Changed code to not construct the path from user-controlled data.

Issue-ID: VNFSDK-834

Signed-off-by: sharath reddy <bs.reddy@huawei.com>
Change-Id: If9eb5ee546436ed9c4495bac8706883ee1ca98ce
Signed-off-by: sharath reddy <bs.reddy@huawei.com>

diff --git a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vtp/scenario/VTPScenarioResource.java b/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vtp/scenario/VTPScenarioResource.java
index 915cd14..1a8de34 100644 (file)
--- a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vtp/scenario/VTPScenarioResource.java
+++ b/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vtp/scenario/VTPScenarioResource.java
@@ -431,8 +431,12 @@ public class VTPScenarioResource extends VTPResource{
         }
 
         try {
-            FileUtils.deleteQuietly(new File(VTP_YAML_STORE, scenarioName));
-            FileUtils.deleteDirectory(scenarioDir);
+            if(FileUtils.directoryContains(new File(VTP_YAML_STORE), new File(scenarioName))) {
+                FileUtils.deleteQuietly(new File(VTP_YAML_STORE, scenarioName));
+            }
+            if(FileUtils.directoryContains(new File(VTP_YAML_STORE), scenarioDir)) {
+                FileUtils.deleteDirectory(scenarioDir);
+            }
         } catch (IOException e) {
             LOG.error("Delete scenario yaml {} failed", scenarioName, e);
             throw new VTPException(

diff --git a/vnfmarket-be/vnf-sdk-marketplace/src/test/java/org/onap/vtp/VTPScenarioResourceTest.java b/vnfmarket-be/vnf-sdk-marketplace/src/test/java/org/onap/vtp/VTPScenarioResourceTest.java
index 5545779..b743615 100644 (file)
--- a/vnfmarket-be/vnf-sdk-marketplace/src/test/java/org/onap/vtp/VTPScenarioResourceTest.java
+++ b/vnfmarket-be/vnf-sdk-marketplace/src/test/java/org/onap/vtp/VTPScenarioResourceTest.java
@@ -108,9 +108,11 @@ public class VTPScenarioResourceTest {
     @Test
     public void testDeleteScenario() throws Exception
     {
+        String yamlStore = vtpScenarioResource.VTP_YAML_STORE;
+        vtpScenarioResource.VTP_YAML_STORE = "/tmp";
         vtpScenarioResource.deleteScenario("demo-registry.yaml");
+        vtpScenarioResource.VTP_YAML_STORE = yamlStore;
     }
-
     @Test(expected = NullPointerException.class)
     public void testStorageTestcases() throws Exception
     {