3 * ============LICENSE_START==========================================
5 * ===================================================================
6 * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
7 * ===================================================================
9 * Unless otherwise specified, all software contained herein is licensed
10 * under the Apache License, Version 2.0 (the "License");
11 * you may not use this software except in compliance with the License.
12 * You may obtain a copy of the License at
14 * http://www.apache.org/licenses/LICENSE-2.0
16 * Unless required by applicable law or agreed to in writing, software
17 * distributed under the License is distributed on an "AS IS" BASIS,
18 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19 * See the License for the specific language governing permissions and
20 * limitations under the License.
22 * Unless otherwise specified, all documentation contained herein is licensed
23 * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
24 * you may not use this documentation except in compliance with the License.
25 * You may obtain a copy of the License at
27 * https://creativecommons.org/licenses/by/4.0/
29 * Unless required by applicable law or agreed to in writing, documentation
30 * distributed under the License is distributed on an "AS IS" BASIS,
31 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
32 * See the License for the specific language governing permissions and
33 * limitations under the License.
35 * ============LICENSE_END============================================
39 package org.onap.portalapp.filter;
41 import java.io.BufferedReader;
42 import java.io.ByteArrayInputStream;
43 import java.io.ByteArrayOutputStream;
44 import java.io.IOException;
45 import java.io.InputStreamReader;
46 import java.nio.charset.StandardCharsets;
47 import java.util.Enumeration;
49 import javax.servlet.FilterChain;
50 import javax.servlet.ReadListener;
51 import javax.servlet.ServletException;
52 import javax.servlet.ServletInputStream;
53 import javax.servlet.http.HttpServletRequest;
54 import javax.servlet.http.HttpServletRequestWrapper;
55 import javax.servlet.http.HttpServletResponse;
57 import org.apache.commons.io.IOUtils;
58 import org.apache.commons.lang.StringUtils;
59 import org.apache.http.HttpStatus;
60 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
61 import org.springframework.web.filter.OncePerRequestFilter;
63 public class SecurityXssFilter extends OncePerRequestFilter {
65 private EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(SecurityXssFilter.class);
67 private static final String APPLICATION_JSON = "application/json";
69 private static final String ERROR_BAD_REQUEST = "{\"error\":\"BAD_REQUEST\"}";
71 private SecurityXssValidator validator = SecurityXssValidator.getInstance();
73 public class RequestWrapper extends HttpServletRequestWrapper {
75 private ByteArrayOutputStream cachedBytes;
77 public RequestWrapper(HttpServletRequest request) {
82 public ServletInputStream getInputStream() throws IOException {
83 if (cachedBytes == null)
86 return new CachedServletInputStream();
90 public BufferedReader getReader() throws IOException {
91 return new BufferedReader(new InputStreamReader(getInputStream()));
94 private void cacheInputStream() throws IOException {
95 cachedBytes = new ByteArrayOutputStream();
96 IOUtils.copy(super.getInputStream(), cachedBytes);
99 public class CachedServletInputStream extends ServletInputStream {
100 private ByteArrayInputStream input;
102 public CachedServletInputStream() {
103 input = new ByteArrayInputStream(cachedBytes.toByteArray());
107 public int read() throws IOException {
112 public boolean isFinished() {
117 public boolean isReady() {
122 public void setReadListener(ReadListener readListener) {
130 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
131 throws ServletException, IOException {
132 StringBuilder requestURL = new StringBuilder(request.getRequestURL().toString());
133 String queryString = request.getQueryString();
134 String requestUrl = "";
135 if (queryString == null) {
136 requestUrl = requestURL.toString();
138 requestUrl = requestURL.append('?').append(queryString).toString();
140 validateRequest(requestUrl, response);
141 StringBuilder headerValues = new StringBuilder();
142 Enumeration<String> headerNames = request.getHeaderNames();
143 while (headerNames.hasMoreElements()) {
144 String key = (String) headerNames.nextElement();
145 String value = request.getHeader(key);
146 headerValues.append(key + ":" + value + ";");
148 validateRequest(headerValues.toString(), response);
149 if (validateRequestType(request)) {
150 request = new RequestWrapper(request);
151 String requestData = IOUtils.toString(request.getInputStream(), StandardCharsets.UTF_8.toString());
152 validateRequest(requestData, response);
153 filterChain.doFilter(request, response);
156 filterChain.doFilter(request, response);
160 private boolean validateRequestType(HttpServletRequest request) {
161 return (request.getMethod().equalsIgnoreCase("POST") || request.getMethod().equalsIgnoreCase("PUT")
162 || request.getMethod().equalsIgnoreCase("DELETE"));
165 private void validateRequest(String text, HttpServletResponse response) throws IOException {
167 if (StringUtils.isNotBlank(text) && validator.denyXSS(text)) {
168 response.setContentType(APPLICATION_JSON);
169 response.setStatus(HttpStatus.SC_BAD_REQUEST);
170 response.getWriter().write(ERROR_BAD_REQUEST);
171 throw new SecurityException(ERROR_BAD_REQUEST);
173 } catch (Exception e) {
174 logger.error(EELFLoggerDelegate.errorLogger, "doFilterInternal() failed due to BAD_REQUEST", e);
175 response.getWriter().close();