Fix LogServlet Vulnerabilities

Change-Id: Ifcd5f535e1f554e0d6cd0a154ca59239806fa363
Signed-off-by: Conor Ward <conor.ward@ericsson.com>
Issue-ID: DMAAP-775

diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/LogServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/LogServlet.java
index 101c9e6..cdc2331 100644 (file)
--- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/LogServlet.java
+++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/LogServlet.java
@@ -39,7 +39,6 @@ import javax.servlet.ServletOutputStream;
 import javax.servlet.http.HttpServletRequest;\r
 import javax.servlet.http.HttpServletResponse;\r
 \r
-import org.apache.log4j.Logger;\r
 import org.onap.dmaap.datarouter.provisioning.beans.DeliveryRecord;\r
 import org.onap.dmaap.datarouter.provisioning.beans.EventLogRecord;\r
 import org.onap.dmaap.datarouter.provisioning.beans.ExpiryRecord;\r
@@ -53,6 +52,8 @@ import org.onap.dmaap.datarouter.provisioning.utils.LOGJSONObject;
 import com.att.eelf.configuration.EELFLogger;\r
 import com.att.eelf.configuration.EELFManager;\r
 \r
+import static org.onap.dmaap.datarouter.provisioning.utils.HttpServletUtils.sendResponseError;\r
+\r
 /**\r
  * This servlet handles requests to the <feedLogURL> and  <subLogURL>,\r
  * which are generated by the provisioning server to handle the log query API.\r
@@ -65,8 +66,8 @@ public class LogServlet extends BaseServlet {
     //Adding EELF Logger Rally:US664892\r
     private static EELFLogger eelflogger = EELFManager.getInstance().getLogger("org.onap.dmaap.datarouter.provisioning.LogServlet");\r
     private static final long TWENTYFOUR_HOURS = (24 * 60 * 60 * 1000L);\r
-    private static final String fmt1 = "yyyy-MM-dd'T'HH:mm:ss'Z'";\r
-    private static final String fmt2 = "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";\r
+    private static final String FMT_1 = "yyyy-MM-dd'T'HH:mm:ss'Z'";\r
+    private static final String FMT_2 = "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";\r
 \r
     private static  boolean isfeedlog;\r
 \r
@@ -145,7 +146,7 @@ public class LogServlet extends BaseServlet {
      * DELETE a logging URL -- not supported.\r
      */\r
     @Override\r
-    public void doDelete(HttpServletRequest req, HttpServletResponse resp) throws IOException {\r
+    public void doDelete(HttpServletRequest req, HttpServletResponse resp) {\r
         setIpAndFqdnForEelf("doDelete");\r
         eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(BEHALF_HEADER),getIdFromPath(req)+"");\r
         String message = "DELETE not allowed for the logURL.";\r
@@ -153,76 +154,79 @@ public class LogServlet extends BaseServlet {
         elr.setMessage(message);\r
         elr.setResult(HttpServletResponse.SC_METHOD_NOT_ALLOWED);\r
         eventlogger.info(elr);\r
-        resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, message);\r
+        sendResponseError(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, message, eventlogger);\r
     }\r
     /**\r
      * GET a logging URL -- retrieve logging data for a feed or subscription.\r
      * See the <b>Logging API</b> document for details on how this method should be invoked.\r
      */\r
     @Override\r
-    public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {\r
+    public void doGet(HttpServletRequest req, HttpServletResponse resp) {\r
         setIpAndFqdnForEelf("doGet");\r
         eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(BEHALF_HEADER),getIdFromPath(req)+"");\r
         int id = getIdFromPath(req);\r
         if (id < 0) {\r
-            resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Missing or bad feed/subscription number.");\r
+            sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "Missing or bad feed/subscription number.", eventlogger);\r
             return;\r
         }\r
         Map<String, String> map = buildMapFromRequest(req);\r
         if (map.get("err") != null) {\r
-            resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid arguments: "+map.get("err"));\r
+            sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid arguments: "+map.get("err"), eventlogger);\r
             return;\r
         }\r
         // check Accept: header??\r
 \r
         resp.setStatus(HttpServletResponse.SC_OK);\r
         resp.setContentType(LOGLIST_CONTENT_TYPE);\r
-        @SuppressWarnings("resource")\r
-        ServletOutputStream out = resp.getOutputStream();\r
-        final String fields = req.getParameter("fields");\r
 \r
-        out.print("[");\r
-        if (isfeedlog) {\r
-            // Handle /feedlog/feedid request\r
-            boolean firstrow = true;\r
+        try (ServletOutputStream out = resp.getOutputStream()) {\r
+            final String fields = req.getParameter("fields");\r
+\r
+            out.print("[");\r
+            if (isfeedlog) {\r
+                // Handle /feedlog/feedid request\r
+                boolean firstrow = true;\r
 \r
-            // 1. Collect publish records for this feed\r
-            RowHandler rh = new PublishRecordRowHandler(out, fields, firstrow);\r
-            getPublishRecordsForFeed(id, rh, map);\r
-            firstrow = rh.firstrow;\r
+                // 1. Collect publish records for this feed\r
+                RowHandler rh = new PublishRecordRowHandler(out, fields, firstrow);\r
+                getPublishRecordsForFeed(id, rh, map);\r
+                firstrow = rh.firstrow;\r
 \r
-            // 2. Collect delivery records for subscriptions to this feed\r
-            rh = new DeliveryRecordRowHandler(out, fields, firstrow);\r
-            getDeliveryRecordsForFeed(id, rh, map);\r
-            firstrow = rh.firstrow;\r
+                // 2. Collect delivery records for subscriptions to this feed\r
+                rh = new DeliveryRecordRowHandler(out, fields, firstrow);\r
+                getDeliveryRecordsForFeed(id, rh, map);\r
+                firstrow = rh.firstrow;\r
 \r
-            // 3. Collect expiry records for subscriptions to this feed\r
-            rh = new ExpiryRecordRowHandler(out, fields, firstrow);\r
-            getExpiryRecordsForFeed(id, rh, map);\r
-        } else {\r
-            // Handle /sublog/subid request\r
-            Subscription sub = Subscription.getSubscriptionById(id);\r
-            if (sub != null) {\r
-                // 1. Collect publish records for the feed this subscription feeds\r
-                RowHandler rh = new PublishRecordRowHandler(out, fields, true);\r
-                getPublishRecordsForFeed(sub.getFeedid(), rh, map);\r
+                // 3. Collect expiry records for subscriptions to this feed\r
+                rh = new ExpiryRecordRowHandler(out, fields, firstrow);\r
+                getExpiryRecordsForFeed(id, rh, map);\r
+            } else {\r
+                // Handle /sublog/subid request\r
+                Subscription sub = Subscription.getSubscriptionById(id);\r
+                if (sub != null) {\r
+                    // 1. Collect publish records for the feed this subscription feeds\r
+                    RowHandler rh = new PublishRecordRowHandler(out, fields, true);\r
+                    getPublishRecordsForFeed(sub.getFeedid(), rh, map);\r
 \r
-                // 2. Collect delivery records for this subscription\r
-                rh = new DeliveryRecordRowHandler(out, fields, rh.firstrow);\r
-                getDeliveryRecordsForSubscription(id, rh, map);\r
+                    // 2. Collect delivery records for this subscription\r
+                    rh = new DeliveryRecordRowHandler(out, fields, rh.firstrow);\r
+                    getDeliveryRecordsForSubscription(id, rh, map);\r
 \r
-                // 3. Collect expiry records for this subscription\r
-                rh = new ExpiryRecordRowHandler(out, fields, rh.firstrow);\r
-                getExpiryRecordsForSubscription(id, rh, map);\r
+                    // 3. Collect expiry records for this subscription\r
+                    rh = new ExpiryRecordRowHandler(out, fields, rh.firstrow);\r
+                    getExpiryRecordsForSubscription(id, rh, map);\r
+                }\r
             }\r
+            out.print("]");\r
+        } catch (IOException ioe) {\r
+            eventlogger.error("IOException: " + ioe.getMessage());\r
         }\r
-        out.print("\n]");\r
     }\r
     /**\r
      * PUT a logging URL -- not supported.\r
      */\r
     @Override\r
-    public void doPut(HttpServletRequest req, HttpServletResponse resp) throws IOException {\r
+    public void doPut(HttpServletRequest req, HttpServletResponse resp) {\r
         setIpAndFqdnForEelf("doPut");\r
         eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(BEHALF_HEADER),getIdFromPath(req)+"");\r
         String message = "PUT not allowed for the logURL.";\r
@@ -230,13 +234,13 @@ public class LogServlet extends BaseServlet {
         elr.setMessage(message);\r
         elr.setResult(HttpServletResponse.SC_METHOD_NOT_ALLOWED);\r
         eventlogger.info(elr);\r
-        resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, message);\r
+        sendResponseError(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, message, eventlogger);\r
     }\r
     /**\r
      * POST a logging URL -- not supported.\r
      */\r
     @Override\r
-    public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {\r
+    public void doPost(HttpServletRequest req, HttpServletResponse resp) {\r
         setIpAndFqdnForEelf("doPost");\r
         eelflogger.info(EelfMsgs.MESSAGE_WITH_BEHALF, req.getHeader(BEHALF_HEADER));\r
         String message = "POST not allowed for the logURL.";\r
@@ -244,11 +248,11 @@ public class LogServlet extends BaseServlet {
         elr.setMessage(message);\r
         elr.setResult(HttpServletResponse.SC_METHOD_NOT_ALLOWED);\r
         eventlogger.info(elr);\r
-        resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, message);\r
+        sendResponseError(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, message, eventlogger);\r
     }\r
 \r
     private Map<String, String> buildMapFromRequest(HttpServletRequest req) {\r
-        Map<String, String> map = new HashMap<String, String>();\r
+        Map<String, String> map = new HashMap<>();\r
         String s = req.getParameter("type");\r
         if (s != null) {\r
             if (s.equals("pub") || s.equals("del") || s.equals("exp")) {\r
@@ -341,7 +345,7 @@ public class LogServlet extends BaseServlet {
             return 0;\r
         try {\r
             // First, look for an RFC 3339 date\r
-            String fmt = (s.indexOf('.') > 0) ? fmt2 : fmt1;\r
+            String fmt = (s.indexOf('.') > 0) ? FMT_2 : FMT_1;\r
             SimpleDateFormat sdf = new SimpleDateFormat(fmt);\r
             Date d = sdf.parse(s);\r
             return d.getTime();\r