Fixing XML parsers security bug
[so.git] / bpmn / so-bpmn-tasks / src / main / java / org / onap / so / bpmn / infrastructure / adapter / network / tasks / NetworkAdapterImpl.java
1 package org.onap.so.bpmn.infrastructure.adapter.network.tasks;
2
3 import java.io.ByteArrayInputStream;
4 import java.io.StringReader;
5 import java.nio.charset.StandardCharsets;
6 import java.util.Optional;
7 import javax.xml.XMLConstants;
8 import javax.xml.bind.JAXBContext;
9 import javax.xml.bind.JAXBException;
10 import javax.xml.bind.Unmarshaller;
11 import javax.xml.parsers.DocumentBuilder;
12 import javax.xml.parsers.DocumentBuilderFactory;
13 import org.apache.commons.lang3.StringUtils;
14 import org.onap.so.adapters.nwrest.CreateNetworkResponse;
15 import org.onap.so.adapters.nwrest.DeleteNetworkResponse;
16 import org.onap.so.adapters.nwrest.UpdateNetworkResponse;
17 import org.onap.so.bpmn.common.BuildingBlockExecution;
18 import org.onap.so.bpmn.servicedecomposition.bbobjects.ServiceInstance;
19 import org.onap.so.bpmn.servicedecomposition.entities.GeneralBuildingBlock;
20 import org.onap.so.bpmn.servicedecomposition.entities.ResourceKey;
21 import org.onap.so.bpmn.servicedecomposition.tasks.ExtractPojosForBB;
22 import org.onap.so.client.exception.ExceptionBuilder;
23 import org.onap.so.utils.Components;
24 import org.slf4j.Logger;
25 import org.slf4j.LoggerFactory;
26 import org.springframework.beans.factory.annotation.Autowired;
27 import org.springframework.stereotype.Component;
28 import org.w3c.dom.Document;
29
30 @Component
31 public class NetworkAdapterImpl {
32
33     private static final Logger logger = LoggerFactory.getLogger(NetworkAdapterImpl.class);
34
35     @Autowired
36     private ExtractPojosForBB extractPojosForBB;
37
38     @Autowired
39     private ExceptionBuilder exceptionUtil;
40
41     public void preProcessNetworkAdapter(BuildingBlockExecution execution) {
42         try {
43             GeneralBuildingBlock gBBInput = execution.getGeneralBuildingBlock();
44             ServiceInstance serviceInstance =
45                     extractPojosForBB.extractByKey(execution, ResourceKey.SERVICE_INSTANCE_ID);
46             execution.setVariable("mso-request-id", gBBInput.getRequestContext().getMsoRequestId());
47             execution.setVariable("mso-service-instance-id", serviceInstance.getServiceInstanceId());
48         } catch (Exception ex) {
49             exceptionUtil.buildAndThrowWorkflowException(execution, 7000, ex);
50         }
51     }
52
53     public void postProcessNetworkAdapter(BuildingBlockExecution execution) {
54         try {
55             String workflowResponse = (String) execution.getVariable("WorkflowResponse");
56             if (workflowResponse != null) {
57                 Optional<String> responseType = findResponseType(workflowResponse);
58                 if ("createNetworkResponse".equals(responseType.get())) {
59                     CreateNetworkResponse createNetworkResponse =
60                             (CreateNetworkResponse) unmarshalXml(workflowResponse, CreateNetworkResponse.class);
61                     execution.setVariable("createNetworkResponse", createNetworkResponse);
62                 } else if ("deleteNetworkResponse".equals(responseType.get())) {
63                     DeleteNetworkResponse deleteNetworkResponse =
64                             (DeleteNetworkResponse) unmarshalXml(workflowResponse, DeleteNetworkResponse.class);
65                     execution.setVariable("deleteNetworkResponse", deleteNetworkResponse);
66                 } else if ("updateNetworkResponse".equals(responseType.get())) {
67                     UpdateNetworkResponse updateNetworkResponse =
68                             (UpdateNetworkResponse) unmarshalXml(workflowResponse, UpdateNetworkResponse.class);
69                     execution.setVariable("updateNetworkResponse", updateNetworkResponse);
70                 } else {
71                     logger.warn("Unable to determine network response type");
72                 }
73             }
74         } catch (Exception e) {
75             logger.error("Error Network Adapter post process", e);
76             exceptionUtil.buildAndThrowWorkflowException(execution, 7000, e.getMessage(), Components.OPENSTACK);
77         }
78     }
79
80     protected <T> Object unmarshalXml(String xmlString, Class<T> resultClass) throws JAXBException {
81         StringReader reader = new StringReader(xmlString);
82         JAXBContext context = JAXBContext.newInstance(resultClass);
83         Unmarshaller unmarshaller = context.createUnmarshaller();
84         return unmarshaller.unmarshal(reader);
85     }
86
87     protected Optional<String> findResponseType(final String xmlString) {
88         try {
89             final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
90             factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, StringUtils.EMPTY);
91             factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, StringUtils.EMPTY);
92
93             final DocumentBuilder builder = factory.newDocumentBuilder();
94             final Document doc = builder.parse(new ByteArrayInputStream(xmlString.getBytes(StandardCharsets.UTF_8)));
95             return Optional.of(doc.getDocumentElement().getNodeName());
96         } catch (final Exception e) {
97             logger.error("Error Finding Response Type", e);
98             return Optional.empty();
99         }
100     }
101
102 }