X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=ONAP-PAP-REST%2Fsrc%2Fmain%2Fjava%2Forg%2Fonap%2Fpolicy%2Fpap%2Fxacml%2Frest%2Fcontroller%2FDictionaryImportController.java;h=9423017c31b0e604b01298692ecc2cfaa3a877d2;hb=b6d9063e06ab8cdf2d97fc75810792659344e4a8;hp=e2317e416b0cbb24d8a0a1bace2090f1f52a2db9;hpb=b13f494b5573118a07b434389fe8f73fc5986e4b;p=policy%2Fengine.git diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java index e2317e416..9423017c3 100644 --- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java +++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java @@ -19,10 +19,7 @@ */ package org.onap.policy.pap.xacml.rest.controller; - /* - * - * - * */ + import java.io.File; import java.io.FileOutputStream; import java.io.FileReader; @@ -36,6 +33,7 @@ import javax.servlet.http.HttpServletResponse; import org.apache.commons.compress.utils.IOUtils; import org.onap.policy.common.logging.flexlogger.FlexLogger; import org.onap.policy.common.logging.flexlogger.Logger; +import org.onap.policy.pap.xacml.rest.DictionaryNames; import org.onap.policy.rest.dao.CommonClassDao; import org.onap.policy.rest.jpa.ActionList; import org.onap.policy.rest.jpa.ActionPolicyDict; @@ -67,6 +65,7 @@ import org.onap.policy.rest.jpa.Zone; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; import com.fasterxml.jackson.databind.DeserializationFeature; import com.fasterxml.jackson.databind.ObjectMapper; @@ -78,21 +77,26 @@ import au.com.bytecode.opencsv.CSVReader; public class DictionaryImportController { private static final Logger LOGGER = FlexLogger.getLogger(DictionaryImportController.class); - private String newFile; - private static CommonClassDao commonClassDao; private static final String DESCRIPTION= "description"; + private static final String ERROR= "Error"; + private static final String DEPENDENCY= "dependency"; @Autowired public DictionaryImportController(CommonClassDao commonClassDao){ + setCommonClassDao(commonClassDao); + } + + public static void setCommonClassDao(CommonClassDao commonClassDao) { DictionaryImportController.commonClassDao = commonClassDao; } - public DictionaryImportController(){} - + public DictionaryImportController(){ + super(); + } - @RequestMapping(value={"/dictionary/import_dictionary"}, method={org.springframework.web.bind.annotation.RequestMethod.POST}) - public void ImportDictionaryData(HttpServletRequest request, HttpServletResponse response) throws IOException{ + @RequestMapping(value={"/dictionary/import_dictionary"}, method={RequestMethod.POST}) + public void importDictionaryData(HttpServletRequest request, HttpServletResponse response) throws IOException{ ObjectMapper mapper = new ObjectMapper(); mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false); String userId = request.getParameter("userId"); @@ -101,21 +105,23 @@ public class DictionaryImportController { if(dictionaryName == null || dictionaryName.isEmpty()){ LOGGER.error("dictionaryName is null/empty"); response.setStatus(HttpServletResponse.SC_BAD_REQUEST); - response.getWriter().write("Error"); + response.getWriter().write(ERROR); return; } - - boolean dictionaryImportExists = false; - try{ - File file = new File(dictionaryName); - OutputStream outputStream = new FileOutputStream(file); + + // fix Fortify Path Manipulation issue + if(!isValidDictionaryName(dictionaryName)){ + LOGGER.error("dictionaryName is invalid"); + response.setStatus(HttpServletResponse.SC_BAD_REQUEST); + response.getWriter().write(ERROR); + return; + } + File file = new File(dictionaryName); + try(OutputStream outputStream = new FileOutputStream(file); FileReader fileReader = new FileReader(file.toString())){ IOUtils.copy(request.getInputStream(), outputStream); - outputStream.close(); - this.newFile = file.toString(); - CSVReader csvReader = new CSVReader(new FileReader(this.newFile)); + CSVReader csvReader = new CSVReader(fileReader); List dictSheet = csvReader.readAll(); if(dictionaryName.startsWith("Attribute")){ - dictionaryImportExists = true; for(int i = 1; i< dictSheet.size(); i++){ Attribute attribute = new Attribute(""); UserInfo userinfo = new UserInfo(); @@ -124,26 +130,26 @@ public class DictionaryImportController { attribute.setUserModifiedBy(userinfo); String[] rows = dictSheet.get(i); for (int j=0 ; j