summaryrefslogtreecommitdiffstats
path: root/common-be
diff options
context:
space:
mode:
authorvasraz <vasyl.razinkov@est.tech>2021-07-27 11:19:48 +0100
committerVasyl Razinkov <vasyl.razinkov@est.tech>2021-08-06 09:42:46 +0000
commit84aa83e9203d6f890cc5f425a00ac748d47c5c8f (patch)
treec64d6fe5494e52781fdec406f7f521d6ddd082d5 /common-be
parent36ff777984fbd728737b264d7aa3933794716519 (diff)
Fix Security Hotspot
Fix for https://sonarcloud.io/project/security_hotspots?id=onap_sdc&hotspots=AXrLK9lDm75TRpHZ3DAu Change-Id: I6427d02bb76618a4b7383e427ce9f762adf73e97 Signed-off-by: Vasyl Razinkov <vasyl.razinkov@est.tech> Issue-ID: SDC-3657
Diffstat (limited to 'common-be')
-rw-r--r--common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarPackageReducerConfiguration.java1
-rw-r--r--common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducer.java15
-rw-r--r--common-be/src/main/java/org/openecomp/sdc/be/csar/storage/exception/CsarSizeReducerException.java4
-rw-r--r--common-be/src/test/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducerTest.java1
4 files changed, 21 insertions, 0 deletions
diff --git a/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarPackageReducerConfiguration.java b/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarPackageReducerConfiguration.java
index a14222ab17..08049b4215 100644
--- a/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarPackageReducerConfiguration.java
+++ b/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarPackageReducerConfiguration.java
@@ -29,5 +29,6 @@ public class CsarPackageReducerConfiguration implements PackageSizeReducerConfig
private final Set<Path> foldersToStrip;
private final long sizeLimit;
+ private final int thresholdEntries;
}
diff --git a/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducer.java b/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducer.java
index 1fef373362..822acc0766 100644
--- a/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducer.java
+++ b/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducer.java
@@ -30,6 +30,7 @@ import java.util.List;
import java.util.Set;
import java.util.UUID;
import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicInteger;
import java.util.function.Consumer;
import java.util.stream.Collectors;
import java.util.zip.ZipEntry;
@@ -100,9 +101,16 @@ public class CsarSizeReducer implements PackageSizeReducer {
}
private Consumer<ZipEntry> signedZipProcessingConsumer(final Path csarPackagePath, final ZipFile zf, final ZipOutputStream zos) {
+ final var thresholdEntries = configuration.getThresholdEntries();
+ final var totalEntryArchive = new AtomicInteger(0);
return zipEntry -> {
final var entryName = zipEntry.getName();
try {
+ if (totalEntryArchive.getAndIncrement() > thresholdEntries) {
+ // too much entries in this archive, can lead to inodes exhaustion of the system
+ final var errorMsg = String.format("Failed to extract '%s' from zip '%s'", entryName, csarPackagePath);
+ throw new CsarSizeReducerException(errorMsg);
+ }
zos.putNextEntry(new ZipEntry(entryName));
if (!zipEntry.isDirectory()) {
if (entryName.toLowerCase().endsWith(CSAR_EXTENSION)) {
@@ -123,8 +131,15 @@ public class CsarSizeReducer implements PackageSizeReducer {
}
private Consumer<ZipEntry> unsignedZipProcessingConsumer(final Path csarPackagePath, final ZipFile zf, final ZipOutputStream zos) {
+ final var thresholdEntries = configuration.getThresholdEntries();
+ final var totalEntryArchive = new AtomicInteger(0);
return zipEntry -> {
final var entryName = zipEntry.getName();
+ if (totalEntryArchive.getAndIncrement() > thresholdEntries) {
+ // too much entries in this archive, can lead to inodes exhaustion of the system
+ final var errorMsg = String.format("Failed to extract '%s' from zip '%s'", entryName, csarPackagePath);
+ throw new CsarSizeReducerException(errorMsg);
+ }
try {
zos.putNextEntry(new ZipEntry(entryName));
if (!zipEntry.isDirectory()) {
diff --git a/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/exception/CsarSizeReducerException.java b/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/exception/CsarSizeReducerException.java
index f57666ac70..806a415ee8 100644
--- a/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/exception/CsarSizeReducerException.java
+++ b/common-be/src/main/java/org/openecomp/sdc/be/csar/storage/exception/CsarSizeReducerException.java
@@ -27,4 +27,8 @@ public class CsarSizeReducerException extends BusinessException {
public CsarSizeReducerException(final String message, final Throwable cause) {
super(message, cause);
}
+
+ public CsarSizeReducerException(final String message) {
+ super(message);
+ }
}
diff --git a/common-be/src/test/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducerTest.java b/common-be/src/test/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducerTest.java
index eaa5ffeda2..e9748f0a16 100644
--- a/common-be/src/test/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducerTest.java
+++ b/common-be/src/test/java/org/openecomp/sdc/be/csar/storage/CsarSizeReducerTest.java
@@ -62,6 +62,7 @@ class CsarSizeReducerTest {
final var sizeLimit = 150000L;
when(csarPackageReducerConfiguration.getSizeLimit()).thenReturn(sizeLimit);
when(csarPackageReducerConfiguration.getFoldersToStrip()).thenReturn(Set.of(pathToReduce1, pathToReduce2));
+ when(csarPackageReducerConfiguration.getThresholdEntries()).thenReturn(10000);
final var csarPath = Path.of("src/test/resources/csarSizeReducer/" + fileName);