DMAAP-DR Header Injection fix

[dmaap/datarouter.git] / datarouter-node / src / main / java / org / onap / dmaap / datarouter / node / NodeServlet.java

diff --git a/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java b/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
index 163b59e..27fa5f3 100644 (file)
--- a/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
+++ b/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
@@ -130,7 +130,7 @@ public class NodeServlet extends HttpServlet {
             } else if (path.startsWith("/internal/resetSubscription/")) {
                 String subid = path.substring(28);
                 if (subid.length() != 0 && subid.indexOf('/') == -1) {
-                    NodeMain.resetQueue(subid, ip);
+                    NodeServer.resetQueue(subid, ip);
                     resp.setStatus(HttpServletResponse.SC_NO_CONTENT);
                     return;
                 }
@@ -253,6 +253,13 @@ public class NodeServlet extends HttpServlet {
                 return;
             }
             fileid = fileid.substring(18);
+            if (req.getHeader("X-DMAAP-DR-PUBLISH-ID") != null && !req.getHeader("X-DMAAP-DR-PUBLISH-ID").matches("^[a-zA-Z0-9_]+$")) {
+                String reason = "Error validating header";
+                eelfLogger.error(reason);
+                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, reason);
+                eelfLogger.info(EelfMsgs.EXIT);
+                return;
+            }
             pubid = req.getHeader("X-DMAAP-DR-PUBLISH-ID");
             user = "datartr";   // SP6 : Added usr as datartr to avoid null entries for internal routing
             targets = config.parseRouting(req.getHeader("X-DMAAP-DR-ROUTING"));
@@ -412,7 +419,7 @@ public class NodeServlet extends HttpServlet {
             for (Target t : targets) {
                 DestInfo di = t.getDestInfo();
                 if (di == null) {
-                    // TODO: unknown destination
+                    //Handle this? : unknown destination
                     continue;
                 }
                 String dbase = PathUtil
@@ -424,7 +431,9 @@ public class NodeServlet extends HttpServlet {
                     mw.write("X-DMAAP-DR-ROUTING\t" + t.getRouting() + "\n");
                 }
                 mw.close();
-                meta.renameTo(new File(dbase + ".M"));
+                if (!meta.renameTo(new File(dbase + ".M"))) {
+                    eelfLogger.error("Rename of file " + dbase + " failed.");
+                }
             }
             resp.setStatus(HttpServletResponse.SC_NO_CONTENT);
             try {
@@ -455,15 +464,11 @@ public class NodeServlet extends HttpServlet {
                 }
             }
             try {
-                data.delete();
+                Files.delete(data.toPath());
+                Files.delete(meta.toPath());
             } catch (Exception e) {
                 eelfLogger.error("NODE0533 Exception common: " + e);
             }
-            try {
-                meta.delete();
-            } catch (Exception e) {
-                eelfLogger.error("NODE0534 Exception common: " + e);
-            }
         }
     }