Merge "Changes done to improve error log percentage"

[portal.git] / ecomp-portal-BE-os / src / main / java / org / onap / portalapp / filter / SecurityXssValidator.java

diff --git a/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/filter/SecurityXssValidator.java b/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/filter/SecurityXssValidator.java
index c203f1f..cc4ba85 100644 (file)
--- a/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/filter/SecurityXssValidator.java
+++ b/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/filter/SecurityXssValidator.java
@@ -51,8 +51,8 @@ import org.onap.portalsdk.core.util.SystemProperties;
 import org.owasp.esapi.ESAPI;
 import org.owasp.esapi.codecs.Codec;
 import org.owasp.esapi.codecs.MySQLCodec;
-import org.owasp.esapi.codecs.MySQLCodec.Mode;
 import org.owasp.esapi.codecs.OracleCodec;
+import org.owasp.esapi.codecs.MySQLCodec.Mode;
 
 public class SecurityXssValidator {
 
@@ -155,18 +155,26 @@ public class SecurityXssValidator {
                Boolean flag = Boolean.FALSE;
                try {
                        if (StringUtils.isNotBlank(value)) {
+                               if (value.contains("&timeseclgn"))
+                               {
+                                       logger.info(EELFLoggerDelegate.applicationLogger, "denyXSS() replacing &timeseclgn with empty string for request value : " + value);
+                                       value=value.replaceAll("&timeseclgn", "");
+                               }
+                               while(value.contains("%25")) {
+                                       value = value.replaceAll("%25", "%");
+                               }
                                value = ESAPI.encoder().canonicalize(value);
                                for (Pattern xssInputPattern : XSS_INPUT_PATTERNS) {
                                        if (xssInputPattern.matcher(value).matches()) {
                                                flag = Boolean.TRUE;
                                                break;
                                        }
-
                                }
                        }
 
                } catch (Exception e) {
-                       logger.error(EELFLoggerDelegate.errorLogger, "denyXSS() failed", e);
+                       logger.error(EELFLoggerDelegate.errorLogger, "denyXSS() failed for request with value : " + e.getMessage());
+                       logger.debug(EELFLoggerDelegate.debugLogger, "denyXSS() failed for request with value : " + value, e);
                }
 
                return flag;