X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=ecomp-portal-BE-common%2Fsrc%2Ftest%2Fjava%2Forg%2Fonap%2Fportalapp%2Fportal%2Fcontroller%2FAuxApiRequestMapperControllerTest.java;h=8ef2d32a6afad9cc4483e5b10e56126657425fa3;hb=HEAD;hp=e7303313cb5fa99dc8db724ec1f59394d90999df;hpb=80ddb55b9f5569c6443104150cb74ba2ae4fcb08;p=portal.git

diff --git a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/AuxApiRequestMapperControllerTest.java b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/AuxApiRequestMapperControllerTest.java
index e7303313..8ef2d32a 100644
--- a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/AuxApiRequestMapperControllerTest.java
+++ b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/AuxApiRequestMapperControllerTest.java
@@ -45,10 +45,8 @@ import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -68,6 +66,7 @@ import org.onap.portalapp.portal.transport.Analytics;
 import org.onap.portalapp.portal.transport.EpNotificationItem;
 import org.onap.portalapp.portal.transport.OnboardingApp;
 import org.onap.portalsdk.core.domain.Role;
+import org.onap.portalsdk.core.onboarding.crossapi.PortalAPIResponse;
 import org.powermock.api.mockito.PowerMockito;
 import org.powermock.core.classloader.annotations.PrepareForTest;
 import org.powermock.modules.junit4.PowerMockRunner;
@@ -114,6 +113,21 @@ public class AuxApiRequestMapperControllerTest {
 		Mockito.when(mockedRequest.getMethod()).thenReturn("GET");
 		assertNull(auxApiRequestMapperController.getUser(mockedRequest, mockedResponse, "test12"));
 	}
+
+	@Test
+	public void getUserXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/roles");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", rolesController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("GET");
+		String expected = "Provided data is not valid";
+		String actual = auxApiRequestMapperController.getUser(mockedRequest, mockedResponse, "“><script>alert(“XSS”)</script>");
+		assertEquals(expected, actual);
+	}
 	
 	@Test
 	public void getUserTestWithException() throws Exception {
@@ -233,6 +247,7 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.getRoleFunction(mockedRequest, mockedResponse, "test"));
 	}
 
+
 	@Test
 	public void saveRoleFunctionTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/roleFunction");
@@ -247,6 +262,21 @@ public class AuxApiRequestMapperControllerTest {
 		assertNotNull(response);
 	}
 
+	@Test
+	public void saveRoleFunctionXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/roleFunction");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", rolesController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
+		PortalRestResponse<String> actual = auxApiRequestMapperController.saveRoleFunction(mockedRequest, mockedResponse, "<script>alert(123)</script>");
+		PortalRestResponse<String> expected = new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "Provided data is not valid", "Failed");
+		assertEquals(expected, actual);
+	}
+
 	@Test
 	public void deleteRoleFunctionTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/roleFunction/test");
@@ -260,6 +290,22 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.deleteRoleFunction(mockedRequest, mockedResponse, "test"));
 	}
 
+	@Test
+	public void deleteRoleFunctionXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/roleFunction/test");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", rolesController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("DELETE");
+		PortalRestResponse<String> actual = auxApiRequestMapperController.deleteRoleFunction(mockedRequest, mockedResponse,
+			"<svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera}");
+		PortalRestResponse<String> expected = new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "Provided data is not valid", "Failed");
+		assertEquals(expected, actual);
+	}
+
 	@Test
 	public void deleteRoleTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/deleteRole/1");
@@ -299,6 +345,19 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.getEcompUser(mockedRequest, mockedResponse, "test"));
 	}
 
+	@Test
+	public void getEcompUserXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v4/user/test");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", rolesController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("GET");
+		assertNull(auxApiRequestMapperController.getEcompUser(mockedRequest, mockedResponse, "<script>alert(‘XSS’)</script>"));
+	}
+
 	@Test
 	public void getEcompRolesOfApplicationTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v4/roles");
@@ -339,6 +398,20 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.extendSessionTimeOuts(mockedRequest, mockedResponse, sessionMap));
 	}
 
+	@Test
+	public void extendSessionTimeOutsXSSTest() throws Exception {
+		String sessionMap = "<script>alert(“XSS”)</script>";
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/extendSessionTimeOuts");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", sessionCommunicationController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
+		assertNull(auxApiRequestMapperController.extendSessionTimeOuts(mockedRequest, mockedResponse, sessionMap));
+	}
+
 	@Test
 	public void getAnalyticsScriptTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/analytics");
@@ -366,6 +439,23 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.storeAnalyticsScript(mockedRequest, mockedResponse, analyticsMap));
 	}
 
+	@Test
+	public void storeAnalyticsScriptXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/storeAnalytics");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", webAnalyticsExtAppController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
+		Analytics analyticsMap = new Analytics();
+		analyticsMap.setPage("<script>alert(“XSS”);</script>");
+		PortalAPIResponse actual = auxApiRequestMapperController.storeAnalyticsScript(mockedRequest, mockedResponse, analyticsMap);
+		PortalAPIResponse expected  = new PortalAPIResponse(true, "analyticsScript is not valid");
+		assertEquals(expected.getMessage(), actual.getMessage());
+	}
+
 	@Test
 	public void bulkUploadFunctionsTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/upload/portal/functions");
@@ -376,11 +466,11 @@ public class AuxApiRequestMapperControllerTest {
 		PowerMockito.mockStatic(AopUtils.class);
 		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
 		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
-		PortalRestResponse res = new PortalRestResponse();
-		res.setStatus(PortalRestStatusEnum.ERROR);
-		res.setMessage("Failed to bulkUploadFunctions");
-		res.setResponse("Failed");
-		assertEquals(res, auxApiRequestMapperController.bulkUploadFunctions(mockedRequest, mockedResponse));
+		PortalRestResponse expected = new PortalRestResponse();
+		expected.setStatus(PortalRestStatusEnum.ERROR);
+		expected.setMessage("Failed to bulkUploadFunctions");
+		expected.setResponse("Failed");
+		assertEquals(expected, auxApiRequestMapperController.bulkUploadFunctions(mockedRequest, mockedResponse));
 	}
 
 	@Test
@@ -393,11 +483,13 @@ public class AuxApiRequestMapperControllerTest {
 		PowerMockito.mockStatic(AopUtils.class);
 		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
 		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
-		PortalRestResponse res = new PortalRestResponse();
-		res.setStatus(PortalRestStatusEnum.ERROR);
-		res.setMessage("Failed to bulkUploadRoles");
-		res.setResponse("Failed");
-		assertEquals(res, auxApiRequestMapperController.bulkUploadRoles(mockedRequest, mockedResponse));
+		PortalRestResponse expected = new PortalRestResponse();
+		expected.setStatus(PortalRestStatusEnum.ERROR);
+		expected.setMessage("Failed to bulkUploadRoles");
+		expected.setResponse("Failed");
+		PortalRestResponse actual = auxApiRequestMapperController.bulkUploadRoles(mockedRequest, mockedResponse);
+		System.out.println(actual.toString());
+		assertEquals(expected, actual);
 	}
 
 	@Test
@@ -410,11 +502,11 @@ public class AuxApiRequestMapperControllerTest {
 		PowerMockito.mockStatic(AopUtils.class);
 		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
 		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
-		PortalRestResponse res = new PortalRestResponse();
-		res.setStatus(PortalRestStatusEnum.ERROR);
-		res.setMessage("Failed to bulkUploadRoleFunctions");
-		res.setResponse("Failed");
-		assertEquals(res, auxApiRequestMapperController.bulkUploadRoleFunctions(mockedRequest, mockedResponse));
+		PortalRestResponse expected = new PortalRestResponse();
+		expected.setStatus(PortalRestStatusEnum.ERROR);
+		expected.setMessage("Failed to bulkUploadRoleFunctions");
+		expected.setResponse("Failed");
+		assertEquals(expected, auxApiRequestMapperController.bulkUploadRoleFunctions(mockedRequest, mockedResponse));
 	}
 
 	@Test
@@ -427,11 +519,11 @@ public class AuxApiRequestMapperControllerTest {
 		PowerMockito.mockStatic(AopUtils.class);
 		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
 		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
-		PortalRestResponse res = new PortalRestResponse();
-		res.setStatus(PortalRestStatusEnum.ERROR);
-		res.setMessage("Failed to bulkUploadUserRoles");
-		res.setResponse("Failed");
-		assertEquals(res, auxApiRequestMapperController.bulkUploadUserRoles(mockedRequest, mockedResponse));
+		PortalRestResponse expected = new PortalRestResponse();
+		expected.setStatus(PortalRestStatusEnum.ERROR);
+		expected.setMessage("Failed to bulkUploadUserRoles");
+		expected.setResponse("Failed");
+		assertEquals(expected, auxApiRequestMapperController.bulkUploadUserRoles(mockedRequest, mockedResponse));
 	}
 
 	@Test
@@ -444,11 +536,11 @@ public class AuxApiRequestMapperControllerTest {
 		PowerMockito.mockStatic(AopUtils.class);
 		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
 		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
-		PortalRestResponse res = new PortalRestResponse();
-		res.setStatus(PortalRestStatusEnum.ERROR);
-		res.setMessage("Failed to bulkUploadUsersSingleRole");
-		res.setResponse("Failed");
-		assertEquals(res,
+		PortalRestResponse expected = new PortalRestResponse();
+		expected.setStatus(PortalRestStatusEnum.ERROR);
+		expected.setMessage("Failed to bulkUploadUsersSingleRole");
+		expected.setResponse("Failed");
+		assertEquals(expected,
 				auxApiRequestMapperController.bulkUploadUsersSingleRole(mockedRequest, mockedResponse, (long) 1));
 	}
 
@@ -462,11 +554,11 @@ public class AuxApiRequestMapperControllerTest {
 		PowerMockito.mockStatic(AopUtils.class);
 		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
 		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
-		PortalRestResponse res = new PortalRestResponse();
-		res.setStatus(PortalRestStatusEnum.ERROR);
-		res.setMessage("Failed to bulkUploadPartnerRoleFunctions");
-		res.setResponse("Failed");
-		assertEquals(res, auxApiRequestMapperController.bulkUploadPartnerFunctions(mockedRequest, mockedResponse));
+		PortalRestResponse expected = new PortalRestResponse();
+		expected.setStatus(PortalRestStatusEnum.ERROR);
+		expected.setMessage("Failed to bulkUploadPartnerRoleFunctions");
+		expected.setResponse("Failed");
+		assertEquals(expected, auxApiRequestMapperController.bulkUploadPartnerFunctions(mockedRequest, mockedResponse));
 	}
 
 	@Test
@@ -480,11 +572,11 @@ public class AuxApiRequestMapperControllerTest {
 		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
 		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
 		List<Role> upload = new ArrayList<>();
-		PortalRestResponse res = new PortalRestResponse();
-		res.setStatus(PortalRestStatusEnum.ERROR);
-		res.setMessage("Failed to bulkUploadRoles");
-		res.setResponse("Failed");
-		assertEquals(res, auxApiRequestMapperController.bulkUploadPartnerRoles(mockedRequest, mockedResponse, upload));
+		PortalRestResponse expected = new PortalRestResponse();
+		expected.setStatus(PortalRestStatusEnum.ERROR);
+		expected.setMessage("Failed to bulkUploadRoles");
+		expected.setResponse("Failed");
+		assertEquals(expected, auxApiRequestMapperController.bulkUploadPartnerRoles(mockedRequest, mockedResponse, upload));
 	}
 
 	@Test
@@ -497,11 +589,11 @@ public class AuxApiRequestMapperControllerTest {
 		PowerMockito.mockStatic(AopUtils.class);
 		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
 		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
-		PortalRestResponse res = new PortalRestResponse();
-		res.setStatus(PortalRestStatusEnum.ERROR);
-		res.setMessage("Failed to bulkUploadPartnerRoleFunctions");
-		res.setResponse("Failed");
-		assertEquals(res, auxApiRequestMapperController.bulkUploadPartnerRoleFunctions(mockedRequest, mockedResponse));
+		PortalRestResponse expected = new PortalRestResponse();
+		expected.setStatus(PortalRestStatusEnum.ERROR);
+		expected.setMessage("Failed to bulkUploadPartnerRoleFunctions");
+		expected.setResponse("Failed");
+		assertEquals(expected, auxApiRequestMapperController.bulkUploadPartnerRoleFunctions(mockedRequest, mockedResponse));
 	}
 
 	@Test
@@ -531,6 +623,23 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.postUserProfile(mockedRequest, extSysUser, mockedResponse));
 	}
 
+	@Test
+	public void postUserProfileXSSTest() {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/userProfile");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", rolesApprovalSystemController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
+		ExternalSystemUser extSysUser = new ExternalSystemUser();
+		extSysUser.setLoginId("<script>alert(“XSS”);</script>");
+		PortalRestResponse<String> actual = auxApiRequestMapperController.postUserProfile(mockedRequest, extSysUser, mockedResponse);
+		PortalRestResponse<String> expected = new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "ExternalSystemUser is not valid", "Failed");
+		assertEquals(expected, actual);
+	}
+
 	@Test
 	public void putUserProfileTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/userProfile");
@@ -545,6 +654,23 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.putUserProfile(mockedRequest, extSysUser, mockedResponse));
 	}
 
+	@Test
+	public void putUserProfileXSSTest() {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/userProfile");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", rolesApprovalSystemController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
+		ExternalSystemUser extSysUser = new ExternalSystemUser();
+		extSysUser.setLoginId("<script>alert(“XSS”);</script>");
+		PortalRestResponse<String> actual = auxApiRequestMapperController.putUserProfile(mockedRequest, extSysUser, mockedResponse);
+		PortalRestResponse<String> expected = new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "ExternalSystemUser is not valid", "Failed");
+		assertEquals(expected, actual);
+	}
+
 	@Test
 	public void deleteUserProfileTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/userProfile");
@@ -559,6 +685,23 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.deleteUserProfile(mockedRequest, extSysUser, mockedResponse));
 	}
 
+	@Test
+	public void deleteUserProfileXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/userProfile");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", rolesApprovalSystemController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("DELETE");
+		ExternalSystemUser extSysUser = new ExternalSystemUser();
+		extSysUser.setLoginId("<script>alert(“XSS”);</script>");
+		PortalRestResponse<String> actual = auxApiRequestMapperController.deleteUserProfile(mockedRequest, extSysUser, mockedResponse);
+		PortalRestResponse<String> expected = new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "ExternalSystemUser is not valid", "Failed");
+		assertEquals(expected, actual);
+	}
+
 	@Test
 	public void handleRequestTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/ticketevent");
@@ -572,6 +715,21 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.handleRequest(mockedRequest, mockedResponse, "test"));
 	}
 
+	@Test
+	public void handleRequestXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/ticketevent");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", ticketEventVersionController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
+		PortalRestResponse<String> actual = auxApiRequestMapperController.handleRequest(mockedRequest, mockedResponse, "<script>alert(“XSS”);</script>");
+		PortalRestResponse<String> expected =  new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "ticketEventJson is not valid", "Failed");
+		assertEquals(expected, actual);
+	}
+
 	@Test
 	public void postPortalAdminTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/portalAdmin");
@@ -586,6 +744,23 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.postPortalAdmin(mockedRequest, mockedResponse, epUser));
 	}
 
+	@Test
+	public void postPortalAdminXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/portalAdmin");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", appsControllerExternalVersionRequest);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
+		EPUser epUser = new EPUser();
+		epUser.setLoginId("<script>alert(/XSS”)</script>");
+		PortalRestResponse<String> actual = auxApiRequestMapperController.postPortalAdmin(mockedRequest, mockedResponse, epUser);
+		PortalRestResponse<String> expected = new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "EPUser is not valid", "Failed");
+		assertEquals(expected, actual);
+	}
+
 	@Test
 	public void getOnboardAppExternalTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/onboardApp/1");
@@ -613,6 +788,23 @@ public class AuxApiRequestMapperControllerTest {
 		assertNull(auxApiRequestMapperController.postOnboardAppExternal(mockedRequest, mockedResponse, newOnboardApp));
 	}
 
+	@Test
+	public void postOnboardAppExternalXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/onboardApp");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", appsControllerExternalVersionRequest);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
+		OnboardingApp newOnboardApp = new OnboardingApp();
+		newOnboardApp.setUebKey("&#00;</form><input type&#61;\"date\" onfocus=\"alert(1)\">");
+		PortalRestResponse<String> actual = auxApiRequestMapperController.postOnboardAppExternal(mockedRequest, mockedResponse, newOnboardApp);
+		PortalRestResponse<String> expected = new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "OnboardingApp is not valid", "Failed");
+		assertEquals(expected, actual);
+	}
+
 	@Test
 	public void putOnboardAppExternalTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/onboardApp/1");
@@ -628,6 +820,24 @@ public class AuxApiRequestMapperControllerTest {
 				newOnboardApp));
 	}
 
+	@Test
+	public void putOnboardAppExternalXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/onboardApp/1");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", appsControllerExternalVersionRequest);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("PUT");
+		OnboardingApp newOnboardApp = new OnboardingApp();
+		newOnboardApp.setUebTopicName("&#13;<blink/&#13; onmouseover=pr&#x6F;mp&#116;(1)>OnMouseOver {Firefox & Opera}");
+		PortalRestResponse<String> actual = auxApiRequestMapperController.putOnboardAppExternal(mockedRequest, mockedResponse, (long) 1,
+			newOnboardApp);
+		PortalRestResponse<String> expected = new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "OnboardingApp is not valid", "Failed");
+		assertEquals(expected, actual);
+	}
+
 	@Test
 	public void publishNotificationTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/publishNotification");
@@ -642,6 +852,24 @@ public class AuxApiRequestMapperControllerTest {
 		assertNotNull(auxApiRequestMapperController.publishNotification(mockedRequest, notificationItem, mockedResponse));
 	}
 
+	@Test
+	public void publishNotificationXSSTest() throws Exception {
+		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/publishNotification");
+		Mockito.when(mockedRequest.getHeader("MinorVersion")).thenReturn("0");
+		Map<String, Object> beans = new HashMap<>();
+		beans.put("bean1", externalAppsRestfulVersionController);
+		Mockito.when(context.getBeansWithAnnotation(ApiVersion.class)).thenReturn(beans);
+		PowerMockito.mockStatic(AopUtils.class);
+		Mockito.when(AopUtils.isAopProxy(Matchers.anyObject())).thenReturn(false);
+		Mockito.when(mockedRequest.getMethod()).thenReturn("POST");
+		EpNotificationItem notificationItem = new EpNotificationItem();
+		notificationItem.setIsForAllRoles("</svg>''<svg><script 'AQuickBrownFoxJumpsOverTheLazyDog'>alert&#x28;1&#x29; {Opera}");
+		PortalAPIResponse actual = auxApiRequestMapperController.publishNotification(mockedRequest, notificationItem, mockedResponse);
+		PortalAPIResponse expected = new PortalAPIResponse(false, "EpNotificationItem is not valid");
+		assertEquals(expected.getMessage(), actual.getMessage());
+		assertEquals(expected.getStatus(), actual.getStatus());
+	}
+
 	@Test
 	public void getFavoritesForUserTest() throws Exception {
 		Mockito.when(mockedRequest.getRequestURI()).thenReturn("/auxapi/v3/getFavorites");