Repair security filters 61/20561/1
authorChristopher Lott (cl778h) <clott@research.att.com>
Wed, 25 Oct 2017 13:55:06 +0000 (09:55 -0400)
committerChristopher Lott (cl778h) <clott@research.att.com>
Wed, 25 Oct 2017 13:55:52 +0000 (09:55 -0400)
Revise app web.xml to remove typo in Java package name.
Also drop unneeded test class.

Issue: PORTAL-135
Change-Id: I49662928c5eed38520e9a9c5f839385148aef0fa
Signed-off-by: Christopher Lott (cl778h) <clott@research.att.com>
ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/controller/ActionHandler.java
ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/ReportHandler.java
ecomp-sdk/epsdk-analytics/src/main/java/org/onap/portalsdk/analytics/model/runtime/ChartD3Helper.java
ecomp-sdk/epsdk-app-os/src/main/webapp/WEB-INF/web.xml
ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/EncDecUtilTest.java [deleted file]
ecomp-sdk/pom.xml

index 36c9d52..ba45589 100644 (file)
@@ -1949,12 +1949,12 @@ public class ActionHandler extends org.onap.portalsdk.analytics.RaptorObject {
         logger.debug(EELFLoggerDelegate.debugLogger, ("Command Executed "));
         //Connection connection = DbUtils.getConnection();
         Enumeration enum1 = rr.getParamKeys();
-        String value = "", key = "";
+        String value = "";
         String paramStr = "";
         StringBuffer paramBuffer = new StringBuffer();
         if(enum1!=null) {
             for (; enum1.hasMoreElements();) {
-                 key = (String) enum1.nextElement();
+               String key = (String) enum1.nextElement();
                  value = rr.getParamValue(key);
                  paramBuffer.append(key+":"+value+" ");
             }
index b4c6faa..0afd354 100644 (file)
@@ -167,6 +167,7 @@ import org.onap.portalsdk.analytics.xmlobj.Reports;
 import org.onap.portalsdk.analytics.xmlobj.SemaphoreList;
 import org.onap.portalsdk.analytics.xmlobj.SemaphoreType;
 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
+import org.owasp.esapi.ESAPI;
 
 import com.lowagie.text.Document;
 import com.lowagie.text.Paragraph;
@@ -3712,7 +3713,7 @@ public class ReportHandler extends org.onap.portalsdk.analytics.RaptorObject {
                                //strBuf.append("Run-time Parameters\n");
                        }
                                csvOut.print("\"" + value.getId() +":" + "\",");
-                               valueName = nvl(value.getName());
+                               valueName = ESAPI.encoder().canonicalize(nvl(value.getName()));
                                if(valueName.indexOf("~")!= -1 && valueName.startsWith("(")) {
                                        csvOut.print("\"'" + valueName.replaceAll("~",",")+ "'\",");
                                } else {
index 1a8da8d..f5c641a 100644 (file)
@@ -61,6 +61,7 @@ import java.util.regex.Pattern;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 
+import org.apache.commons.lang.StringUtils;
 import org.apache.commons.lang.time.DateUtils;
 import org.onap.portalsdk.analytics.error.RaptorException;
 import org.onap.portalsdk.analytics.model.ReportHandler;
@@ -1932,29 +1933,28 @@ public class ChartD3Helper {
                                        wholeScript.append("<script> \n");
 
                                        wholeScript.append("historicalBarChart = [ \n");
-                                        double TOTAL = 0;
-                                        double VALUE = 0;
+                                        double total = 0;
+                                        double value = 0;
                                         int flagNull = 0;
-                                        String KEY = "";
                                         String COLOR = "";
                                         TreeSet<String> colorList = new TreeSet<String>();
                                         for (int i = 0; i < ds.getRowCount(); i++) {
-                                                VALUE = 0;
+                                                value = 0;
                                                 try {
-                                                 VALUE = Double.parseDouble(ds.getString(i, 2));
-                                                 TOTAL = TOTAL+VALUE;
+                                                        value = Double.parseDouble(ds.getString(i, 2));
+                                                 total = total+value;
                                                 } catch (NumberFormatException ex) {
                                                         flagNull = 1;
                                                 }
-                                                KEY = ds.getString(i, 0);
+                                                String key = ds.getString(i, 0);
                                                 try {
                                                         if(ds.getString(i, "chart_color")!=null) {
-                                                                colorList.add(KEY+"|"+ds.getString(i,  "chart_color"));                                         
+                                                                colorList.add(key+"|"+ds.getString(i,  "chart_color"));                                         
                                                         }
                                                 } catch (ArrayIndexOutOfBoundsException ex) {
                                                         //System.out.println("No Chart Color");
                                                 }
-                                                wholeScript.append("{ \""+ "key" +"\":\""+ KEY+"\", \""+ "y" +"\":"+VALUE+"}, \n");
+                                                wholeScript.append("{ \""+ "key" +"\":\""+ key+"\", \""+ "y" +"\":"+value+"}, \n");
                                                 
                                         }
                                         StringBuffer color = new StringBuffer("");
index 7441508..f5039df 100644 (file)
@@ -15,7 +15,7 @@
        </session-config>
        <filter>
     <filter-name>SecurityXssFilter</filter-name>
-    <filter-class>org.onap.portalapp.filtersss.SecurityXssFilter</filter-class>
+    <filter-class>org.onap.portalapp.filter.SecurityXssFilter</filter-class>
    </filter> 
     <filter-mapping>
     <filter-name>SecurityXssFilter</filter-name>
diff --git a/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/EncDecUtilTest.java b/ecomp-sdk/epsdk-core/src/main/java/org/onap/portalsdk/core/util/EncDecUtilTest.java
deleted file mode 100644 (file)
index 926ed34..0000000
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * ============LICENSE_START==========================================
- * ONAP Portal SDK
- * ===================================================================
- * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
- * ===================================================================
- *
- * Unless otherwise specified, all software contained herein is licensed
- * under the Apache License, Version 2.0 (the "License");
- * you may not use this software except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *             http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Unless otherwise specified, all documentation contained herein is licensed
- * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
- * you may not use this documentation except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *             https://creativecommons.org/licenses/by/4.0/
- *
- * Unless required by applicable law or agreed to in writing, documentation
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * ============LICENSE_END============================================
- *
- * ECOMP is a trademark and service mark of AT&T Intellectual Property.
- */
-package org.onap.portalsdk.core.util;
-
-import java.io.UnsupportedEncodingException;
-import java.security.AlgorithmParameters;
-import java.security.GeneralSecurityException;
-import java.security.SecureRandom;
-
-import javax.crypto.Cipher;
-import javax.crypto.SecretKey;
-import javax.crypto.SecretKeyFactory;
-import javax.crypto.spec.IvParameterSpec;
-import javax.crypto.spec.PBEKeySpec;
-import javax.crypto.spec.SecretKeySpec;
-
-import org.apache.commons.codec.binary.Base64;
-
-public class EncDecUtilTest {
-
-       private static final String WORD = "test";
-       private static final String SALT = "r n�HN~�\ 6\1a|\bf��X\1d�";
-       private static final int ITERATIONS = 65536;
-       private static final int KEY_SIZE = 256;
-       private byte[] ivBytes;
-
-       public String encrypt(String plainText) throws UnsupportedEncodingException, GeneralSecurityException {
-
-               // get salt
-               // salt = generateSalt();
-               byte[] saltBytes = SALT.getBytes("UTF-8");
-
-               // Derive the key
-               SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
-               PBEKeySpec spec = new PBEKeySpec(WORD.toCharArray(), saltBytes, ITERATIONS, KEY_SIZE);
-
-               SecretKey secretKey = factory.generateSecret(spec);
-               SecretKeySpec secret = new SecretKeySpec(secretKey.getEncoded(), "AES");
-
-               // encrypt the message
-               Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
-               cipher.init(Cipher.ENCRYPT_MODE, secret);
-               AlgorithmParameters params = cipher.getParameters();
-               ivBytes = params.getParameterSpec(IvParameterSpec.class).getIV();
-               byte[] encryptedTextBytes = cipher.doFinal(plainText.getBytes("UTF-8"));
-               return Base64.encodeBase64String(encryptedTextBytes);
-       }
-
-       public String decrypt(String encryptedText) throws UnsupportedEncodingException, GeneralSecurityException  {
-               byte[] saltBytes = SALT.getBytes("UTF-8");
-               byte[] encryptedTextBytes = Base64.decodeBase64(encryptedText);
-
-               // Derive the key
-               SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
-               PBEKeySpec spec = new PBEKeySpec(WORD.toCharArray(), saltBytes, ITERATIONS, KEY_SIZE);
-
-               SecretKey secretKey = factory.generateSecret(spec);
-               SecretKeySpec secret = new SecretKeySpec(secretKey.getEncoded(), "AES");
-
-               // Decrypt the message
-               Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
-               cipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(ivBytes));
-
-               byte[] decryptedTextBytes = cipher.doFinal(encryptedTextBytes);
-               return new String(decryptedTextBytes);
-       }
-
-       public String generateSalt() {
-               SecureRandom random = new SecureRandom();
-               byte [] bytes = new byte[20];
-               random.nextBytes(bytes);
-               return new String(bytes);
-       }
-}
\ No newline at end of file
index bb39056..8cae0a5 100644 (file)
                                                </lifecycleMappingMetadata>
                                        </configuration>
                                </plugin>
+                               <!-- maven-site-plugin config is provided by OParent -->
+                               <plugin>
+                                       <groupId>org.apache.maven.plugins</groupId>
+                                       <artifactId>maven-site-plugin</artifactId>
+                                       <version>3.6</version>
+                                       <dependencies>
+                                               <dependency>
+                                                       <groupId>org.apache.maven.wagon</groupId>
+                                                       <artifactId>wagon-webdav-jackrabbit</artifactId>
+                                                       <version>2.10</version>
+                                               </dependency>
+                                       </dependencies>
+                               </plugin>
                        </plugins>
                </pluginManagement>