Merge "Fix vulnerabilities and bugs in policy/engine"
[policy/engine.git] / ONAP-PAP-REST / src / main / java / org / onap / policy / pap / xacml / rest / XACMLPapServlet.java
index bedc212..9564acc 100644 (file)
@@ -46,7 +46,7 @@ import java.util.Scanner;
 import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.CopyOnWriteArrayList;
-
+import javax.json.JsonException;
 import javax.persistence.EntityManagerFactory;
 import javax.persistence.Persistence;
 import javax.persistence.PersistenceException;
@@ -1017,26 +1017,24 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                        im.startTransaction();
                        loggingContext.metricEnded();
                        PolicyLogger.metrics("XACMLPapServlet doPut im startTransaction");
+               } catch(AdministrativeStateException e) {
+                   String message = "PUT interface called for PAP " + papResourceName + 
+                           " but it has an Administrative state of " + im.getStateManager().getAdminState() +
+                           "\n Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
+               } catch(StandbyStatusException e) {
+                   String message = "PUT interface called for PAP " + papResourceName + 
+                           " but it has a Standby Status of " + im.getStateManager().getStandbyStatus() +
+                           "\n Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
                } catch (IntegrityMonitorException e) {
-                       String message = "PUT interface called for PAP " + papResourceName;
-                       if (e instanceof AdministrativeStateException) {
-                               message += " but it has an Administrative state of "
-                                       + im.getStateManager().getAdminState();
-                       } else if (e instanceof StandbyStatusException) {
-                               message += " but it has a Standby Status of "
-                                       + im.getStateManager().getStandbyStatus();
-                       } else {
-                               message += " but an exception occurred";
-
-                       }
-                       message += "\n Exception Message: " + e.getMessage();
-
-                       LOGGER.info(message, e);
-                       PolicyLogger.error(MessageCodes.ERROR_SYSTEM_ERROR + " " + message);
-                       loggingContext.transactionEnded();
-                       PolicyLogger.audit("Transaction Failed - See Error.log");
-                       setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, message);
-                       return;
+                   String message = "PUT interface called for PAP " + papResourceName +
+                           " but an exception occurred" +
+                           "\n Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
                }
 
                loggingContext.metricStarted();
@@ -1096,55 +1094,6 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                                return;
                        }
                }
-               //This would occur if we received a notification of a policy rename from AC
-               String oldPolicyName = request.getParameter("oldPolicyName");
-               String newPolicyName = request.getParameter("newPolicyName");
-               if(oldPolicyName != null && newPolicyName != null){
-                       if(LOGGER.isDebugEnabled()){
-                               LOGGER.debug("\nXACMLPapServlet.doPut() - before decoding"
-                                               + "\npolicyToCreateUpdate = " + " ");
-                       }
-                       //decode it
-                       try{
-                               oldPolicyName = URLDecoder.decode(oldPolicyName, "UTF-8");
-                               newPolicyName = URLDecoder.decode(newPolicyName, "UTF-8");
-                               if(LOGGER.isDebugEnabled()){
-                                       LOGGER.debug("\nXACMLPapServlet.doPut() - after decoding"
-                                                       + "\npolicyToCreateUpdate = " + " ");
-                               }
-                       } catch(UnsupportedEncodingException e){
-                               PolicyLogger.error("\nXACMLPapServlet.doPut() - Unsupported URL encoding of policyToCreateUpdate (UTF-8)"
-                                               + "\npolicyToCreateUpdate = " + " ");
-                               setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR,"policyToCreateUpdate encoding not supported"
-                                               + "\nfailure with the following exception: " + e);
-                               loggingContext.transactionEnded();
-                               PolicyLogger.audit("Transaction Failed - See error.log");
-                               im.endTransaction();
-                               return;
-                       }
-                       //send it to PolicyDBDao
-                       PolicyDBDaoTransaction renameTransaction = policyDBDao.getNewTransaction();
-                       try{
-                               renameTransaction.renamePolicy(oldPolicyName,newPolicyName, "XACMLPapServlet.doPut");
-                       }catch(Exception e){
-                               renameTransaction.rollbackTransaction();
-                               setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR,"createUpdateTransaction.createPolicy(policyToCreateUpdate, XACMLPapServlet.doPut) "
-                                               + "\nfailure with the following exception: " + e);
-                               loggingContext.transactionEnded();
-                               PolicyLogger.audit("Transaction Failed - See error.log");
-                               im.endTransaction();
-                               return;
-                       }
-                       loggingContext.metricStarted();
-                       renameTransaction.commitTransaction();
-                       loggingContext.metricEnded();
-                       PolicyLogger.metrics("XACMLPapServlet goPut commitTransaction");
-                       response.setStatus(HttpServletResponse.SC_OK);
-                       loggingContext.transactionEnded();
-                       PolicyLogger.audit("Transaction Ended Successfully");
-                       im.endTransaction();
-                       return;
-               }
                //
                // See if this is Admin Console registering itself with us
                //
@@ -1225,7 +1174,7 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                        PolicyLogger.audit("Transaction Ended Successfully");
                        im.endTransaction();
                        return;
-               } else if (apiflag != null && apiflag.equalsIgnoreCase("api")) {
+               } else if (apiflag != null && "api".equalsIgnoreCase(apiflag)) {
                        // this request is from the Policy Creation API 
                        if(authorizeRequest(request)){
                                APIRequestHandler apiRequestHandler = new APIRequestHandler();
@@ -2260,6 +2209,14 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                        PolicyLogger.audit("Transaction Failed - See Error.log");
                        setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
                        return;
+               } catch (IOException | JsonException e) {
+                   LOGGER.debug(e);
+                   acPutTransaction.rollbackTransaction();
+                   PolicyLogger.error(MessageCodes.ERROR_PROCESS_FLOW, e, "XACMLPapServlet", " AC PUT exception");
+                   loggingContext.transactionEnded();
+                   PolicyLogger.audit("Transaction Failed - See Error.log");
+                   setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
+                   return;
                }
        }
        
@@ -2274,33 +2231,6 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
         * @throws IOException
         */
        private void doACDelete(HttpServletRequest request, HttpServletResponse response, String groupId, ONAPLoggingContext loggingContext) throws IOException {
-               //This code is to allow deletes to propagate to the database since delete is not implemented
-               String isDeleteNotify = request.getParameter("isDeleteNotify");
-               if(isDeleteNotify != null){
-                       String policyToDelete = request.getParameter("policyToDelete");
-                       try{
-                               policyToDelete = URLDecoder.decode(policyToDelete,"UTF-8");
-                       } catch(UnsupportedEncodingException e){
-                               LOGGER.error("Unsupported URL encoding of policyToDelete (UTF-8", e);
-                               setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR,"policyToDelete encoding not supported");
-                               return;
-                       }
-                       PolicyDBDaoTransaction deleteTransaction = policyDBDao.getNewTransaction();
-                       try{
-                               deleteTransaction.deletePolicy(policyToDelete);
-                       } catch(Exception e){
-                               deleteTransaction.rollbackTransaction();
-                               setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR,"deleteTransaction.deleteTransaction(policyToDelete) "
-                                               + "\nfailure with the following exception: " + e);
-                               return;
-                       }
-                       loggingContext.metricStarted();
-                       deleteTransaction.commitTransaction();
-                       loggingContext.metricEnded();
-                       PolicyLogger.metrics("XACMLPapServlet doACPut commitTransaction");
-                       response.setStatus(HttpServletResponse.SC_OK);
-                       return;
-               }
                PolicyDBDaoTransaction removePdpOrGroupTransaction = policyDBDao.getNewTransaction();
                try {
                        // for all DELETE operations the group must exist before the operation can be done
@@ -2881,7 +2811,7 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                                }
                        }
                        // remove any ACs that are no longer connected
-                       if (disconnectedACs.size() > 0) {
+                       if (!disconnectedACs.isEmpty()) {
                                adminConsoleURLStringList.removeAll(disconnectedACs);
                        }
                }
@@ -2898,24 +2828,21 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                        PolicyLogger.audit("Transaction Failed - See Error.log");
                        response.setStatus(HttpServletResponse.SC_OK);
                        return;
-               }catch (ForwardProgressException | AdministrativeStateException | StandbyStatusException e){
-                       String submsg;
-                       if (e instanceof ForwardProgressException) {
-                               submsg = " is not making forward progress.";
-                       } else if (e instanceof AdministrativeStateException) {
-                               submsg = " Administrative State is LOCKED.";
-                       } else {
-                               submsg = " Standby Status is NOT PROVIDING SERVICE.";
-                       }
-
-                       String message = "GET:/pap/test called and PAP " + papResourceName + submsg
-                                       + " Exception Message: " + e.getMessage();
-                       LOGGER.info(message, e);
-                       PolicyLogger.error(MessageCodes.ERROR_SYSTEM_ERROR + " " + message);
-                       loggingContext.transactionEnded();
-                       PolicyLogger.audit("Transaction Failed - See Error.log");
-                       setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, message);
-                       return;
+               }catch (ForwardProgressException e){
+                   String message = "GET:/pap/test called and PAP " + papResourceName + " is not making forward progress."
+                           + " Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
+               }catch (AdministrativeStateException e){
+                   String message = "GET:/pap/test called and PAP " + papResourceName + " Administrative State is LOCKED."
+                           + " Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
+               }catch (StandbyStatusException e){
+                   String message = "GET:/pap/test called and PAP " + papResourceName + " Standby Status is NOT PROVIDING SERVICE."
+                           + " Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
                }catch (Exception e) {
                        //A subsystem is not making progress, is locked, standby or is not responding
                        String eMsg = e.getMessage();
@@ -3090,4 +3017,12 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
        public static void setMsPolicyName(String msPolicyName) {
                XACMLPapServlet.msPolicyName = msPolicyName;
        }
+       
+       private void logMessage(Exception e, String message, ONAPLoggingContext loggingContext, HttpServletResponse response) {
+           LOGGER.info(message, e);
+           PolicyLogger.error(MessageCodes.ERROR_SYSTEM_ERROR + " " + message);
+           loggingContext.transactionEnded();
+           PolicyLogger.audit("Transaction Failed - See Error.log");
+           setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, message);
+       }
 }