Merge "Fix sql injection vulnerability"

[portal.git] / ecomp-portal-BE-common / src / main / java / org / onap / portalapp / util / EPUserUtils.java

diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/util/EPUserUtils.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/util/EPUserUtils.java
index 2292934..99a2911 100644 (file)
--- a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/util/EPUserUtils.java
+++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/util/EPUserUtils.java
@@ -33,7 +33,7 @@
  *
  * ============LICENSE_END============================================
  *
- * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ * 
  */
 package org.onap.portalapp.util;
 
@@ -45,7 +45,9 @@ import java.util.Iterator;
 import java.util.List;
 import java.util.Set;
 import java.util.UUID;
+import java.util.regex.Matcher;
 import java.util.regex.Pattern;
+import java.util.stream.Collectors;
 
 import javax.servlet.ServletContext;
 import javax.servlet.http.HttpServletRequest;
@@ -263,7 +265,7 @@ public class EPUserUtils {
                        }
                }
 
-               // Additionally; the account admin role is overloaded between ecomp
+               // Additionally; the account admin role is overloaded between onap
                // portal and partners; lets also include that
                Iterator<EPUserApp> appRolesIterator = user.getEPUserApps().iterator();
                while (appRolesIterator.hasNext()) {
@@ -398,4 +400,40 @@ public class EPUserUtils {
                return "";
        }
 
+       public static Boolean matchRoleFunctions(String portalApiPath, Set<? extends String> roleFunctions) {
+               String[] path = portalApiPath.split("/");
+               List<String> roleFunList = new ArrayList<>();
+               if (path.length > 1) {
+                       roleFunList = roleFunctions.stream().filter(item -> item.startsWith(path[0])).collect(Collectors.toList());
+                       if (roleFunList.size() >= 1) {
+                               for (String roleFunction : roleFunList) {
+                                       String[] roleFunctionArray = roleFunction.split("/");
+                                       boolean b = true;
+                                       if (roleFunctionArray.length == path.length) {
+                                               for (int i = 0; i < roleFunctionArray.length; i++) {
+                                                       if (b) {
+                                                               if (!roleFunctionArray[i].equals("*")) {
+                                                                       Pattern p = Pattern.compile(Pattern.quote(path[i]), Pattern.CASE_INSENSITIVE);
+                                                                       Matcher m = p.matcher(roleFunctionArray[i]);
+                                                                       b = m.matches();
+
+                                                               }
+                                                       }
+                                               }
+                                                       if (b)
+                                                               return b;
+                                       }
+                               }
+                       }
+               } else {
+                       for (String roleFunction : roleFunctions) {
+                               if (roleFunction.equals(("*"))) {
+                                       return true;
+                               } else if (portalApiPath.matches(roleFunction)) {
+                                       return true;
+                               }
+                       }
+               }
+               return false;
+       }
 }