Medium Vulnerabilities CodeFix: 1. URL Redirection 2. AAF-1111

[aaf/authz.git] / auth / auth-locate / src / main / java / org / onap / aaf / auth / locate / api / API_AAFAccess.java

diff --git a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_AAFAccess.java b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_AAFAccess.java
index b5ab435..7b23c89 100644 (file)
--- a/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_AAFAccess.java
+++ b/auth/auth-locate/src/main/java/org/onap/aaf/auth/locate/api/API_AAFAccess.java
@@ -7,9 +7,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -53,24 +53,27 @@ import org.onap.aaf.cadi.client.Retryable;
 import org.onap.aaf.misc.env.APIException;
 import org.onap.aaf.misc.env.Env;
 import org.onap.aaf.misc.env.TimeTaken;
+import org.owasp.esapi.errors.AccessControlException;
+import org.owasp.esapi.reference.DefaultHTTPUtilities;
+import org.owasp.encoder.Encode;
 
 public class API_AAFAccess {
-//    private static String service, version, envContext; 
+//    private static String service, version, envContext;
 
     private static final String GET_PERMS_BY_USER = "Get Perms by User";
     private static final String USER_HAS_PERM ="User Has Perm";
 //    private static final String USER_IN_ROLE ="User Has Role";
-    
+
     /**
      * Normal Init level APIs
-     * 
+     *
      * @param gwAPI
      * @param facade
      * @throws Exception
      */
     public static void init(final AAF_Locate gwAPI, LocateFacade facade) throws Exception {
-        
-        
+
+
         gwAPI.route(HttpMethods.GET,"/authz/perms/user/:user",API.VOID,new LocateCode(facade,GET_PERMS_BY_USER, true) {
             @Override
             public void handle(final AuthzTrans trans, final HttpServletRequest req, final HttpServletResponse resp) throws Exception {
@@ -90,7 +93,7 @@ public class API_AAFAccess {
                     } finally {
                         tt2.done();
                     }
-                    
+
                     if (d==null || d.data.isEmpty()) {
                         tt2 = trans.start("AAF Service Call",Env.REMOTE);
                         try {
@@ -104,7 +107,7 @@ public class API_AAFAccess {
                                         ServletOutputStream sos;
                                         try {
                                             sos = resp.getOutputStream();
-                                            sos.print(fp.value);
+                                            sos.print(Encode.forJava(fp.value));
                                         } catch (IOException e) {
                                             throw new CadiException(e);
                                         }
@@ -122,7 +125,7 @@ public class API_AAFAccess {
                         User u = (User)d.data.get(0);
                         resp.setStatus(u.code);
                         ServletOutputStream sos = resp.getOutputStream();
-                        sos.print(u.resp);
+                        sos.print(Encode.forJava(u.resp));
                     }
                 } finally {
                     tt.done();
@@ -136,7 +139,7 @@ public class API_AAFAccess {
 
         /**
          * Query User Has Perm is DEPRECATED
-         * 
+         *
          * Need to move towards NS declaration... is this even being used?
          * @deprecated
          */
@@ -169,8 +172,8 @@ public class API_AAFAccess {
             @Override
             public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {
                 try {
-                    redirect(trans, req, resp, context, 
-                            gwAPI.getGUILocator(), 
+                    redirect(trans, req, resp, context,
+                            gwAPI.getGUILocator(),
                             "gui/"+pathParam(req,":path"));
                 } catch (LocatorException e) {
                     context.error(trans, resp, Result.ERR_BadData, e.getMessage());
@@ -184,8 +187,8 @@ public class API_AAFAccess {
             @Override
             public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {
                 try {
-                    redirect(trans, req, resp, context, 
-                            gwAPI.getGUILocator(), 
+                    redirect(trans, req, resp, context,
+                            gwAPI.getGUILocator(),
                             pathParam(req,":path"));
                 } catch (LocatorException e) {
                     context.error(trans, resp, Result.ERR_BadData, e.getMessage());
@@ -195,7 +198,7 @@ public class API_AAFAccess {
             }
         });
     }
-    
+
     public static void initDefault(final AAF_Locate gwAPI, LocateFacade facade) throws Exception {
 
         /**
@@ -205,7 +208,7 @@ public class API_AAFAccess {
             @Override
             public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {
                 try {
-                    redirect(trans, req, resp, context, 
+                    redirect(trans, req, resp, context,
                             gwAPI.getGUILocator(),
                             "login");
                 } catch (LocatorException e) {
@@ -216,7 +219,7 @@ public class API_AAFAccess {
             }
         });
 
-        
+
         /**
          * Default URL
          */
@@ -224,17 +227,17 @@ public class API_AAFAccess {
             @Override
             public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {
                 try {
-                    redirect(trans, req, resp, context, 
-                            gwAPI.getGUILocator(), 
+                    redirect(trans, req, resp, context,
+                            gwAPI.getGUILocator(),
                             "gui/home");
                 } catch (Exception e) {
                     context.error(trans, resp, Result.ERR_General, e.getMessage());
                 }
             }
         });
-        
+
         /**
-         * Configuration 
+         * Configuration
          */
         gwAPI.route(HttpMethods.GET,"/configure/:id/:type",API.CONFIG,new LocateCode(facade,"Deliver Configuration Properties to AAF", true) {
             @Override
@@ -256,12 +259,12 @@ public class API_AAFAccess {
         });
     }
 
-    private static void redirect(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, LocateFacade context, Locator<URI> loc, String path) throws IOException {
+    private static void redirect(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp, LocateFacade context, Locator<URI> loc, String path) throws IOException, AccessControlException {
         try {
             if (loc.hasItems()) {
                 Item item = loc.best();
                 URI uri = loc.get(item);
-                StringBuilder redirectURL = new StringBuilder(uri.toString()); 
+                StringBuilder redirectURL = new StringBuilder(uri.toString());
                 redirectURL.append('/');
                 redirectURL.append(path);
                 String str = req.getQueryString();
@@ -270,7 +273,9 @@ public class API_AAFAccess {
                     redirectURL.append(str);
                 }
                 trans.info().log("Redirect to",redirectURL);
-                resp.sendRedirect(redirectURL.toString());
+                DefaultHTTPUtilities util = new DefaultHTTPUtilities();                
+                util.sendRedirect(redirectURL.toString());                
+                //resp.sendRedirect(redirectURL.toString());
             } else {
                 context.error(trans, resp, Result.err(Result.ERR_NotFound,"No Locations found for redirection"));
             }
@@ -282,7 +287,7 @@ public class API_AAFAccess {
     private static class User {
         public final int code;
         public final String resp;
-        
+
         public User(int code, String resp) {
             this.code = code;
             this.resp = resp;