update link to upper-constraints.txt
[dmaap/datarouter.git] / datarouter-node / src / main / java / org / onap / dmaap / datarouter / node / NodeServlet.java
index 3f2fc09..4dbe0e7 100644 (file)
 
 package org.onap.dmaap.datarouter.node;
 
-import static org.onap.dmaap.datarouter.node.NodeUtils.sendResponseError;
+import static org.onap.dmaap.datarouter.node.utils.NodeUtils.sendResponseError;
 
 import com.att.eelf.configuration.EELFLogger;
 import com.att.eelf.configuration.EELFManager;
+import jakarta.servlet.http.HttpServlet;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.FileWriter;
@@ -40,17 +41,19 @@ import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.Enumeration;
 import java.util.regex.Pattern;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import org.jetbrains.annotations.Nullable;
+import org.onap.dmaap.datarouter.node.delivery.Delivery;
 import org.onap.dmaap.datarouter.node.eelf.EelfMsgs;
+import org.onap.dmaap.datarouter.node.log.StatusLog;
+import org.onap.dmaap.datarouter.node.utils.NodeUtils;
 import org.slf4j.MDC;
 
 /**
- * Servlet for handling all http and https requests to the data router node
- * <p>
- * Handled requests are:
+ * Servlet for handling all http and https requests to the data router node.
+ *
+ * <p>Handled requests are:
  * <br>
  * GET http://<i>node</i>/internal/fetchProv - fetch the provisioning data
  * <br>
@@ -64,9 +67,9 @@ public class NodeServlet extends HttpServlet {
     private static final String INVALID_REQUEST_URI = "Invalid request URI.  Expecting <feed-publishing-url>/<fileid>.";
     private static final String IO_EXCEPTION = "IOException";
     private static final String ON_BEHALF_OF = "X-DMAAP-DR-ON-BEHALF-OF";
-    private static NodeConfigManager config;
-    private static Pattern metaDataPattern;
-    private static EELFLogger eelfLogger = EELFManager.getInstance().getLogger(NodeServlet.class);
+    private final NodeConfigManager config;
+    private static final Pattern metaDataPattern;
+    private static final EELFLogger eelfLogger = EELFManager.getInstance().getLogger(NodeServlet.class);
 
     static {
         final String ws = "\\s*";
@@ -81,30 +84,30 @@ public class NodeServlet extends HttpServlet {
 
     private final Delivery delivery;
 
-    NodeServlet(Delivery delivery) {
+    NodeServlet(Delivery delivery, NodeConfigManager nodeConfigManager) {
+        config = nodeConfigManager;
         this.delivery = delivery;
     }
 
     /**
-     * Get the NodeConfigurationManager
+     * Get the NodeConfigurationManager.
      */
     @Override
     public void init() {
-        config = NodeConfigManager.getInstance();
-        eelfLogger.info("NODE0101 Node Servlet Configured");
+        eelfLogger.debug("NODE0101 Node Servlet Configured");
     }
 
     private boolean down(HttpServletResponse resp) {
         if (config.isShutdown() || !config.isConfigured()) {
             sendResponseError(resp, HttpServletResponse.SC_SERVICE_UNAVAILABLE, eelfLogger);
-            eelfLogger.info("NODE0102 Rejecting request: Service is being quiesced");
+            eelfLogger.error("NODE0102 Rejecting request: Service is being quiesced");
             return true;
         }
         return false;
     }
 
     /**
-     * Handle a GET for /internal/fetchProv
+     * Handle a GET for /internal/fetchProv.
      */
     @Override
     protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
@@ -112,8 +115,8 @@ public class NodeServlet extends HttpServlet {
         NodeUtils.setRequestIdAndInvocationId(req);
         eelfLogger.info(EelfMsgs.ENTRY);
         try {
-            eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(ON_BEHALF_OF),
-                    getIdFromPath(req) + "");
+            eelfLogger.debug(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(ON_BEHALF_OF),
+                getIdFromPath(req) + "");
             if (down(resp)) {
                 return;
             }
@@ -130,13 +133,13 @@ public class NodeServlet extends HttpServlet {
             } else if (path.startsWith("/internal/resetSubscription/")) {
                 String subid = path.substring(28);
                 if (subid.length() != 0 && subid.indexOf('/') == -1) {
-                    NodeMain.resetQueue(subid, ip);
+                    NodeServer.resetQueue(subid, ip);
                     resp.setStatus(HttpServletResponse.SC_NO_CONTENT);
                     return;
                 }
             }
 
-            eelfLogger.info("NODE0103 Rejecting invalid GET of " + path + FROM + ip);
+            eelfLogger.debug("NODE0103 Rejecting invalid GET of " + path + FROM + ip);
             sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, eelfLogger);
         } finally {
             eelfLogger.info(EelfMsgs.EXIT);
@@ -144,15 +147,15 @@ public class NodeServlet extends HttpServlet {
     }
 
     /**
-     * Handle all PUT requests
+     * Handle all PUT requests.
      */
     @Override
     protected void doPut(HttpServletRequest req, HttpServletResponse resp) {
         NodeUtils.setIpAndFqdnForEelf("doPut");
         NodeUtils.setRequestIdAndInvocationId(req);
         eelfLogger.info(EelfMsgs.ENTRY);
-        eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(ON_BEHALF_OF),
-                getIdFromPath(req) + "");
+        eelfLogger.debug(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(ON_BEHALF_OF),
+            getIdFromPath(req) + "");
         try {
             common(req, resp, true);
         } catch (IOException ioe) {
@@ -162,15 +165,15 @@ public class NodeServlet extends HttpServlet {
     }
 
     /**
-     * Handle all DELETE requests
+     * Handle all DELETE requests.
      */
     @Override
     protected void doDelete(HttpServletRequest req, HttpServletResponse resp) {
         NodeUtils.setIpAndFqdnForEelf("doDelete");
         NodeUtils.setRequestIdAndInvocationId(req);
         eelfLogger.info(EelfMsgs.ENTRY);
-        eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(ON_BEHALF_OF),
-                getIdFromPath(req) + "");
+        eelfLogger.debug(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(ON_BEHALF_OF),
+            getIdFromPath(req) + "");
         try {
             common(req, resp, false);
         } catch (IOException ioe) {
@@ -194,8 +197,7 @@ public class NodeServlet extends HttpServlet {
         String lip = req.getLocalAddr();
         String pubid = null;
         String rcvd = NodeUtils.logts(System.currentTimeMillis()) + ";from=" + ip + ";by=" + lip;
-        Target[] targets = null;
-        boolean isAAFFeed = false;
+        Target[] targets;
         if (fileid.startsWith("/delete/")) {
             deleteFile(req, resp, fileid, pubid);
             return;
@@ -203,46 +205,24 @@ public class NodeServlet extends HttpServlet {
         String credentials = req.getHeader("Authorization");
         if (credentials == null) {
             eelfLogger.error("NODE0306 Rejecting unauthenticated PUT or DELETE of " + req.getPathInfo() + FROM + req
-                    .getRemoteAddr());
+                .getRemoteAddr());
             resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Authorization header required");
             eelfLogger.info(EelfMsgs.EXIT);
             return;
         }
         if (fileid.startsWith(PUBLISH)) {
             fileid = fileid.substring(9);
-            int i = fileid.indexOf('/');
-            if (i == -1 || i == fileid.length() - 1) {
+            int index = fileid.indexOf('/');
+            if (index == -1 || index == fileid.length() - 1) {
                 eelfLogger.error("NODE0205 Rejecting bad URI for PUT or DELETE of " + req.getPathInfo() + FROM + req
-                        .getRemoteAddr());
+                    .getRemoteAddr());
                 resp.sendError(HttpServletResponse.SC_NOT_FOUND,
-                        "Invalid request URI.  Expecting <feed-publishing-url>/<fileid>.  Possible missing fileid.");
+                    "Invalid request URI.  Expecting <feed-publishing-url>/<fileid>.  Possible missing fileid.");
                 eelfLogger.info(EelfMsgs.EXIT);
                 return;
             }
-            feedid = fileid.substring(0, i);
-
-            if (config.getCadiEnabled()) {
-                String path = req.getPathInfo();
-                if (!path.startsWith("/internal") && feedid != null) {
-                    String aafInstance = config.getAafInstance(feedid);
-                    if (!("legacy".equalsIgnoreCase(aafInstance))) {
-                        isAAFFeed = true;
-                        String permission = config.getPermission(aafInstance);
-                        eelfLogger.info("NodeServlet.common() permission string - " + permission);
-                        //Check in CADI Framework API if user has AAF permission or not
-                        if (!req.isUserInRole(permission)) {
-                            String message = "AAF disallows access to permission string - " + permission;
-                            eelfLogger.error("NODE0307 Rejecting unauthenticated PUT or DELETE of " + req.getPathInfo()
-                                    + FROM + req.getRemoteAddr());
-                            resp.sendError(HttpServletResponse.SC_FORBIDDEN, message);
-                            eelfLogger.info(EelfMsgs.EXIT);
-                            return;
-                        }
-                    }
-                }
-            }
-
-            fileid = fileid.substring(i + 1);
+            feedid = fileid.substring(0, index);
+            fileid = fileid.substring(index + 1);
             pubid = config.getPublishId();
             targets = config.getTargets(feedid);
         } else if (fileid.startsWith(INTERNAL_PUBLISH)) {
@@ -253,22 +233,21 @@ public class NodeServlet extends HttpServlet {
                 return;
             }
             fileid = fileid.substring(18);
-            pubid = req.getHeader("X-DMAAP-DR-PUBLISH-ID");
-            user = "datartr";   // SP6 : Added usr as datartr to avoid null entries for internal routing
+            pubid = generateAndValidatePublishId(req);
             targets = config.parseRouting(req.getHeader("X-DMAAP-DR-ROUTING"));
         } else {
             eelfLogger.error("NODE0204 Rejecting bad URI for PUT or DELETE of " + req.getPathInfo() + FROM + req
-                    .getRemoteAddr());
+                .getRemoteAddr());
             resp.sendError(HttpServletResponse.SC_NOT_FOUND,
-                    INVALID_REQUEST_URI);
+                INVALID_REQUEST_URI);
             eelfLogger.info(EelfMsgs.EXIT);
             return;
         }
         if (fileid.indexOf('/') != -1) {
             eelfLogger.error("NODE0202 Rejecting bad URI for PUT or DELETE of " + req.getPathInfo() + FROM + req
-                    .getRemoteAddr());
+                .getRemoteAddr());
             resp.sendError(HttpServletResponse.SC_NOT_FOUND,
-                    INVALID_REQUEST_URI);
+                INVALID_REQUEST_URI);
             eelfLogger.info(EelfMsgs.EXIT);
             return;
         }
@@ -284,39 +263,15 @@ public class NodeServlet extends HttpServlet {
         String logurl = HTTPS + hp + INTERNAL_PUBLISH + fileid;
         if (feedid != null) {
             logurl = HTTPS + hp + PUBLISH + feedid + "/" + fileid;
-            //Cadi code starts
-            if (!isAAFFeed) {
-                String reason = config.isPublishPermitted(feedid, credentials, ip);
-                if (reason != null) {
-                    eelfLogger.error("NODE0111 Rejecting unauthorized publish attempt to feed " + PathUtil
-                            .cleanString(feedid) + " fileid " + PathUtil.cleanString(fileid) + FROM + PathUtil
-                            .cleanString(ip) + " reason " + PathUtil.cleanString(reason));
-                    resp.sendError(HttpServletResponse.SC_FORBIDDEN, reason);
-                    eelfLogger.info(EelfMsgs.EXIT);
-                    return;
-                }
-                user = config.getAuthUser(feedid, credentials);
-            } else {
-                String reason = config.isPublishPermitted(feedid, ip);
-                if (reason != null) {
-                    eelfLogger.error("NODE0111 Rejecting unauthorized publish attempt to feed " + PathUtil
-                            .cleanString(feedid) + " fileid " + PathUtil.cleanString(fileid) + FROM + PathUtil
-                            .cleanString(ip) + " reason   Invalid AAF user- " + PathUtil.cleanString(reason));
-                    String message = "Invalid AAF user- " + PathUtil.cleanString(reason);
-                    eelfLogger.info("NODE0308 Rejecting unauthenticated PUT or DELETE of " + PathUtil
-                            .cleanString(req.getPathInfo()) + FROM + PathUtil.cleanString(req.getRemoteAddr()));
-                    resp.sendError(HttpServletResponse.SC_FORBIDDEN, message);
-                    return;
-                }
-                if ((req.getUserPrincipal() != null) && (req.getUserPrincipal().getName() != null)) {
-                    String userName = req.getUserPrincipal().getName();
-                    String[] attid = userName.split("@");
-                    user = attid[0];
-                } else {
-                    user = "AAFUser";
-                }
+            String reason = config.isPublishPermitted(feedid, credentials, ip);
+            if (reason != null) {
+                eelfLogger.info("NODE0111 Rejecting unauthorized publish attempt to feed " + feedid + " fileid "
+                    + fileid + " from " + ip + " reason " + reason);
+                resp.sendError(javax.servlet.http.HttpServletResponse.SC_FORBIDDEN, reason);
+                eelfLogger.info(EelfMsgs.EXIT);
+                return;
             }
-            //Cadi code Ends
+            user = config.getAuthUser(feedid, credentials);
             String newnode = config.getIngressNode(feedid, user, ip);
             if (newnode != null) {
                 String port = "";
@@ -326,9 +281,9 @@ public class NodeServlet extends HttpServlet {
                 }
                 String redirto = HTTPS + newnode + port + PUBLISH + feedid + "/" + fileid;
                 eelfLogger
-                        .info("NODE0108 Redirecting publish attempt for feed " + PathUtil.cleanString(feedid) + USER
-                                + PathUtil.cleanString(user) + " ip " + PathUtil.cleanString(ip) + " to " + PathUtil
-                                .cleanString(redirto));  //Fortify scan fixes - log forging
+                    .debug("NODE0108 Redirecting publish attempt for feed " + PathUtil.cleanString(feedid) + USER
+                        + PathUtil.cleanString(user) + " ip " + PathUtil.cleanString(ip) + " to " + PathUtil
+                        .cleanString(redirto));  //Fortify scan fixes - log forging
                 resp.sendRedirect(PathUtil.cleanString(redirto));         //Fortify scan fixes-open redirect - 2 issues
                 eelfLogger.info(EelfMsgs.EXIT);
                 return;
@@ -345,23 +300,23 @@ public class NodeServlet extends HttpServlet {
         try {
             StringBuilder mx = new StringBuilder();
             mx.append(req.getMethod()).append('\t').append(fileid).append('\n');
-            Enumeration hnames = req.getHeaderNames();
+            Enumeration<String> hnames = req.getHeaderNames();
             String ctype = null;
             boolean hasRequestIdHeader = false;
             boolean hasInvocationIdHeader = false;
             while (hnames.hasMoreElements()) {
-                String hn = (String) hnames.nextElement();
+                String hn = hnames.nextElement();
                 String hnlc = hn.toLowerCase();
-                if ((isput && ("content-type".equals(hnlc) ||
-                        "content-language".equals(hnlc) ||
-                        "content-md5".equals(hnlc) ||
-                        "content-range".equals(hnlc))) ||
-                        "x-dmaap-dr-meta".equals(hnlc) ||
-                        (feedid == null && "x-dmaap-dr-received".equals(hnlc)) ||
-                        (hnlc.startsWith("x-") && !hnlc.startsWith("x-dmaap-dr-"))) {
-                    Enumeration hvals = req.getHeaders(hn);
+                if ((isput && ("content-type".equals(hnlc)
+                    || "content-language".equals(hnlc)
+                    || "content-md5".equals(hnlc)
+                    || "content-range".equals(hnlc)))
+                    || "x-dmaap-dr-meta".equals(hnlc)
+                    || (feedid == null && "x-dmaap-dr-received".equals(hnlc))
+                    || (hnlc.startsWith("x-") && !hnlc.startsWith("x-dmaap-dr-"))) {
+                    Enumeration<String> hvals = req.getHeaders(hn);
                     while (hvals.hasMoreElements()) {
-                        String hv = (String) hvals.nextElement();
+                        String hv = hvals.nextElement();
                         if ("content-type".equals(hnlc)) {
                             ctype = hv;
                         }
@@ -374,16 +329,16 @@ public class NodeServlet extends HttpServlet {
                         if ("x-dmaap-dr-meta".equals(hnlc)) {
                             if (hv.length() > 4096) {
                                 eelfLogger.error("NODE0109 Rejecting publish attempt with metadata too long for feed "
-                                        + PathUtil.cleanString(feedid) + USER + PathUtil.cleanString(user) + " ip "
-                                        + PathUtil.cleanString(ip));  //Fortify scan fixes - log forging
+                                    + PathUtil.cleanString(feedid) + USER + PathUtil.cleanString(user) + " ip "
+                                    + PathUtil.cleanString(ip));  //Fortify scan fixes - log forging
                                 resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Metadata too long");
                                 eelfLogger.info(EelfMsgs.EXIT);
                                 return;
                             }
                             if (!metaDataPattern.matcher(hv.replaceAll("\\\\.", "X")).matches()) {
                                 eelfLogger.error("NODE0109 Rejecting publish attempt with malformed metadata for feed "
-                                        + PathUtil.cleanString(feedid) + USER + PathUtil.cleanString(user) + " ip "
-                                        + PathUtil.cleanString(ip));  //Fortify scan fixes - log forging
+                                    + PathUtil.cleanString(feedid) + USER + PathUtil.cleanString(user) + " ip "
+                                    + PathUtil.cleanString(ip));  //Fortify scan fixes - log forging
                                 resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Malformed metadata");
                                 eelfLogger.info(EelfMsgs.EXIT);
                                 return;
@@ -405,18 +360,18 @@ public class NodeServlet extends HttpServlet {
             String message = writeInputStreamToFile(req, data);
             if (message != null) {
                 StatusLog.logPubFail(pubid, feedid, logurl, req.getMethod(), ctype, exlen, data.length(), ip, user,
-                        message);
+                    message);
                 throw new IOException(message);
             }
             Path dpath = Paths.get(fbase);
             for (Target t : targets) {
                 DestInfo di = t.getDestInfo();
                 if (di == null) {
-                    // TODO: unknown destination
+                    //Handle this? : unknown destination
                     continue;
                 }
                 String dbase = PathUtil
-                        .cleanString(di.getSpool() + "/" + pubid);  //Fortify scan fixes-Path Manipulation
+                    .cleanString(di.getSpool() + "/" + pubid);  //Fortify scan fixes-Path Manipulation
                 Files.createLink(Paths.get(dbase), dpath);
                 mw = new FileWriter(meta);
                 mw.write(metadata);
@@ -424,26 +379,28 @@ public class NodeServlet extends HttpServlet {
                     mw.write("X-DMAAP-DR-ROUTING\t" + t.getRouting() + "\n");
                 }
                 mw.close();
-                meta.renameTo(new File(dbase + ".M"));
+                if (!meta.renameTo(new File(dbase + ".M"))) {
+                    eelfLogger.error("Rename of file " + dbase + " failed.");
+                }
             }
             resp.setStatus(HttpServletResponse.SC_NO_CONTENT);
             try {
                 resp.getOutputStream().close();
             } catch (IOException ioe) {
                 StatusLog.logPubFail(pubid, feedid, logurl, req.getMethod(), ctype, exlen, data.length(), ip, user,
-                        ioe.getMessage());
+                    ioe.getMessage());
                 //Fortify scan fixes - log forging
                 eelfLogger.error("NODE0110 IO Exception while closing IO stream " + PathUtil.cleanString(feedid)
-                        + USER + PathUtil.cleanString(user) + " ip " + PathUtil.cleanString(ip) + " " + ioe
-                        .toString(), ioe);
+                    + USER + PathUtil.cleanString(user) + " ip " + PathUtil.cleanString(ip) + " " + ioe
+                    .toString(), ioe);
                 throw ioe;
             }
 
             StatusLog.logPub(pubid, feedid, logurl, req.getMethod(), ctype, data.length(), ip, user,
-                    HttpServletResponse.SC_NO_CONTENT);
+                HttpServletResponse.SC_NO_CONTENT);
         } catch (IOException ioe) {
             eelfLogger.error("NODE0110 IO Exception receiving publish attempt for feed " + feedid + USER + user
-                    + " ip " + ip + " " + ioe.toString(), ioe);
+                + " ip " + ip + " " + ioe.toString(), ioe);
             eelfLogger.info(EelfMsgs.EXIT);
             throw ioe;
         } finally {
@@ -455,25 +412,32 @@ public class NodeServlet extends HttpServlet {
                 }
             }
             try {
-                data.delete();
+                Files.delete(data.toPath());
+                Files.delete(meta.toPath());
             } catch (Exception e) {
                 eelfLogger.error("NODE0533 Exception common: " + e);
             }
-            try {
-                meta.delete();
-            } catch (Exception e) {
-                eelfLogger.error("NODE0534 Exception common: " + e);
-            }
         }
     }
 
+    private String generateAndValidatePublishId(HttpServletRequest req) throws IOException {
+        String newPubId = req.getHeader("X-DMAAP-DR-PUBLISH-ID");
+
+        String regex = ".*";
+
+        if(newPubId.matches(regex)){
+            return newPubId;
+        }
+        throw new IOException("Invalid Header X-DMAAP-DR-PUBLISH-ID");
+    }
+
     private String writeInputStreamToFile(HttpServletRequest req, File data) {
         byte[] buf = new byte[1024 * 1024];
-        int i;
+        int bytesRead;
         try (OutputStream dos = new FileOutputStream(data);
-                InputStream is = req.getInputStream()) {
-            while ((i = is.read(buf)) > 0) {
-                dos.write(buf, 0, i);
+            InputStream is = req.getInputStream()) {
+            while ((bytesRead = is.read(buf)) > 0) {
+                dos.write(buf, 0, bytesRead);
             }
         } catch (IOException ioe) {
             eelfLogger.error("NODE0530 Exception common: " + ioe, ioe);
@@ -497,28 +461,28 @@ public class NodeServlet extends HttpServlet {
         final String FROM_DR_MESSAGE = ".M) from DR Node: ";
         try {
             fileid = fileid.substring(8);
-            int i = fileid.indexOf('/');
-            if (i == -1 || i == fileid.length() - 1) {
+            int index = fileid.indexOf('/');
+            if (index == -1 || index == fileid.length() - 1) {
                 eelfLogger.error("NODE0112 Rejecting bad URI for DELETE of " + req.getPathInfo() + FROM + req
-                        .getRemoteAddr());
+                    .getRemoteAddr());
                 resp.sendError(HttpServletResponse.SC_NOT_FOUND,
-                        "Invalid request URI. Expecting <subId>/<pubId>.");
+                    "Invalid request URI. Expecting <subId>/<pubId>.");
                 eelfLogger.info(EelfMsgs.EXIT);
                 return;
             }
-            String subscriptionId = fileid.substring(0, i);
+            String subscriptionId = fileid.substring(0, index);
             int subId = Integer.parseInt(subscriptionId);
-            pubid = fileid.substring(i + 1);
+            pubid = fileid.substring(index + 1);
             String errorMessage = "Unable to delete files (" + pubid + ", " + pubid + FROM_DR_MESSAGE
-                    + config.getMyName() + ".";
+                + config.getMyName() + ".";
             int subIdDir = subId - (subId % 100);
             if (!isAuthorizedToDelete(resp, subscriptionId, errorMessage)) {
                 return;
             }
             boolean result = delivery.markTaskSuccess(config.getSpoolBase() + "/s/" + subIdDir + "/" + subId, pubid);
             if (result) {
-                eelfLogger.info("NODE0115 Successfully deleted files (" + pubid + ", " + pubid + FROM_DR_MESSAGE
-                        + config.getMyName());
+                eelfLogger.debug("NODE0115 Successfully deleted files (" + pubid + ", " + pubid + FROM_DR_MESSAGE
+                    + config.getMyName());
                 resp.setStatus(HttpServletResponse.SC_OK);
                 eelfLogger.info(EelfMsgs.EXIT);
             } else {
@@ -528,7 +492,7 @@ public class NodeServlet extends HttpServlet {
             }
         } catch (IOException ioe) {
             eelfLogger.error("NODE0117 Unable to delete files (" + pubid + ", " + pubid + FROM_DR_MESSAGE
-                    + config.getMyName(), ioe);
+                + config.getMyName(), ioe);
             eelfLogger.info(EelfMsgs.EXIT);
         }
     }
@@ -539,10 +503,10 @@ public class NodeServlet extends HttpServlet {
             eelfLogger.info(EelfMsgs.EXIT);
             return null;
         }
-        if (!req.isSecure()) {
+        if (!req.isSecure() && config.isTlsEnabled()) {
             eelfLogger.error(
-                    "NODE0104 Rejecting insecure PUT or DELETE of " + req.getPathInfo() + FROM + req
-                            .getRemoteAddr());
+                "NODE0104 Rejecting insecure PUT or DELETE of " + req.getPathInfo() + FROM + req
+                    .getRemoteAddr());
             resp.sendError(HttpServletResponse.SC_FORBIDDEN, "https required on publish requests");
             eelfLogger.info(EelfMsgs.EXIT);
             return null;
@@ -550,9 +514,9 @@ public class NodeServlet extends HttpServlet {
         String fileid = req.getPathInfo();
         if (fileid == null) {
             eelfLogger.error("NODE0201 Rejecting bad URI for PUT or DELETE of " + req.getPathInfo() + FROM + req
-                    .getRemoteAddr());
+                .getRemoteAddr());
             resp.sendError(HttpServletResponse.SC_NOT_FOUND,
-                    INVALID_REQUEST_URI);
+                INVALID_REQUEST_URI);
             eelfLogger.info(EelfMsgs.EXIT);
             return null;
         }
@@ -560,19 +524,19 @@ public class NodeServlet extends HttpServlet {
     }
 
     private boolean isAuthorizedToDelete(HttpServletResponse resp, String subscriptionId, String errorMessage)
-            throws IOException {
+        throws IOException {
         try {
             boolean deletePermitted = config.isDeletePermitted(subscriptionId);
             if (!deletePermitted) {
                 eelfLogger.error("NODE0113 " + errorMessage + " Error: Subscription "
-                        + subscriptionId + " is not a privileged subscription");
+                    + subscriptionId + " is not a privileged subscription");
                 resp.sendError(HttpServletResponse.SC_UNAUTHORIZED);
                 eelfLogger.info(EelfMsgs.EXIT);
                 return false;
             }
         } catch (NullPointerException npe) {
-            eelfLogger.error("NODE0114 " + errorMessage + " Error: Subscription " + subscriptionId +
-                    " does not exist", npe);
+            eelfLogger.error("NODE0114 " + errorMessage + " Error: Subscription " + subscriptionId
+                + " does not exist", npe);
             resp.sendError(HttpServletResponse.SC_NOT_FOUND);
             eelfLogger.info(EelfMsgs.EXIT);
             return false;
@@ -591,4 +555,88 @@ public class NodeServlet extends HttpServlet {
             return -1;
         }
     }
+
+    /**
+     * Utility class that validates the path url formed from
+     * the string passed in the request parameters.
+     */
+    static class PathUtil {
+
+        private PathUtil() {
+            throw new IllegalStateException("Utility Class");
+        }
+
+        /**
+         * This method takes String as the parameter and return the filtered path string.
+         *
+         * @param string String to clean
+         * @return A cleaned String
+         */
+        static String cleanString(String string) {
+            if (string == null) {
+                return null;
+            }
+            StringBuilder cleanString = new StringBuilder();
+            for (int i = 0; i < string.length(); ++i) {
+                cleanString.append(cleanChar(string.charAt(i)));
+            }
+            return cleanString.toString();
+        }
+
+        /**
+         * This method filters the valid special characters in path string.
+         *
+         * @param character The char to be cleaned
+         * @return The cleaned char
+         */
+        private static char cleanChar(char character) {
+            // 0 - 9
+            for (int i = 48; i < 58; ++i) {
+                if (character == i) {
+                    return (char) i;
+                }
+            }
+            // 'A' - 'Z'
+            for (int i = 65; i < 91; ++i) {
+                if (character == i) {
+                    return (char) i;
+                }
+            }
+            // 'a' - 'z'
+            for (int i = 97; i < 123; ++i) {
+                if (character == i) {
+                    return (char) i;
+                }
+            }
+            return getValidCharacter(character);
+        }
+
+        private static char getValidCharacter(char character) {
+            // other valid characters
+            switch (character) {
+                case '/':
+                    return '/';
+                case '.':
+                    return '.';
+                case '-':
+                    return '-';
+                case ':':
+                    return ':';
+                case '?':
+                    return '?';
+                case '&':
+                    return '&';
+                case '=':
+                    return '=';
+                case '#':
+                    return '#';
+                case '_':
+                    return '_';
+                case ' ':
+                    return ' ';
+                default:
+                    return '%';
+            }
+        }
+    }
 }