Fix security risk 'Improper Input Validation'
[sdc.git] / utils / webseal-simulator / src / main / java / org / openecomp / sdc / webseal / simulator / Login.java
1 /*-
2  * ============LICENSE_START=======================================================
3  * SDC
4  * ================================================================================
5  * Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
6  * ================================================================================
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  *      http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  * ============LICENSE_END=========================================================
19  */
20
21 package org.openecomp.sdc.webseal.simulator;
22
23 import java.io.IOException;
24 import java.io.PrintWriter;
25 import java.util.Collection;
26 import java.util.Iterator;
27 import javax.servlet.ServletException;
28 import javax.servlet.http.Cookie;
29 import javax.servlet.http.HttpServlet;
30 import javax.servlet.http.HttpServletRequest;
31 import javax.servlet.http.HttpServletResponse;
32 import org.openecomp.sdc.logging.api.Logger;
33 import org.openecomp.sdc.logging.api.LoggerFactory;
34 import org.openecomp.sdc.webseal.simulator.conf.Conf;
35
36 public class Login extends HttpServlet {
37
38     private static final long serialVersionUID = 1L;
39     private static final Logger logger = LoggerFactory.getLogger(Login.class);
40
41     @Override
42     protected void doGet(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException {
43
44         if (null != request.getParameter("userId")) {
45             doPost(request, response);
46             return;
47         }
48         logger.info("about to build login page");
49         response.setContentType("text/html");
50         PrintWriter writer = response.getWriter();
51
52         Collection<User> allUsers = Conf.getInstance().getUsers().values();
53         writer.println("<html>");
54
55         writer.println("<head>");
56         writer.println("<style>");
57         writer.println("body {padding: 40px; font-family: Arial; font-size: 14px;}");
58         writer.println("h1 {background-color: #DDDDDD; padding: 4px 10px;}");
59         writer.println("h2 {margin-top: 20px;}");
60         writer.println(".label {width: 100px; float:left;}");
61         writer.println(".break {display: block; margin-bottom: 10px;}");
62         writer.println("tr {padding: 4px 10px;}");
63         writer.println("th {padding: 4px 10px; text-align: left; background-color: #dddddd;}");
64         writer.println("td {padding: 4px 10px; text-align: left;}");
65         writer.println("</style>");
66         writer.println("</head>");
67
68         writer.println("<body>");
69
70         writer.println("<h1>Webseal simulator</h1>");
71         writer.println("<h2>Login:</h2>");
72
73         writer.println("<form action=\"\" method=\"post\">");
74         writer.println("  <div class='label'>User id:</div>");
75         writer.println("  <input type='text' name='userId'>");
76         writer.println("  <div class='break'></div>");
77
78         writer.println("  <div class='label'>Password:</div>");
79         writer.println("  <input type='password' name='password'>");
80         writer.println("  <div class='break'></div>");
81
82         writer.println("  <input type='submit' value='Login'>");
83         writer.println("  <label name='message'></label>");
84         writer.println("</form>");
85
86         writer.println("<hr/>");
87         writer.println("<h2>Quick links:</h2>");
88         writer.println("<table>");
89         writer.println("<tr>");
90         writer.println("<th>full name</th>");
91         writer.println("<th>user id</th>");
92         writer.println("<th>role</th>");
93         writer.println("<th>action</th>");
94         writer.println("</tr>");
95         Iterator<User> iterator = allUsers.iterator();
96         while (iterator.hasNext()) {
97             User user = iterator.next();
98             writer.println("<tr>");
99             writer.println("<td>" + user.getUserRef() + "</td>");
100             writer.println("<td>" + user.getUserId() + "</td>");
101             writer.println("<td>" + user.getRole() + "</td>");
102             writer.println("<td>" + user.getUserCreateRef() + "</td>");
103             writer.println("</tr>");
104         }
105         writer.println("</table>");
106
107         writer.println("<a href='create?all=true' target='resultFrame'>Create All</a>");
108         writer.println("<hr/><iframe name='resultFrame' width='400' height='300'></iframe>");
109
110         writer.println("</body>");
111         writer.println("</html>");
112
113     }
114
115     @Override
116     public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException {
117
118         String userId = request.getParameter("userId");
119         String password = request.getParameter("password");
120         request.setAttribute("message", "OK");
121
122         logger.info("Login -> doPost userId={}", userId);
123         User user = getUser(userId, password);
124         if (user == null) {
125             response.sendError(500, "ERROR: userId or password incorrect");
126         } else {
127             logger.info("Login -> doPost redirect to /sdc1 (to proxy)");
128             response.addCookie(new Cookie("HTTP_IV_USER", user.getUserId()));
129             response.addCookie(new Cookie("USER_ID", user.getUserId()));
130             response.addCookie(new Cookie("HTTP_CSP_FIRSTNAME", user.getFirstName()));
131             response.addCookie(new Cookie("HTTP_CSP_EMAIL", user.getEmail()));
132             response.addCookie(new Cookie("HTTP_CSP_LASTNAME", user.getLastName()));
133             response.addCookie(new Cookie("HTTP_IV_REMOTE_ADDRESS", "0.0.0.0"));
134             response.addCookie(new Cookie("HTTP_CSP_WSTYPE", "Intranet"));
135             response.addCookie(new Cookie(Conf.getInstance().getPortalCookieName(), "portal"));
136             response.sendRedirect("/sdc1");
137         }
138
139     }
140
141     private User getUser(String userId, String password) {
142         User user = Conf.getInstance().getUsers().get(userId);
143         if (user == null) {
144             return null;
145         }
146         if (!password.equals(user.getPassword())) {
147             return null;
148         }
149         return user;
150     }
151
152     @Override
153     public String getServletInfo() {
154         return "Http Proxy Servlet";
155     }
156 }