XSS Vulnerability fix in AppsController

[portal.git] / ecomp-portal-BE-os / src / main / java / org / onap / portalapp / portal / controller / AppsOSController.java

diff --git a/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/portal/controller/AppsOSController.java b/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/portal/controller/AppsOSController.java
index ed54055..e109ef5 100644 (file)
--- a/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/portal/controller/AppsOSController.java
+++ b/ecomp-portal-BE-os/src/main/java/org/onap/portalapp/portal/controller/AppsOSController.java
@@ -40,10 +40,15 @@ package org.onap.portalapp.portal.controller;
 import java.util.HashMap;
 import java.util.Map;
 
+import java.util.Set;
 import javax.servlet.http.HttpServletRequest;
 
+import javax.validation.ConstraintViolation;
+import javax.validation.Validation;
+import javax.validation.Validator;
+import javax.validation.ValidatorFactory;
+import lombok.NoArgsConstructor;
 import org.json.JSONObject;
-import org.onap.portalapp.portal.controller.AppsController;
 import org.onap.portalapp.portal.domain.EPUser;
 import org.onap.portalapp.portal.ecomp.model.PortalRestResponse;
 import org.onap.portalapp.portal.ecomp.model.PortalRestStatusEnum;
@@ -53,8 +58,10 @@ import org.onap.portalapp.portal.service.EPAppService;
 import org.onap.portalapp.portal.service.PersUserAppService;
 import org.onap.portalapp.portal.service.UserService;
 import org.onap.portalapp.util.EPUserUtils;
+import org.onap.portalapp.validation.SecureString;
 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.EnableAspectJAutoProxy;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -63,26 +70,20 @@ import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RestController;
 
 @RestController
-@org.springframework.context.annotation.Configuration
+@Configuration
 @EnableAspectJAutoProxy
 @EPAuditLog
+@NoArgsConstructor
 public class AppsOSController extends AppsController {
+       private static final ValidatorFactory validatorFactory = Validation.buildDefaultValidatorFactory();
        
-       static final String FAILURE = "failure";
-       EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(AppsOSController.class);
+       private static final String FAILURE = "failure";
+       private static final EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(AppsOSController.class);
 
-       @Autowired
-       AdminRolesService adminRolesService;
-       @Autowired
-       EPAppService appService;
-       @Autowired
-       PersUserAppService persUserAppService;
        @Autowired
        UserService userService;
 
-       
-       
-       /**
+       /**
         * Create new application's contact us details.
         * 
         * @param contactUs
@@ -95,9 +96,9 @@ public class AppsOSController extends AppsController {
                        return new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, FAILURE,
                                        "New User cannot be null or empty");
                
-               if (!(adminRolesService.isSuperAdmin(user) || adminRolesService.isAccountAdmin(user))){
+               if (!(super.getAdminRolesService().isSuperAdmin(user) || super.getAdminRolesService().isAccountAdmin(user))){
                        if(!user.getLoginId().equalsIgnoreCase(newUser.getLoginId()))
-                               return new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, FAILURE,
+                               return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, FAILURE,
                                                "UnAuthorized");
                }
                        
@@ -106,16 +107,27 @@ public class AppsOSController extends AppsController {
                try {
                        saveNewUser = userService.saveNewUser(newUser,checkDuplicate);
                } catch (Exception e) {
-                       return new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, saveNewUser, e.getMessage());
+                       return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, saveNewUser, e.getMessage());
                }
-               return new PortalRestResponse<String>(PortalRestStatusEnum.OK, saveNewUser, "");
+               return new PortalRestResponse<>(PortalRestStatusEnum.OK, saveNewUser, "");
        }
        
        @RequestMapping(value = { "/portalApi/currentUserProfile/{loginId}" }, method = RequestMethod.GET, produces = "application/json")
        public String getCurrentUserProfile(HttpServletRequest request, @PathVariable("loginId") String loginId) {
+
+               if(loginId != null){
+                       Validator validator = validatorFactory.getValidator();
+                       SecureString secureString = new SecureString(loginId);
+                       Set<ConstraintViolation<SecureString>> constraintViolations = validator.validate(secureString);
+
+                       if (!constraintViolations.isEmpty()){
+                               return "loginId is not valid";
+                       }
+               }
+
                
-               Map<String,String> map = new HashMap<String,String>();
-               EPUser user = null;
+               Map<String,String> map = new HashMap<>();
+               EPUser user;
                try {
                         user = (EPUser) userService.getUserByUserId(loginId).get(0);
                         map.put("firstName", user.getFirstName());
@@ -128,7 +140,7 @@ public class AppsOSController extends AppsController {
                        logger.error(EELFLoggerDelegate.errorLogger, "Failed to get user info", e);
                }
 
-               JSONObject j = new JSONObject(map);;
+               JSONObject j = new JSONObject(map);
                return j.toString();
        }