From e3982f6c2a13c903947a66d89e1af1ccbb161e5f Mon Sep 17 00:00:00 2001 From: "Christopher Lott (cl778h)" Date: Fri, 20 Oct 2017 08:22:19 -0400 Subject: Role management; security vulnerabilities. Extend user/role management interface to allow role deletion. Add filters to defend against common web Javascript attacks. Drop Greensock code with unusable license. Use OParent in EPSDK web application. Issue: US324470, US342324, PORTAL-127 Change-Id: I3a10744fbbbdbda7c88d2b2e542e72e779c9b142 Signed-off-by: Christopher Lott (cl778h) --- .../portalsdk/core/service/ElementLinkService.java | 3 +- .../portalsdk/core/service/ElementMapService.java | 3 +- .../core/service/RoleServiceCentralizedAccess.java | 4 +- .../portalsdk/core/util/SecurityCodecUtil.java | 76 ++++++++++++++++++++++ .../org/onap/portalsdk/core/util/YamlUtils.java | 3 +- .../onap/portalsdk/core/web/support/UserUtils.java | 1 + 6 files changed, 85 insertions(+), 5 deletions(-) create mode 100644 ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java (limited to 'ecomp-sdk/epsdk-core/src/main/java') diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementLinkService.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementLinkService.java index e096d832..4d06d827 100644 --- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementLinkService.java +++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementLinkService.java @@ -44,6 +44,7 @@ import java.util.HashMap; import java.util.List; import java.util.Map; +import org.apache.commons.io.FilenameUtils; import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate; import org.onap.portalsdk.core.util.SystemProperties; import org.onap.portalsdk.core.util.YamlUtils; @@ -68,7 +69,7 @@ public class ElementLinkService { relFilePath = SystemProperties.getProperty("customCallFlow_path"); else relFilePath = SystemProperties.getProperty("element_map_file_path"); - final String yamlDirPath = new File(args[0], relFilePath).getPath(); + final String yamlDirPath = FilenameUtils.normalize(new File(args[0], relFilePath).getPath()); String callFlowBusinessYml = ""; String callFlowStep = ""; diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementMapService.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementMapService.java index e838e783..75f3dc8e 100644 --- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementMapService.java +++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/ElementMapService.java @@ -47,6 +47,7 @@ import java.util.Map; import java.util.Set; import java.util.TreeSet; +import org.apache.commons.io.FilenameUtils; import org.apache.commons.lang.StringUtils; import org.onap.portalsdk.core.domain.support.Container; import org.onap.portalsdk.core.domain.support.Domain; @@ -205,7 +206,7 @@ public class ElementMapService { */ public String buildElementMapYaml(String args[]) throws IOException { - final String yamlDirPath = new File(args[2], filePath).getPath(); + final String yamlDirPath = FilenameUtils.normalize(new File(args[2], filePath).getPath()); if (args != null && args.length > 4) { if (args[3] != null) networkToscaYml = args[3] + ".yml"; diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/RoleServiceCentralizedAccess.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/RoleServiceCentralizedAccess.java index 3ef7cb8b..777968e5 100644 --- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/RoleServiceCentralizedAccess.java +++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/service/RoleServiceCentralizedAccess.java @@ -134,8 +134,8 @@ public class RoleServiceCentralizedAccess implements RoleService { @Override public void deleteRole(String loginId, Role domainRole) throws IOException { - String roleName = domainRole.getName().replaceAll(" ", "%20"); - restApiRequestBuilder.deleteViaRest("/deleteRole/" + roleName, true, null, loginId); + Long roleId = domainRole.getId(); + restApiRequestBuilder.deleteViaRest("v2/deleteRole/" + roleId, true, null, loginId); } @Override diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java new file mode 100644 index 00000000..c3e00c3f --- /dev/null +++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/SecurityCodecUtil.java @@ -0,0 +1,76 @@ +/* + * ============LICENSE_START========================================== + * ONAP Portal SDK + * =================================================================== + * Copyright © 2017 AT&T Intellectual Property. All rights reserved. + * =================================================================== + * + * Unless otherwise specified, all software contained herein is licensed + * under the Apache License, Version 2.0 (the "License"); + * you may not use this software except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Unless otherwise specified, all documentation contained herein is licensed + * under the Creative Commons License, Attribution 4.0 Intl. (the "License"); + * you may not use this documentation except in compliance with the License. + * You may obtain a copy of the License at + * + * https://creativecommons.org/licenses/by/4.0/ + * + * Unless required by applicable law or agreed to in writing, documentation + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * ============LICENSE_END============================================ + * + * ECOMP is a trademark and service mark of AT&T Intellectual Property. + */ +package org.onap.portalsdk.core.util; + +import org.apache.commons.lang.StringUtils; +import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate; +import org.owasp.esapi.codecs.Codec; +import org.owasp.esapi.codecs.MySQLCodec; +import org.owasp.esapi.codecs.MySQLCodec.Mode; +import org.owasp.esapi.codecs.OracleCodec; + +public class SecurityCodecUtil { + + private static final EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(SecurityCodecUtil.class); + + private static final String MYSQL_DB = "mysql"; + private static final String ORACLE_DB = "oracle"; + private static final String MARIA_DB = "mariadb"; + private static Codec instance = null; + + public static Codec getCodec() { + try { + if (null == instance) { + if (StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), MYSQL_DB) + || StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), + MARIA_DB)) { + instance = new MySQLCodec(Mode.STANDARD); + + } else if (StringUtils.containsIgnoreCase(SystemProperties.getProperty(SystemProperties.DB_DRIVER), + ORACLE_DB)) { + instance = new OracleCodec(); + } + } + + } catch (Exception ex) { + logger.error(EELFLoggerDelegate.errorLogger, "getCodec() failed", ex); + } + return instance; + + } +} \ No newline at end of file diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/YamlUtils.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/YamlUtils.java index 38bd2075..5072e5a2 100644 --- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/YamlUtils.java +++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/YamlUtils.java @@ -43,6 +43,7 @@ import java.io.FileWriter; import java.io.IOException; import java.util.Map; +import org.apache.commons.io.FilenameUtils; import org.yaml.snakeyaml.Yaml; import org.yaml.snakeyaml.representer.Representer; @@ -71,7 +72,7 @@ public class YamlUtils { @SuppressWarnings("unchecked") public static Map readYamlFile(String filePath, String fileName) throws IOException { - FileReader reader = new FileReader(filePath + File.separator + fileName); + FileReader reader = new FileReader(FilenameUtils.normalize(filePath + File.separator + fileName)); Map callFlowBs = (Map) yaml.load(reader); reader.close(); return callFlowBs; diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/web/support/UserUtils.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/web/support/UserUtils.java index 89f34050..bd7d5ed5 100644 --- a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/web/support/UserUtils.java +++ b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/web/support/UserUtils.java @@ -346,6 +346,7 @@ public class UserUtils { userJson.setOrgId(user.getOrgId()); userJson.setPhone(user.getPhone()); userJson.setOrgUserId(user.getOrgUserId()); + userJson.setActive(user.getActive()); Set ecompRoles = new TreeSet<>(); for (Role role : user.getRoles()) { ecompRoles.add(convertToEcompRole(role)); -- cgit 1.2.3-korg