X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=ONAP-PAP-REST%2Fsrc%2Fmain%2Fjava%2Forg%2Fonap%2Fpolicy%2Fpap%2Fxacml%2Frest%2Fcontroller%2FDictionaryImportController.java;h=f3c78ffb9b8817b0d7389bd86b0a2c3a75a1530d;hb=9ffce7748d288fde9e55d92367a858020e5a32fc;hp=e2317e416b0cbb24d8a0a1bace2090f1f52a2db9;hpb=b13f494b5573118a07b434389fe8f73fc5986e4b;p=policy%2Fengine.git diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java index e2317e416..f3c78ffb9 100644 --- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java +++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryImportController.java @@ -19,10 +19,7 @@ */ package org.onap.policy.pap.xacml.rest.controller; - /* - * - * - * */ + import java.io.File; import java.io.FileOutputStream; import java.io.FileReader; @@ -36,6 +33,7 @@ import javax.servlet.http.HttpServletResponse; import org.apache.commons.compress.utils.IOUtils; import org.onap.policy.common.logging.flexlogger.FlexLogger; import org.onap.policy.common.logging.flexlogger.Logger; +import org.onap.policy.pap.xacml.rest.DictionaryNames; import org.onap.policy.rest.dao.CommonClassDao; import org.onap.policy.rest.jpa.ActionList; import org.onap.policy.rest.jpa.ActionPolicyDict; @@ -67,6 +65,7 @@ import org.onap.policy.rest.jpa.Zone; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; import com.fasterxml.jackson.databind.DeserializationFeature; import com.fasterxml.jackson.databind.ObjectMapper; @@ -78,8 +77,6 @@ import au.com.bytecode.opencsv.CSVReader; public class DictionaryImportController { private static final Logger LOGGER = FlexLogger.getLogger(DictionaryImportController.class); - private String newFile; - private static CommonClassDao commonClassDao; private static final String DESCRIPTION= "description"; @@ -88,11 +85,13 @@ public class DictionaryImportController { DictionaryImportController.commonClassDao = commonClassDao; } - public DictionaryImportController(){} + public DictionaryImportController(){ + super(); + } - @RequestMapping(value={"/dictionary/import_dictionary"}, method={org.springframework.web.bind.annotation.RequestMethod.POST}) - public void ImportDictionaryData(HttpServletRequest request, HttpServletResponse response) throws IOException{ + @RequestMapping(value={"/dictionary/import_dictionary"}, method={RequestMethod.POST}) + public void importDictionaryData(HttpServletRequest request, HttpServletResponse response) throws IOException{ ObjectMapper mapper = new ObjectMapper(); mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false); String userId = request.getParameter("userId"); @@ -104,18 +103,20 @@ public class DictionaryImportController { response.getWriter().write("Error"); return; } - - boolean dictionaryImportExists = false; - try{ - File file = new File(dictionaryName); - OutputStream outputStream = new FileOutputStream(file); + + // fix Fortify Path Manipulation issue + if(!isValidDictionaryName(dictionaryName)){ + LOGGER.error("dictionaryName is invalid"); + response.setStatus(HttpServletResponse.SC_OK); + response.getWriter().write("Dictionary Import failed. Hence the following dictionary doen't support import function : "+ dictionaryName); + return; + } + File file = new File(dictionaryName); + try(OutputStream outputStream = new FileOutputStream(file); FileReader fileReader = new FileReader(file.toString())){ IOUtils.copy(request.getInputStream(), outputStream); - outputStream.close(); - this.newFile = file.toString(); - CSVReader csvReader = new CSVReader(new FileReader(this.newFile)); + CSVReader csvReader = new CSVReader(fileReader); List dictSheet = csvReader.readAll(); if(dictionaryName.startsWith("Attribute")){ - dictionaryImportExists = true; for(int i = 1; i< dictSheet.size(); i++){ Attribute attribute = new Attribute(""); UserInfo userinfo = new UserInfo(); @@ -124,26 +125,26 @@ public class DictionaryImportController { attribute.setUserModifiedBy(userinfo); String[] rows = dictSheet.get(i); for (int j=0 ; j