Fix the security issue

[clamp.git] / src / main / java / org / onap / clamp / clds / service / CldsTemplateService.java

diff --git a/src/main/java/org/onap/clamp/clds/service/CldsTemplateService.java b/src/main/java/org/onap/clamp/clds/service/CldsTemplateService.java
index d82e7c6..183db8b 100644 (file)
--- a/src/main/java/org/onap/clamp/clds/service/CldsTemplateService.java
+++ b/src/main/java/org/onap/clamp/clds/service/CldsTemplateService.java
@@ -5,6 +5,8 @@
  * Copyright (C) 2017-2018 AT&T Intellectual Property. All rights
  *                             reserved.
  * ================================================================================
+ * Modifications Copyright (c) 2019 Samsung
+ * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
@@ -33,8 +35,6 @@ import org.onap.clamp.clds.dao.CldsDao;
 import org.onap.clamp.clds.model.CldsTemplate;
 import org.onap.clamp.clds.model.ValueItem;
 import org.onap.clamp.clds.util.LoggingUtils;
-import org.onap.clamp.clds.util.ONAPLogConstants;
-import org.slf4j.event.Level;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
@@ -52,14 +52,14 @@ public class CldsTemplateService extends SecureServiceBase {
     private SecureServicePermission permissionReadTemplate;
     private SecureServicePermission permissionUpdateTemplate;
     @Autowired
-       private HttpServletRequest request;
+    private HttpServletRequest request;
 
     @PostConstruct
     private final void afterConstruction() {
-        permissionReadTemplate = SecureServicePermission.create(cldsPermissionTypeTemplate, cldsPermissionInstance,
-            "read");
-        permissionUpdateTemplate = SecureServicePermission.create(cldsPermissionTypeTemplate, cldsPermissionInstance,
-            "update");
+        permissionReadTemplate = SecureServicePermission.create(cldsPermissionTypeTemplate,
+            cldsPermissionInstance, "read");
+        permissionUpdateTemplate = SecureServicePermission.create(cldsPermissionTypeTemplate,
+            cldsPermissionInstance, "update");
     }
 
     @Autowired
@@ -71,19 +71,17 @@ public class CldsTemplateService extends SecureServiceBase {
      * database. This is subset of the json getModel. This is only expected to
      * be used for testing purposes, not by the UI.
      *
-     * @param templateName
+     * @param templateName template name
      * @return bpmn xml text - content of bpmn given name
      */
     public String getBpmnTemplate(String templateName) {
-       util.entering(request, "CldsTemplateService: GET template bpmn");
-        Date startTime = new Date();
+        util.entering(request, "CldsTemplateService: GET template bpmn");
+        final Date startTime = new Date();
         isAuthorized(permissionReadTemplate);
         logger.info("GET bpmnText for templateName=" + templateName);
+
         CldsTemplate template = CldsTemplate.retrieve(cldsDao, templateName, false);
-        // audit log
-        LoggingUtils.setTimeContext(startTime, new Date());
-        auditLogger.info("GET template bpmn completed");
-        util.exiting("200", "Get template bpmn success", Level.INFO, ONAPLogConstants.ResponseStatus.COMPLETED);
+        auditLogInfo(util, "GET template bpmn", startTime);
         return template.getBpmnText();
     }
 
@@ -92,52 +90,48 @@ public class CldsTemplateService extends SecureServiceBase {
      * database. This is subset of the json getModel. This is only expected to
      * be used for testing purposes, not by the UI.
      *
-     * @param templateName
+     * @param templateName template name
      * @return image xml text - content of image given name
      */
     public String getImageXml(String templateName) {
-       util.entering(request, "CldsTemplateService: GET template image");
-        Date startTime = new Date();
+        util.entering(request, "CldsTemplateService: GET template image");
+        final Date startTime = new Date();
         isAuthorized(permissionReadTemplate);
         logger.info("GET imageText for templateName=" + templateName);
+
         CldsTemplate template = CldsTemplate.retrieve(cldsDao, templateName, false);
-        // audit log
-        LoggingUtils.setTimeContext(startTime, new Date());
-        auditLogger.info("GET template image completed");
-        util.exiting("200", "Get template image success", Level.INFO, ONAPLogConstants.ResponseStatus.COMPLETED);
+        auditLogInfo(util, "GET template image", startTime);
         return template.getImageText();
     }
 
     /**
      * REST service that retrieves a CLDS template by name from the database.
      *
-     * @param templateName
+     * @param templateName template name
      * @return clds template - clds template for the given template name
      */
     public CldsTemplate getTemplate(String templateName) {
-       util.entering(request, "CldsTemplateService: GET template");
-        Date startTime = new Date();
+        util.entering(request, "CldsTemplateService: GET template");
+        final Date startTime = new Date();
         isAuthorized(permissionReadTemplate);
         logger.info("GET model for  templateName=" + templateName);
+
         CldsTemplate template = CldsTemplate.retrieve(cldsDao, templateName, false);
         template.setUserAuthorizedToUpdate(isAuthorizedNoException(permissionUpdateTemplate));
-        // audit log
-        LoggingUtils.setTimeContext(startTime, new Date());
-        auditLogger.info("GET template completed");
-        util.exiting("200", "Get template success", Level.INFO, ONAPLogConstants.ResponseStatus.COMPLETED);
+        auditLogInfo(util, "GET template", startTime);
         return template;
     }
 
     /**
      * REST service that saves a CLDS template by name in the database.
      *
-     * @param templateName
-     * @param cldsTemplate
+     * @param templateName template name
+     * @param cldsTemplate clds template
      * @return The CldsTemplate modified and saved in DB
      */
     public CldsTemplate putTemplate(String templateName, CldsTemplate cldsTemplate) {
-       util.entering(request, "CldsTemplateService: PUT template");
-        Date startTime = new Date();
+        util.entering(request, "CldsTemplateService: PUT template");
+        final Date startTime = new Date();
         isAuthorized(permissionUpdateTemplate);
         logger.info("PUT Template for  templateName=" + templateName);
         logger.info("PUT bpmnText=" + cldsTemplate.getBpmnText());
@@ -145,10 +139,7 @@ public class CldsTemplateService extends SecureServiceBase {
         logger.info("PUT imageText=" + cldsTemplate.getImageText());
         cldsTemplate.setName(templateName);
         cldsTemplate.save(cldsDao, null);
-        // audit log
-        LoggingUtils.setTimeContext(startTime, new Date());
-        auditLogger.info("PUT template completed");
-        util.exiting("200", "Put template success", Level.INFO, ONAPLogConstants.ResponseStatus.COMPLETED);
+        auditLogInfo(util, "PUT template", startTime);
         return cldsTemplate;
     }
 
@@ -158,20 +149,18 @@ public class CldsTemplateService extends SecureServiceBase {
      * @return template names in JSON
      */
     public List<ValueItem> getTemplateNames() {
-       util.entering(request, "CldsTemplateService: GET template names");
-        Date startTime = new Date();
+        util.entering(request, "CldsTemplateService: GET template names");
+        final Date startTime = new Date();
         isAuthorized(permissionReadTemplate);
         logger.info("GET list of template names");
+
         List<ValueItem> names = cldsDao.getTemplateNames();
-        // audit log
-        LoggingUtils.setTimeContext(startTime, new Date());
-        auditLogger.info("GET template names completed");
-        util.exiting("200", "Get template names success", Level.INFO, ONAPLogConstants.ResponseStatus.COMPLETED);
+        auditLogInfo(util, "GET template names", startTime);
         return names;
     }
 
     // Created for the integration test
-    public void setLoggingUtil (LoggingUtils utilP) {
-        util =  utilP;
+    public void setLoggingUtil(LoggingUtils utilP) {
+        util = utilP;
     }
 }