DMAAP-DR Header Injection fix

[dmaap/datarouter.git] / datarouter-node / src / main / java / org / onap / dmaap / datarouter / node / NodeServlet.java

diff --git a/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java b/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
index 6fd1def..27fa5f3 100644 (file)
--- a/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
+++ b/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
@@ -130,7 +130,7 @@ public class NodeServlet extends HttpServlet {
             } else if (path.startsWith("/internal/resetSubscription/")) {
                 String subid = path.substring(28);
                 if (subid.length() != 0 && subid.indexOf('/') == -1) {
-                    NodeMain.resetQueue(subid, ip);
+                    NodeServer.resetQueue(subid, ip);
                     resp.setStatus(HttpServletResponse.SC_NO_CONTENT);
                     return;
                 }
@@ -253,6 +253,13 @@ public class NodeServlet extends HttpServlet {
                 return;
             }
             fileid = fileid.substring(18);
+            if (req.getHeader("X-DMAAP-DR-PUBLISH-ID") != null && !req.getHeader("X-DMAAP-DR-PUBLISH-ID").matches("^[a-zA-Z0-9_]+$")) {
+                String reason = "Error validating header";
+                eelfLogger.error(reason);
+                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, reason);
+                eelfLogger.info(EelfMsgs.EXIT);
+                return;
+            }
             pubid = req.getHeader("X-DMAAP-DR-PUBLISH-ID");
             user = "datartr";   // SP6 : Added usr as datartr to avoid null entries for internal routing
             targets = config.parseRouting(req.getHeader("X-DMAAP-DR-ROUTING"));
@@ -424,7 +431,9 @@ public class NodeServlet extends HttpServlet {
                     mw.write("X-DMAAP-DR-ROUTING\t" + t.getRouting() + "\n");
                 }
                 mw.close();
-                meta.renameTo(new File(dbase + ".M"));
+                if (!meta.renameTo(new File(dbase + ".M"))) {
+                    eelfLogger.error("Rename of file " + dbase + " failed.");
+                }
             }
             resp.setStatus(HttpServletResponse.SC_NO_CONTENT);
             try {