diff options
author | 2022-10-14 13:35:39 +0100 | |
---|---|---|
committer | 2022-10-18 08:27:16 +0000 | |
commit | ddb9d5a7637b382be9ac7a96ad023a983c41c342 (patch) | |
tree | 4e551d6ce4348aed56f42b021bbe4fcfccc3cd15 /catalog-be/src/test/java/org | |
parent | ccab3629426bdc6a87ca6102db3fdb23d4419b3e (diff) |
Fix security risk 'Improper Input Validation'
Signed-off-by: Vasyl Razinkov <vasyl.razinkov@est.tech>
Change-Id: I6a52148aec3b567db43ec57109214e52d106f73c
Issue-ID: SDC-4189
Diffstat (limited to 'catalog-be/src/test/java/org')
-rw-r--r-- | catalog-be/src/test/java/org/openecomp/sdc/be/servlets/utils/DataValidatorTest.java | 54 |
1 files changed, 54 insertions, 0 deletions
diff --git a/catalog-be/src/test/java/org/openecomp/sdc/be/servlets/utils/DataValidatorTest.java b/catalog-be/src/test/java/org/openecomp/sdc/be/servlets/utils/DataValidatorTest.java new file mode 100644 index 0000000000..8804e49b4b --- /dev/null +++ b/catalog-be/src/test/java/org/openecomp/sdc/be/servlets/utils/DataValidatorTest.java @@ -0,0 +1,54 @@ +/* + * ============LICENSE_START======================================================= + * SDC + * ================================================================================ + * Copyright (C) 2022 Nordix Foundation. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + +package org.openecomp.sdc.be.servlets.utils; + +import static org.junit.jupiter.api.Assertions.assertFalse; + +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import org.mockito.InjectMocks; +import org.mockito.junit.jupiter.MockitoExtension; +import org.openecomp.sdc.be.model.User; +import org.openecomp.sdc.common.util.DataValidator; +import org.openecomp.sdc.common.util.SecureString; + +@ExtendWith(MockitoExtension.class) +class DataValidatorTest { + + @InjectMocks + private DataValidator dataValidator; + + @Test + void isValidSecureString() { + final SecureString secureString = new SecureString("<script>alert(“XSS”);</script>"); + assertFalse(dataValidator.isValid(secureString)); + } + + @Test + void isValidEPUser() { + final User user = new User(); + user.setEmail("“><script>alert(“XSS”)</script>"); + user.setUserId("<IMG SRC=”javascript:alert(‘XSS’);”>"); + user.setFirstName("<IMG SRC=javascript:alert(‘XSS’)> "); + assertFalse(dataValidator.isValid(user)); + } + +} |