https://sonarcloud.io/project/security_hotspots?id=onap_cps&hotspots=AXfObcsqA2pnU4Plp4-g
Issue-ID: CPS-289
Signed-off-by: puthuparambil.aditya <aditya.puthuparambil@bell.ca>
Change-Id: Ibe8627413fc9e3964cdc5bb98caf5e25fa4f3a95
/*
* ============LICENSE_START=======================================================
* Copyright (C) 2020 Pantheon.tech
+ * Modifications Copyright (C) 2021 Bell Canada.
* ================================================================================
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
private static Map<String, String> extractYangResourcesMapFromZipArchive(final MultipartFile multipartFile) {
final ImmutableMap.Builder<String, String> yangResourceMapBuilder = ImmutableMap.builder();
-
+ final ZipFileSizeValidator zipFileSizeValidator = new ZipFileSizeValidator();
try (
final InputStream inputStream = multipartFile.getInputStream();
final ZipInputStream zipInputStream = new ZipInputStream(inputStream);
) {
ZipEntry zipEntry;
while ((zipEntry = zipInputStream.getNextEntry()) != null) {
- extractZipEntryToMapIfApplicable(yangResourceMapBuilder, zipEntry, zipInputStream);
+ extractZipEntryToMapIfApplicable(yangResourceMapBuilder, zipEntry, zipInputStream,
+ zipFileSizeValidator);
}
zipInputStream.closeEntry();
} catch (final IOException e) {
throw new CpsException("Cannot extract resources from zip archive.", e.getMessage(), e);
}
-
+ zipFileSizeValidator.validateSizeAndEntries();
try {
final Map<String, String> yangResourceMap = yangResourceMapBuilder.build();
if (yangResourceMap.isEmpty()) {
private static void extractZipEntryToMapIfApplicable(
final ImmutableMap.Builder<String, String> yangResourceMapBuilder, final ZipEntry zipEntry,
- final ZipInputStream zipInputStream) throws IOException {
-
+ final ZipInputStream zipInputStream, final ZipFileSizeValidator zipFileSizeValidator) throws IOException {
+ zipFileSizeValidator.setCompressedSize(zipEntry.getCompressedSize());
final String yangResourceName = extractResourceNameFromPath(zipEntry.getName());
if (zipEntry.isDirectory() || !resourceNameEndsWithExtension(yangResourceName, YANG_FILE_EXTENSION)) {
return;
}
- yangResourceMapBuilder.put(yangResourceName, extractYangResourceContent(zipInputStream));
+ yangResourceMapBuilder.put(yangResourceName, extractYangResourceContent(zipInputStream, zipFileSizeValidator));
}
private static boolean resourceNameEndsWithExtension(final String resourceName, final String extension) {
}
}
- private static String extractYangResourceContent(final ZipInputStream zipInputStream) throws IOException {
+ private static String extractYangResourceContent(final ZipInputStream zipInputStream,
+ final ZipFileSizeValidator zipFileSizeValidator) throws IOException {
try (final ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream()) {
- final byte[] buffer = new byte[READ_BUFFER_SIZE];
+ int totalSizeEntry = 0;
int numberOfBytesRead;
+ final byte[] buffer = new byte[READ_BUFFER_SIZE];
+ zipFileSizeValidator.incrementTotalEntryInArchive();
while ((numberOfBytesRead = zipInputStream.read(buffer, 0, READ_BUFFER_SIZE)) > 0) {
byteArrayOutputStream.write(buffer, 0, numberOfBytesRead);
+ totalSizeEntry += numberOfBytesRead;
+ zipFileSizeValidator.updateTotalSizeArchive(totalSizeEntry);
+ zipFileSizeValidator.validateCompresssionRatio(totalSizeEntry);
}
return byteArrayOutputStream.toString(StandardCharsets.UTF_8);
}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Copyright (C) 2021 Bell Canada.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.cps.rest.utils;
+
+import lombok.Getter;
+import lombok.Setter;
+import org.onap.cps.spi.exceptions.ModelValidationException;
+
+@Setter
+@Getter
+public class ZipFileSizeValidator {
+
+ private static final int THRESHOLD_ENTRIES = 10000;
+ private static final int THRESHOLD_SIZE = 100000000;
+ private static final double THRESHOLD_RATIO = 40;
+ private static final String INVALID_ZIP = "Invalid ZIP archive content.";
+
+ private int totalSizeArchive = 0;
+ private int totalEntryInArchive = 0;
+ private long compressedSize = 0;
+
+ /**
+ * Increment the totalEntryInArchive by 1.
+ */
+ public void incrementTotalEntryInArchive() {
+ totalEntryInArchive++;
+ }
+
+ /**
+ * Update the totalSizeArchive by numberOfBytesRead.
+ * @param numberOfBytesRead the number of bytes of each entry
+ */
+ public void updateTotalSizeArchive(final int numberOfBytesRead) {
+ totalSizeArchive += numberOfBytesRead;
+ }
+
+ /**
+ * Validate the total Compression size of the zip.
+ * @param totalEntrySize the size of the unzipped entry.
+ */
+ public void validateCompresssionRatio(final int totalEntrySize) {
+ final double compressionRatio = (double) totalEntrySize / compressedSize;
+ if (compressionRatio > THRESHOLD_RATIO) {
+ throw new ModelValidationException(INVALID_ZIP,
+ String.format("Ratio between compressed and uncompressed data exceeds the CPS limit"
+ + " %s.", THRESHOLD_RATIO));
+ }
+ }
+
+ /**
+ * Validate the total Size and number of entries in the zip.
+ */
+ public void validateSizeAndEntries() {
+ if (totalSizeArchive > THRESHOLD_SIZE) {
+ throw new ModelValidationException(INVALID_ZIP,
+ String.format("The uncompressed data size exceeds the CPS limit %s bytes.", THRESHOLD_SIZE));
+ }
+ if (totalEntryInArchive > THRESHOLD_ENTRIES) {
+ throw new ModelValidationException(INVALID_ZIP,
+ String.format("The number of entries in the archive exceeds the CPS limit %s.",
+ THRESHOLD_ENTRIES));
+ }
+ }
+}
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * Copyright (C) 2021 Bell Canada.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.cps.rest.utils
+
+import org.onap.cps.spi.exceptions.ModelValidationException
+import spock.lang.Specification
+
+class ZipFileSizeValidatorSpec extends Specification {
+
+ def static thresholdSize = ZipFileSizeValidator.THRESHOLD_SIZE
+ def static thresholdEntries = ZipFileSizeValidator.THRESHOLD_ENTRIES
+ def static thresholdRatio = ZipFileSizeValidator.THRESHOLD_RATIO
+
+ def objectUnderTest = new ZipFileSizeValidator()
+ def compressedFileSize = 100
+
+ def setup() {
+ objectUnderTest.setTotalEntryInArchive(0)
+ objectUnderTest.setTotalSizeArchive(0)
+ objectUnderTest.setCompressedSize(compressedFileSize)
+ }
+
+ def 'Increment the total entries in Archive.'() {
+ when: 'the totalEntriesInArchive value is incremented'
+ objectUnderTest.incrementTotalEntryInArchive()
+ then: 'the totalEntriesInArchive is incremented by 1'
+ assert objectUnderTest.totalEntryInArchive == old(objectUnderTest.totalEntryInArchive) + 1
+ }
+
+ def 'Update the total size of Archive.'() {
+ given: 'the size of an entry of archive'
+ def entrySize = 100
+ when: 'the totalSizeArchive is to be updated with the latest entry Size'
+ objectUnderTest.updateTotalSizeArchive(entrySize)
+ then: 'the totalSizeArchive is updated as expected'
+ assert objectUnderTest.totalSizeArchive == old(objectUnderTest.totalSizeArchive) + entrySize
+ }
+
+ def 'Validate the zip archive for compression ratio less that threshold compression ratio.'() {
+ given: 'the totalEntrySize of the archive so that compression ratio is within the threshold'
+ int totalEntrySize = compressedFileSize * thresholdRatio - 1
+ when: 'the validation is performed against the threshold compression ratio'
+ objectUnderTest.validateCompresssionRatio(totalEntrySize)
+ then: 'validation passes and no exception is thrown'
+ noExceptionThrown()
+ }
+
+ def 'Validate the zip archive for compression ratio.'() {
+ given: 'the totalEntrySize of the archive so that compression ratio is higher than the threshold'
+ int totalEntrySize = compressedFileSize * thresholdRatio + 1
+ when: 'the validation is performed against the threshold compression ratio'
+ objectUnderTest.validateCompresssionRatio(totalEntrySize)
+ then: 'validation fails and exception is thrown'
+ thrown ModelValidationException
+ }
+
+ def 'Validate the zip archive for thresholdSize and thresholdEntries #caseDescriptor.'() {
+ given:
+ objectUnderTest.setTotalEntryInArchive(totalEntriesInArchive)
+ objectUnderTest.setTotalSizeArchive(totalSizeArchive)
+ when: 'the validation is performed against the threshold size and threshold Entries count'
+ objectUnderTest.validateSizeAndEntries()
+ then: 'validation passes and no exception is thrown'
+ noExceptionThrown()
+ where: 'following cases are tested'
+ caseDescriptor | totalSizeArchive | totalEntriesInArchive
+ 'less than threshold value' | thresholdSize - 1 | thresholdEntries - 1
+ 'at threshold value' | thresholdSize | thresholdEntries
+ }
+
+ def 'Validate the zip archive for thresholdSize and thresholdEntries with #caseDescriptor.'() {
+ given:
+ objectUnderTest.setTotalEntryInArchive(totalEntriesInArchive)
+ objectUnderTest.setTotalSizeArchive(totalSizeArchive)
+ when: 'the validation is performed against the threshold size and threshold Entries count'
+ objectUnderTest.validateSizeAndEntries()
+ then: 'validation fails and exception is thrown'
+ thrown ModelValidationException
+ where: 'following cases are tested'
+ caseDescriptor | totalSizeArchive | totalEntriesInArchive
+ 'totalEntriesInArchive exceeds threshold value' | thresholdSize | thresholdEntries + 1
+ 'totalSizeArchive exceeds threshold value' | thresholdSize + 1 | thresholdEntries
+ }
+}
Code Review / cps.git / commitdiff