Merge "Fix NodeServlet Vulnerabilities"

diff --combined datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
index 5f85139,e5eb2ed..b54068b
--- 1/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
--- 2/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
+++ b/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeServlet.java
@@@ -27,14 -27,12 +27,12 @@@ package org.onap.dmaap.datarouter.node
  import com.att.eelf.configuration.EELFLogger;
  import com.att.eelf.configuration.EELFManager;
  import java.io.File;
- import java.io.FileInputStream;
  import java.io.FileOutputStream;
  import java.io.FileWriter;
  import java.io.IOException;
  import java.io.InputStream;
  import java.io.OutputStream;
  import java.io.Writer;
- import java.net.Socket;
  import java.nio.file.Files;
  import java.nio.file.Path;
  import java.nio.file.Paths;
@@@ -44,9 -42,12 +42,12 @@@ import javax.servlet.ServletException
  import javax.servlet.http.HttpServlet;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
+ 
  import org.apache.log4j.Logger;
  import org.onap.dmaap.datarouter.node.eelf.EelfMsgs;
  
+ import static org.onap.dmaap.datarouter.node.NodeUtils.sendResponseError;
+ 
  /**
   * Servlet for handling all http and https requests to the data router node
   * <p>
@@@ -59,25 -60,26 +60,23 @@@
   * PUT/DELETE https://<i>node</i>/publish/<i>feedid</i>/<i>fileid</i> - publsh request
   */
  public class NodeServlet extends HttpServlet {
- 
      private static Logger logger = Logger.getLogger("org.onap.dmaap.datarouter.node.NodeServlet");
      private static NodeConfigManager config;
      private static Pattern MetaDataPattern;
-     private static SubnetMatcher internalsubnet = new SubnetMatcher("135.207.136.128/25");
      //Adding EELF Logger Rally:US664892
      private static EELFLogger eelflogger = EELFManager.getInstance()
          .getLogger("org.onap.dmaap.datarouter.node.NodeServlet");
  
      static {
 -        try {
 -            final String ws = "\\s*";
 -            // assume that \\ and \" have been replaced by X
 -            final String string = "\"[^\"]*\"";
 -            //String string = "\"(?:[^\"\\\\]|\\\\.)*\"";
 -            final String number = "[+-]?(?:\\.\\d+|(?:0|[1-9]\\d*)(?:\\.\\d*)?)(?:[eE][+-]?\\d+)?";
 -            final String value = "(?:" + string + "|" + number + "|null|true|false)";
 -            final String item = string + ws + ":" + ws + value + ws;
 -            final String object = ws + "\\{" + ws + "(?:" + item + "(?:" + "," + ws + item + ")*)?\\}" + ws;
 -            MetaDataPattern = Pattern.compile(object, Pattern.DOTALL);
 -        } catch (Exception e) {
 -        }
 +        final String ws = "\\s*";
 +        // assume that \\ and \" have been replaced by X
 +        final String string = "\"[^\"]*\"";
 +        //String string = "\"(?:[^\"\\\\]|\\\\.)*\"";
 +        final String number = "[+-]?(?:\\.\\d+|(?:0|[1-9]\\d*)(?:\\.\\d*)?)(?:[eE][+-]?\\d+)?";
 +        final String value = "(?:" + string + "|" + number + "|null|true|false)";
 +        final String item = string + ws + ":" + ws + value + ws;
 +        final String object = ws + "\\{" + ws + "(?:" + item + "(?:" + "," + ws + item + ")*)?\\}" + ws;
 +        MetaDataPattern = Pattern.compile(object, Pattern.DOTALL);
      }
  
      /**
@@@ -90,7 -92,7 +89,7 @@@
  
      private boolean down(HttpServletResponse resp) throws IOException {
          if (config.isShutdown() || !config.isConfigured()) {
-             resp.sendError(HttpServletResponse.SC_SERVICE_UNAVAILABLE);
+             sendResponseError(resp, HttpServletResponse.SC_SERVICE_UNAVAILABLE, logger);
              logger.info("NODE0102 Rejecting request: Service is being quiesced");
              return (true);
          }
@@@ -100,12 -102,17 +99,17 @@@
      /**
       * Handle a GET for /internal/fetchProv
       */
-     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+     protected void doGet(HttpServletRequest req, HttpServletResponse resp){
          NodeUtils.setIpAndFqdnForEelf("doGet");
          eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader("X-ATT-DR-ON-BEHALF-OF"),
              getIdFromPath(req) + "");
-         if (down(resp)) {
-             return;
+         try{
+             if (down(resp)) {
+                 return;
+             }
+ 
+         } catch (IOException ioe) {
+             logger.error("IOException" + ioe.getMessage());
          }
          String path = req.getPathInfo();
          String qs = req.getQueryString();
@@@ -125,50 -132,9 +129,9 @@@
                  return;
              }
          }
-         if (internalsubnet.matches(NodeUtils.getInetAddress(ip))) {
-             if (path.startsWith("/internal/logs/")) {
-                 String f = path.substring(15);
-                 File fn = new File(config.getLogDir() + "/" + f);
-                 if (f.indexOf('/') != -1 || !fn.isFile()) {
-                     logger.info("NODE0103 Rejecting invalid GET of " + path + " from " + ip);
-                     resp.sendError(HttpServletResponse.SC_NOT_FOUND);
-                     return;
-                 }
-                 byte[] buf = new byte[65536];
-                 resp.setContentType("text/plain");
-                 resp.setContentLength((int) fn.length());
-                 resp.setStatus(200);
-                 try (InputStream is = new FileInputStream(fn)) {
-                     OutputStream os = resp.getOutputStream();
-                     int i;
-                     while ((i = is.read(buf)) > 0) {
-                         os.write(buf, 0, i);
-                     }
-                 }
-                 return;
-             }
-             if (path.startsWith("/internal/rtt/")) {
-                 String xip = path.substring(14);
-                 long st = System.currentTimeMillis();
-                 String status = " unknown";
-                 try {
-                     Socket s = new Socket(xip, 443);
-                     s.close();
-                     status = " connected";
-                 } catch (Exception e) {
-                     status = " error " + e.toString();
-                 }
-                 long dur = System.currentTimeMillis() - st;
-                 resp.setContentType("text/plain");
-                 resp.setStatus(200);
-                 byte[] buf = (dur + status + "\n").getBytes();
-                 resp.setContentLength(buf.length);
-                 resp.getOutputStream().write(buf);
-                 return;
-             }
-         }
+ 
          logger.info("NODE0103 Rejecting invalid GET of " + path + " from " + ip);
-         resp.sendError(HttpServletResponse.SC_NOT_FOUND);
+         sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, logger);
      }
  
      /**
@@@ -178,7 -144,12 +141,12 @@@
          NodeUtils.setIpAndFqdnForEelf("doPut");
          eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader("X-ATT-DR-ON-BEHALF-OF"),
              getIdFromPath(req) + "");
-         common(req, resp, true);
+         try {
+             common(req, resp, true);
+         }
+         catch(IOException ioe){
+             logger.error("IOException" + ioe.getMessage());
+         }
      }
  
      /**
@@@ -188,7 -159,12 +156,12 @@@
          NodeUtils.setIpAndFqdnForEelf("doDelete");
          eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader("X-ATT-DR-ON-BEHALF-OF"),
              getIdFromPath(req) + "");
-         common(req, resp, false);
+         try {
+             common(req, resp, false);
+         }
+         catch(IOException ioe){
+             logger.error("IOException" + ioe.getMessage());
+         }
      }
  
      private void common(HttpServletRequest req, HttpServletResponse resp, boolean isput)

diff --combined datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeUtils.java
index d5b15bc,01585d9..cc21992
--- 1/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeUtils.java
--- 2/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeUtils.java
+++ b/datarouter-node/src/main/java/org/onap/dmaap/datarouter/node/NodeUtils.java
@@@ -45,6 -45,8 +45,8 @@@ import org.apache.log4j.Logger
  import org.onap.dmaap.datarouter.node.eelf.EelfMsgs;
  import org.slf4j.MDC;
  
+ import javax.servlet.http.HttpServletResponse;
+ 
  /**
   * Utility functions for the data router node
   */
@@@ -53,6 -55,12 +55,6 @@@ public class NodeUtils 
      private static EELFLogger eelfLogger = EELFManager.getInstance()
          .getLogger("org.onap.dmaap.datarouter.node.NodeUtils");
      private static Logger nodeUtilsLogger = Logger.getLogger("org.onap.dmaap.datarouter.node.NodeUtils");
 -    private static SimpleDateFormat logDate;
 -
 -    static {
 -        logDate = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
 -        logDate.setTimeZone(TimeZone.getTimeZone("GMT"));
 -    }
  
      private NodeUtils() {
      }
@@@ -235,8 -243,6 +237,8 @@@
       * Format a logging timestamp as yyyy-mm-ddThh:mm:ss.mmmZ
       */
      public static synchronized String logts(Date when) {
 +        SimpleDateFormat logDate = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
 +        logDate.setTimeZone(TimeZone.getTimeZone("GMT"));
          return (logDate.format(when));
      }
  
@@@ -257,5 -263,13 +259,13 @@@
  
      }
  
+     public static void sendResponseError(HttpServletResponse response, int errorCode, Logger intlogger) {
+         try {
+             response.sendError(errorCode);
+         } catch (IOException ioe) {
+             intlogger.error("IOException" + ioe.getMessage());
+         }
+     }
+ 
  
  }