Code Review / dmaap / datarouter.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | review | tree
raw | inline | side by side
Fix Main Vulnerabilities
[dmaap/datarouter.git] / datarouter-prov / src / main / java / org / onap / dmaap / datarouter / provisioning / SubscribeServlet.java
diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscribeServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscribeServlet.java
index 3ad2242..1ab45a9 100644 (file)
--- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscribeServlet.java
+++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscribeServlet.java
@@ -42,9 +42,11 @@ import org.onap.dmaap.datarouter.provisioning.utils.JSONUtilities;
 import com.att.eelf.configuration.EELFLogger;
 import com.att.eelf.configuration.EELFManager;
 
+import static org.onap.dmaap.datarouter.provisioning.utils.HttpServletUtils.sendResponseError;
+
 /**
- * This servlet handles provisioning for the <subscribeURL> which is generated by the provisioning
- * server to handle the creation and inspection of subscriptions to a specific feed.
+ * This servlet handles provisioning for the <subscribeURL> which is generated by the provisioning server to
+ * handle the creation and inspection of subscriptions to a specific feed.
  *
  * @author Robert Eby
  * @version $Id$
@@ -53,38 +55,39 @@ import com.att.eelf.configuration.EELFManager;
 public class SubscribeServlet extends ProxyServlet {
 
     //Adding EELF Logger Rally:US664892
-    private static EELFLogger eelflogger = EELFManager.getInstance().getLogger("org.onap.dmaap.datarouter.provisioning.SubscribeServlet");
+    private static EELFLogger eelflogger = EELFManager.getInstance()
+        .getLogger("org.onap.dmaap.datarouter.provisioning.SubscribeServlet");
 
     /**
      * DELETE on the <subscribeUrl> -- not supported.
      */
     @Override
-    public void doDelete(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+    public void doDelete(HttpServletRequest req, HttpServletResponse resp) {
         setIpAndFqdnForEelf("doDelete");
-        eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_SUBID, req.getHeader(BEHALF_HEADER),getIdFromPath(req)+"");
+        eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_SUBID, req.getHeader(BEHALF_HEADER), getIdFromPath(req) + "");
         String message = "DELETE not allowed for the subscribeURL.";
         EventLogRecord elr = new EventLogRecord(req);
         elr.setMessage(message);
         elr.setResult(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
         eventlogger.info(elr);
-        resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, message);
+        sendResponseError(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, message, eventlogger);
     }
+
     /**
-     * GET on the <subscribeUrl> -- get the list of subscriptions to a feed.
-     * See the <i>Subscription Collection Query</i> section in the <b>Provisioning API</b>
-     * document for details on how this method should be invoked.
+     * GET on the &lt;subscribeUrl&gt; -- get the list of subscriptions to a feed. See the <i>Subscription Collection
+     * Query</i> section in the <b>Provisioning API</b> document for details on how this method should be invoked.
      */
     @Override
-    public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+    public void doGet(HttpServletRequest req, HttpServletResponse resp) {
         setIpAndFqdnForEelf("doGet");
-        eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_SUBID, req.getHeader(BEHALF_HEADER),getIdFromPath(req)+"");
+        eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_SUBID, req.getHeader(BEHALF_HEADER), getIdFromPath(req) + "");
         EventLogRecord elr = new EventLogRecord(req);
         String message = isAuthorizedForProvisioning(req);
         if (message != null) {
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_FORBIDDEN);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_FORBIDDEN, message);
+            sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
             return;
         }
         if (isProxyServer()) {
@@ -93,11 +96,11 @@ public class SubscribeServlet extends ProxyServlet {
         }
         String bhdr = req.getHeader(BEHALF_HEADER);
         if (bhdr == null) {
-            message = "Missing "+BEHALF_HEADER+" header.";
+            message = "Missing " + BEHALF_HEADER + " header.";
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+            sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
             return;
         }
         int feedid = getIdFromPath(req);
@@ -106,7 +109,7 @@ public class SubscribeServlet extends ProxyServlet {
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+            sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
             return;
         }
         Feed feed = Feed.getFeedById(feedid);
@@ -115,17 +118,17 @@ public class SubscribeServlet extends ProxyServlet {
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_NOT_FOUND);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_NOT_FOUND, message);
+            sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
             return;
         }
         // Check with the Authorizer
         AuthorizationResponse aresp = authz.decide(req);
-        if (! aresp.isAuthorized()) {
+        if (!aresp.isAuthorized()) {
             message = "Policy Engine disallows access.";
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_FORBIDDEN);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_FORBIDDEN, message);
+            sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
             return;
         }
 
@@ -138,29 +141,34 @@ public class SubscribeServlet extends ProxyServlet {
         eventlogger.info(elr);
         resp.setStatus(HttpServletResponse.SC_OK);
         resp.setContentType(SUBLIST_CONTENT_TYPE);
-        resp.getOutputStream().print(t);
+        try {
+            resp.getOutputStream().print(t);
+        } catch (IOException ioe) {
+            eventlogger.error("IOException: " + ioe.getMessage());
+        }
     }
+
     /**
      * PUT on the &lt;subscribeUrl&gt; -- not supported.
      */
     @Override
-    public void doPut(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+    public void doPut(HttpServletRequest req, HttpServletResponse resp) {
         setIpAndFqdnForEelf("doPut");
-        eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_SUBID, req.getHeader(BEHALF_HEADER),getIdFromPath(req)+"");
+        eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_SUBID, req.getHeader(BEHALF_HEADER), getIdFromPath(req) + "");
         String message = "PUT not allowed for the subscribeURL.";
         EventLogRecord elr = new EventLogRecord(req);
         elr.setMessage(message);
         elr.setResult(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
         eventlogger.info(elr);
-        resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, message);
+        sendResponseError(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, message, eventlogger);
     }
+
     /**
-     * POST on the &lt;subscribeUrl&gt; -- create a new subscription to a feed.
-     * See the <i>Creating a Subscription</i> section in the <b>Provisioning API</b>
-     * document for details on how this method should be invoked.
+     * POST on the &lt;subscribeUrl&gt; -- create a new subscription to a feed. See the <i>Creating a Subscription</i>
+     * section in the <b>Provisioning API</b> document for details on how this method should be invoked.
      */
     @Override
-    public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+    public void doPost(HttpServletRequest req, HttpServletResponse resp) {
         setIpAndFqdnForEelf("doPost");
         eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF, req.getHeader(BEHALF_HEADER));
         EventLogRecord elr = new EventLogRecord(req);
@@ -169,7 +177,7 @@ public class SubscribeServlet extends ProxyServlet {
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_FORBIDDEN);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_FORBIDDEN, message);
+            sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
             return;
         }
         if (isProxyServer()) {
@@ -178,11 +186,11 @@ public class SubscribeServlet extends ProxyServlet {
         }
         String bhdr = req.getHeader(BEHALF_HEADER);
         if (bhdr == null) {
-            message = "Missing "+BEHALF_HEADER+" header.";
+            message = "Missing " + BEHALF_HEADER + " header.";
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+            sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
             return;
         }
         int feedid = getIdFromPath(req);
@@ -191,7 +199,7 @@ public class SubscribeServlet extends ProxyServlet {
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+            sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
             return;
         }
         Feed feed = Feed.getFeedById(feedid);
@@ -200,17 +208,17 @@ public class SubscribeServlet extends ProxyServlet {
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_NOT_FOUND);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_NOT_FOUND, message);
+            sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
             return;
         }
         // Check with the Authorizer
         AuthorizationResponse aresp = authz.decide(req);
-        if (! aresp.isAuthorized()) {
+        if (!aresp.isAuthorized()) {
             message = "Policy Engine disallows access.";
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_FORBIDDEN);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_FORBIDDEN, message);
+            sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
             return;
         }
 
@@ -218,12 +226,12 @@ public class SubscribeServlet extends ProxyServlet {
         ContentHeader ch = getContentHeader(req);
         String ver = ch.getAttribute("version");
         if (!ch.getType().equals(SUB_BASECONTENT_TYPE) || !(ver.equals("1.0") || ver.equals("2.0"))) {
-            intlogger.debug("Content-type is: "+req.getHeader("Content-Type"));
+            intlogger.debug("Content-type is: " + req.getHeader("Content-Type"));
             message = "Incorrect content-type";
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message);
+            sendResponseError(resp, HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message, eventlogger);
             return;
         }
         JSONObject jo = getJSONfromInput(req);
@@ -232,30 +240,31 @@ public class SubscribeServlet extends ProxyServlet {
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+            sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
             return;
         }
-        if (intlogger.isDebugEnabled())
+        if (intlogger.isDebugEnabled()) {
             intlogger.debug(jo.toString());
-        if (++active_subs > max_subs) {
-            active_subs--;
+        }
+        if (++activeSubs > maxSubs) {
+            activeSubs--;
             message = "Cannot create subscription; the maximum number of subscriptions has been configured.";
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_CONFLICT);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_CONFLICT, message);
+            sendResponseError(resp, HttpServletResponse.SC_CONFLICT, message, eventlogger);
             return;
         }
         Subscription sub = null;
         try {
             sub = new Subscription(jo);
         } catch (InvalidObjectException e) {
-            active_subs--;
+            activeSubs--;
             message = e.getMessage();
             elr.setMessage(message);
             elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_BAD_REQUEST, message);
+            sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
             return;
         }
         sub.setFeedid(feedid);
@@ -263,8 +272,11 @@ public class SubscribeServlet extends ProxyServlet {
 
         // Check if this subscription already exists; not an error (yet), just warn
         Subscription sub2 = Subscription.getSubscriptionMatching(sub);
-        if (sub2 != null)
-            intlogger.warn("PROV0011 Creating a duplicate subscription: new subid="+sub.getSubid()+", old subid="+sub2.getSubid());
+        if (sub2 != null) {
+            intlogger.warn(
+                "PROV0011 Creating a duplicate subscription: new subid=" + sub.getSubid() + ", old subid=" + sub2
+                    .getSubid());
+        }
 
         // Create SUBSCRIPTIONS table entries
         if (doInsert(sub)) {
@@ -274,15 +286,19 @@ public class SubscribeServlet extends ProxyServlet {
             resp.setStatus(HttpServletResponse.SC_CREATED);
             resp.setContentType(SUBFULL_CONTENT_TYPE);
             resp.setHeader("Location", sub.getLinks().getSelf());
-            resp.getOutputStream().print(sub.asLimitedJSONObject().toString());
+            try {
+                resp.getOutputStream().print(sub.asLimitedJSONObject().toString());
+            } catch (IOException ioe) {
+                eventlogger.error("IOException: " + ioe.getMessage());
+            }
 
             provisioningDataChanged();
         } else {
             // Something went wrong with the INSERT
-            active_subs--;
+            activeSubs--;
             elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
             eventlogger.info(elr);
-            resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG);
+            sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);
         }
     }
 }
The Data Routing System project is intended to provide a common framework by which data producers can make data available to data consumers and a way for potential consumers to find feeds with the data they require. The interface to DR is exposed as a RESTful web service known as the DR Publishing and Delivery API