From e3982f6c2a13c903947a66d89e1af1ccbb161e5f Mon Sep 17 00:00:00 2001 From: "Christopher Lott (cl778h)" Date: Fri, 20 Oct 2017 08:22:19 -0400 Subject: Role management; security vulnerabilities. Extend user/role management interface to allow role deletion. Add filters to defend against common web Javascript attacks. Drop Greensock code with unusable license. Use OParent in EPSDK web application. Issue: US324470, US342324, PORTAL-127 Change-Id: I3a10744fbbbdbda7c88d2b2e542e72e779c9b142 Signed-off-by: Christopher Lott (cl778h) --- .../onap/portalsdk/analytics/model/definition/ReportSchedule.java | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/definition/ReportSchedule.java') diff --git a/ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/definition/ReportSchedule.java b/ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/definition/ReportSchedule.java index e9a4df1f..f4b54a18 100644 --- a/ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/definition/ReportSchedule.java +++ b/ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/definition/ReportSchedule.java @@ -74,6 +74,8 @@ import org.onap.portalsdk.analytics.util.DataSet; import org.onap.portalsdk.analytics.util.Utils; import org.onap.portalsdk.analytics.xmlobj.FormFieldType; import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate; +import org.onap.portalsdk.core.util.SecurityCodecUtil; +import org.owasp.esapi.ESAPI; public class ReportSchedule extends RaptorObject { @@ -652,9 +654,9 @@ public class ReportSchedule extends RaptorObject { if (paramValue!=null && paramValue.length() > 0) { if(paramValue.toLowerCase().trim().startsWith("select ")) { - paramValue = Utils.replaceInString(paramValue, "[LOGGED_USERID]", userId); - paramValue = Utils.replaceInString(paramValue, "[USERID]", userId); - paramValue = Utils.replaceInString(paramValue, "[USER_ID]", userId); + paramValue = Utils.replaceInString(paramValue, "[LOGGED_USERID]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(),userId)); + paramValue = Utils.replaceInString(paramValue, "[USERID]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(),userId)); + paramValue = Utils.replaceInString(paramValue, "[USER_ID]", ESAPI.encoder().encodeForSQL( SecurityCodecUtil.getCodec(),userId)); paramValue = Utils.replaceInString(paramValue, "''", "'"); ds = ConnectionUtils.getDataSet(paramValue, dbInfo); -- cgit 1.2.3-korg