Fix high-severity bug 'application exposed to path traversal attack'
[sdc.git] / catalog-be / src / main / webapp / WEB-INF / web.xml
1 <?xml version="1.0" encoding="UTF-8"?>
2 <web-app xmlns="http://java.sun.com/xml/ns/javaee"
3     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4     xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
5     version="3.0">
6
7     <servlet>
8         <servlet-name>jersey</servlet-name>
9         <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
10         <init-param>
11             <param-name>jersey.config.server.provider.packages</param-name>
12             <param-value>
13                 io.swagger.v3.jaxrs2.integration.resources,
14                 org.openecomp.sdc.be.servlets
15             </param-value>
16         </init-param>
17         <init-param>
18             <param-name>jersey.config.server.provider.classnames</param-name>
19             <param-value>
20                 org.glassfish.jersey.media.multipart.MultiPartFeature,
21                 org.openecomp.sdc.be.filters.BasicAuthenticationFilter,
22                 org.openecomp.sdc.be.filters.BeServletFilter,
23                 org.openecomp.sdc.be.filters.ComponentsAvailabilityFilter,
24                 org.glassfish.jersey.server.filter.RolesAllowedDynamicFeature,
25                 org.openecomp.sdc.be.servlets.exception.DefaultExceptionMapper,
26                 org.openecomp.sdc.be.servlets.exception.ComponentExceptionMapper,
27                 org.openecomp.sdc.be.servlets.exception.ConstraintViolationExceptionMapper,
28                 org.openecomp.sdc.be.servlets.exception.StorageExceptionMapper,
29                 org.openecomp.sdc.be.view.MixinModelWriter,
30                 org.openecomp.sdc.config.ObjectMapperProvider
31             </param-value>
32         </init-param>
33         <init-param>
34             <param-name>exclude_url_endpoints</param-name>
35             <param-value>/api/v3/analytics,/api/v3/storeAnalytics</param-value>
36         </init-param>
37         <load-on-startup>1</load-on-startup>
38
39     </servlet>
40
41     <servlet-mapping>
42         <servlet-name>jersey</servlet-name>
43         <url-pattern>/sdc2/rest/*</url-pattern>
44     </servlet-mapping>
45
46     <servlet>
47         <servlet-name>jerseyDistribution</servlet-name>
48         <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
49         <init-param>
50             <param-name>jersey.config.server.provider.packages</param-name>
51             <param-value>
52                 io.swagger.v3.jaxrs2.integration.resources,
53                 org.openecomp.sdc.be.distribution.servlet,
54                 org.openecomp.sdc.be.externalapi.servlet
55             </param-value>
56         </init-param>
57         <init-param>
58             <param-name>jersey.config.server.provider.classnames</param-name>
59             <param-value>
60                 org.glassfish.jersey.media.multipart.MultiPartFeature,
61                 org.openecomp.sdc.be.filters.BeServletFilter,
62                 org.openecomp.sdc.be.filters.ComponentsAvailabilityFilter,
63                 org.openecomp.sdc.be.servlets.exception.DefaultExceptionMapper,
64                 org.openecomp.sdc.be.servlets.exception.ComponentExceptionMapper,
65                 org.openecomp.sdc.be.servlets.exception.StorageExceptionMapper,
66                 org.openecomp.sdc.be.filters.BasicAuthenticationFilter
67             </param-value>
68         </init-param>
69         <load-on-startup>1</load-on-startup>
70         <async-supported>true</async-supported>
71     </servlet>
72
73     <servlet-mapping>
74         <servlet-name>jerseyDistribution</servlet-name>
75         <url-pattern>/sdc/*</url-pattern>
76     </servlet-mapping>
77
78     <!-- ECOMP Portal -->
79     <servlet>
80         <servlet-name>ECOMPServlet</servlet-name>
81         <servlet-class>org.onap.portalsdk.core.onboarding.crossapi.PortalRestAPIProxy
82         </servlet-class>
83         <load-on-startup>3</load-on-startup>
84         <async-supported>true</async-supported>
85     </servlet>
86
87     <!--    <filter>-->
88     <!--        <filter-name>CadiAuthFilter</filter-name>-->
89     <!--        <filter-class>org.onap.portalsdk.core.onboarding.crossapi.CadiAuthFilter</filter-class>-->
90     <!--        <init-param>-->
91     <!--            <param-name>cadi_prop_files</param-name>-->
92     <!--            &lt;!&ndash; Add Absolute path of cadi.properties &ndash;&gt;-->
93     <!--            <param-value>etc/cadi.properties</param-value>-->
94     <!--        </init-param>-->
95     <!--        &lt;!&ndash;Add param values with comma delimited values &ndash;&gt;-->
96     <!--        &lt;!&ndash; for example /api/v3/*,/auxapi/*&ndash;&gt;-->
97     <!--        <init-param>-->
98     <!--            <param-name>include_url_endpoints</param-name>-->
99     <!--            <param-value>/api/v3/roles,/api/v3/user/*,/api/v3/user/*/roles,/api/v3/users,/api/v3/sessionTimeOuts,/api/v3/updateSessionTimeOuts</param-value>-->
100     <!--        </init-param>-->
101     <!--        <init-param>-->
102     <!--            <param-name>exclude_url_endpoints</param-name>-->
103     <!--            <param-value>/api/v3/analytics,/api/v3/storeAnalytics</param-value>-->
104     <!--        </init-param>-->
105     <!--    </filter>-->
106     <!--    <filter-mapping>-->
107     <!--        <filter-name>CadiAuthFilter</filter-name>-->
108     <!--        <url-pattern>/api/v3/*</url-pattern>-->
109     <!--    </filter-mapping>-->
110
111     <servlet>
112         <servlet-name>ViewStatusMessages</servlet-name>
113         <servlet-class>ch.qos.logback.classic.ViewStatusMessagesServlet</servlet-class>
114         <async-supported>true</async-supported>
115     </servlet>
116
117     <servlet>
118         <servlet-name>TogglzConsoleServlet</servlet-name>
119         <servlet-class>org.togglz.console.TogglzConsoleServlet</servlet-class>
120     </servlet>
121
122     <servlet-mapping>
123         <servlet-name>TogglzConsoleServlet</servlet-name>
124         <url-pattern>/catalog/togglz/*</url-pattern>
125     </servlet-mapping>
126
127     <servlet-mapping>
128         <servlet-name>ViewStatusMessages</servlet-name>
129         <url-pattern>/lbClassicStatus</url-pattern>
130     </servlet-mapping>
131
132     <!--        <filter>
133            <filter-name>GzipFilter</filter-name>
134            <filter-class>org.eclipse.jetty.servlets.GzipFilter</filter-class>
135            <async-supported>true</async-supported>
136            <init-param>
137             <param-name>methods</param-name>
138             <param-value>GET,POST,PUT,DELETE</param-value>
139            </init-param>
140            <init-param>
141               <param-name>mimeTypes</param-name>
142               <param-value>text/html,text/plain,text/css,application/javascript,application/json</param-value>
143            </init-param>
144         </filter>
145         <filter-mapping>
146            <filter-name>GzipFilter</filter-name>
147             <url-pattern>/sdc2/rest/*</url-pattern>
148         </filter-mapping>
149
150     -->
151     <!--<filter>-->
152     <!--<filter-name>RestrictionAccessFilter</filter-name>-->
153     <!--<filter-class>org.openecomp.sdc.be.filters.RestrictionAccessFilter</filter-class>-->
154     <!--<async-supported>true</async-supported>-->
155     <!--</filter>-->
156
157     <!--    <filter>-->
158     <!--    <filter-name>gatewayFilter</filter-name>-->
159     <!--    <filter-class>org.openecomp.sdc.be.filters.GatewayFilter</filter-class>-->
160     <!--    </filter>-->
161
162     <filter>
163         <filter-name>gatewayFilter</filter-name>
164         <filter-class>
165             org.springframework.web.filter.DelegatingFilterProxy
166         </filter-class>
167         <init-param>
168             <param-name>targetFilterLifecycle</param-name>
169             <param-value>true</param-value>
170         </init-param>
171     </filter>
172
173     <filter-mapping>
174         <filter-name>gatewayFilter</filter-name>
175         <url-pattern>/sdc2/rest/*</url-pattern>
176         <url-pattern>/sdc/*</url-pattern>
177     </filter-mapping>
178
179     <!--
180         <filter>
181             <filter-name>basicAuthFilter</filter-name>
182             <filter-class>
183                 org.openecomp.sdc.be.filters.BasicAuthenticationFilter
184             </filter-class>
185             <init-param>
186                 <param-name>excludedUrls</param-name>
187                 <param-value>/sdc2/rest/healthCheck,/sdc2/rest/v1/user,/sdc2/rest/v1/user/jh0003,/sdc2/rest/v1/screen,/sdc2/rest/v1/consumers,/sdc2/rest/v1/catalog/uploadType/datatypes,/sdc2/rest/v1/catalog/upload/multipart</param-value>
188             </init-param>
189         </filter>
190
191         <filter-mapping>
192             <filter-name>basicAuthFilter</filter-name>
193             <url-pattern>/*</url-pattern>
194         </filter-mapping>-->
195
196     <!--    <filter>-->
197     <!--        <filter-name>beRestrictionAccessFilter</filter-name>-->
198     <!--        <filter-class>-->
199     <!--            org.springframework.web.filter.DelegatingFilterProxy-->
200     <!--        </filter-class>-->
201     <!--        <init-param>-->
202     <!--            <param-name>targetFilterLifecycle</param-name>-->
203     <!--            <param-value>true</param-value>-->
204     <!--        </init-param>-->
205     <!--    </filter>-->
206     <!--    <filter-mapping>-->
207     <!--        <filter-name>beRestrictionAccessFilter</filter-name>-->
208     <!--        <url-pattern>/sdc2/rest/*</url-pattern>-->
209     <!--    </filter-mapping>-->
210
211     <!--    <filter>-->
212     <!--        <filter-name>CADI</filter-name>-->
213     <!--        <filter-class>org.openecomp.sdc.be.filters.BeCadiServletFilter</filter-class>-->
214     <!--        <init-param>-->
215     <!--            <param-name>cadi_prop_files</param-name>-->
216     <!--            <param-value>etc/cadi.properties</param-value>-->
217     <!--        </init-param>-->
218     <!--    </filter>-->
219
220     <!--    <filter-mapping>-->
221     <!--        <filter-name>CADI</filter-name>-->
222     <!--        <url-pattern>/sdc/*</url-pattern>-->
223     <!--        <url-pattern>/sdc2/rest/*</url-pattern>-->
224     <!--    </filter-mapping>-->
225
226     <filter>
227         <filter-name>reqValidationFilter</filter-name>
228         <filter-class>
229             org.springframework.web.filter.DelegatingFilterProxy
230         </filter-class>
231         <init-param>
232             <param-name>targetFilterLifecycle</param-name>
233             <param-value>true</param-value>
234         </init-param>
235     </filter>
236
237     <filter-mapping>
238         <filter-name>reqValidationFilter</filter-name>
239         <url-pattern>/sdc2/rest/*</url-pattern>
240         <url-pattern>/sdc/*</url-pattern>
241     </filter-mapping>
242
243     <error-page>
244         <exception-type>java.lang.RuntimeException</exception-type>
245         <location>/sdc2/rest/v1/catalog/handleException/</location>
246     </error-page>
247     <context-param>
248         <param-name>contextConfigLocation</param-name>
249         <param-value>classpath:application-context.xml</param-value>
250     </context-param>
251
252     <context-param>
253         <param-name>org.togglz.core.manager.TogglzConfig</param-name>
254         <param-value>org.openecomp.sdc.be.togglz.TogglzConfiguration</param-value>
255     </context-param>
256
257     <context-param>
258         <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
259         <param-value>false</param-value>
260     </context-param>
261
262     <listener>
263         <listener-class>org.openecomp.sdc.be.listen.BEAppContextListener</listener-class>
264     </listener>
265
266     <listener>
267         <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
268     </listener>
269
270     <welcome-file-list>
271         <welcome-file>swagger-ui/index.html</welcome-file>
272     </welcome-file-list>
273 </web-app>