value)) { - value = ESAPI.encoder().canonicalize(value); - for (Pattern xssInputPattern : XSS_INPUT_PATTERNS) { - if (xssInputPattern.matcher(value).matches()) { - flag = Boolean.TRUE; - break; - } + value = ESAPI.encoder().canonicalize(value); - } - } + // Avoid null characters + value = value.replaceAll("\0", ""); - } catch (Exception e) { - logger.error(EELFLoggerDelegate.errorLogger, "denyXSS() failed", e); - } + for (Pattern xssInputPattern : xssInputPatterns) { + value = xssInputPattern.matcher(value).replaceAll(""); + } + } - return flag; - } + } catch (Exception e) { + logger.error(EELFLoggerDelegate.errorLogger, "stripXSS() failed", e); + } - public Codec getCodec() { - try { - if (null == instance) { - if (StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), MYSQL_DB) - || StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), - MARIA_DB)) { - instance = new MySQLCodec(Mode.STANDARD); + return value; + } - } else if (StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), - ORACLE_DB)) { - instance = new OracleCodec(); - } else { - throw new NotImplementedException("Handling for data base \"" - + SystemProperties.getProperty(SystemProperties.DB_DRIVER) + "\" not yet implemented."); - } - } + public Boolean denyXSS(String value) { + Boolean flag = Boolean.FALSE; + try { + if (StringUtils.isBlank(value)) + return flag; - } catch (Exception ex) { - logger.error(EELFLoggerDelegate.errorLogger, "getCodec() failed", ex); - } - return instance; + value = ESAPI.encoder().canonicalize(value); + for (Pattern xssInputPattern : xssInputPatterns) { + if (xssInputPattern.matcher(value).matches()) { + flag = Boolean.TRUE; + break; + } + } - } + } catch (Exception e) { + logger.error(EELFLoggerDelegate.errorLogger, "denyXSS() failed", e); + } - public List<Pattern> getXSS_INPUT_PATTERNS() { - return XSS_INPUT_PATTERNS; - } + return flag; + } - public void setXSS_INPUT_PATTERNS(List<Pattern> xSS_INPUT_PATTERNS) { - XSS_INPUT_PATTERNS = xSS_INPUT_PATTERNS; - } + public Codec getCodec() { + try { + if (null == instance) { + if (StringUtils + .containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), MYSQL_DB) + || StringUtils + .containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), + MARIA_DB)) { + instance = new MySQLCodec(Mode.STANDARD); + + } else if (StringUtils + .containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), + ORACLE_DB)) { + instance = new OracleCodec(); + } else { + throw new NotImplementedException("Handling for data base \"" + + SystemProperties.getProperty(SystemProperties.DB_DRIVER) + + "\" not yet implemented."); + } + } + + } catch (Exception ex) { + logger.error(EELFLoggerDelegate.errorLogger, "getCodec() failed", ex); + } + return instance; + + } + + public List<Pattern> getXssInputPatterns() { + return xssInputPatterns; + } + + public void setXssInputPatterns(List<Pattern> xssInputPatterns) { + this.xssInputPatterns = xssInputPatterns; + } }
\ No newline at end of file |