Fix RouteServlet Vulnerabilities

Change-Id: I5a38a29ebc92118f848cc24f22fe1a46e436933d
Signed-off-by: Conor Ward <conor.ward@ericsson.com>
Issue-ID: DMAAP-775

diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/RouteServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/RouteServlet.java
index aa0d6f5..a9b22ec 100644 (file)
--- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/RouteServlet.java
+++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/RouteServlet.java
@@ -30,6 +30,7 @@ import java.util.Set;
 import javax.servlet.http.HttpServletRequest;\r
 import javax.servlet.http.HttpServletResponse;\r
 \r
+import org.json.JSONException;\r
 import org.json.JSONObject;\r
 import org.onap.dmaap.datarouter.provisioning.beans.Deleteable;\r
 import org.onap.dmaap.datarouter.provisioning.beans.EgressRoute;\r
@@ -39,6 +40,8 @@ import org.onap.dmaap.datarouter.provisioning.beans.Insertable;
 import org.onap.dmaap.datarouter.provisioning.beans.NetworkRoute;\r
 import org.onap.dmaap.datarouter.provisioning.beans.NodeClass;\r
 \r
+import static org.onap.dmaap.datarouter.provisioning.utils.HttpServletUtils.sendResponseError;\r
+\r
 /**\r
  * <p>\r
  * This servlet handles requests to URLs under /internal/route/ on the provisioning server.\r
@@ -130,17 +133,21 @@ public class RouteServlet extends ProxyServlet {
      * DELETE route table entries by deleting part of the route table tree.\r
      */\r
     @Override\r
-    public void doDelete(HttpServletRequest req, HttpServletResponse resp) throws IOException {\r
+    public void doDelete(HttpServletRequest req, HttpServletResponse resp) {\r
         EventLogRecord elr = new EventLogRecord(req);\r
         if (!isAuthorizedForInternal(req)) {\r
             elr.setMessage("Unauthorized.");\r
             elr.setResult(HttpServletResponse.SC_FORBIDDEN);\r
             eventlogger.info(elr);\r
-            resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Unauthorized.");\r
+            sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, "Unauthorized.", eventlogger);\r
             return;\r
         }\r
         if (isProxyOK(req) && isProxyServer()) {\r
-            super.doDelete(req, resp);\r
+            try {\r
+                super.doDelete(req, resp);\r
+            } catch (IOException ioe) {\r
+                eventlogger.error("IOException" + ioe.getMessage());\r
+            }\r
             return;\r
         }\r
 \r
@@ -154,12 +161,12 @@ public class RouteServlet extends ProxyServlet {
                     int feedid = Integer.parseInt(parts[1]);\r
                     IngressRoute er = IngressRoute.getIngressRoute(feedid, parts[2], parts[3].replaceAll("!", "/"));\r
                     if (er == null) {\r
-                        resp.sendError(HttpServletResponse.SC_NOT_FOUND, "The specified ingress route does not exist.");\r
+                        sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "The specified ingress route does not exist.", eventlogger);\r
                         return;\r
                     }\r
                     d = new Deleteable[] { er };\r
                 } catch (NumberFormatException e) {\r
-                    resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Invalid feed ID in 'delete ingress' command.");\r
+                    sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Invalid feed ID in 'delete ingress' command.", eventlogger);\r
                     return;\r
                 }\r
             } else if (parts.length == 2) {\r
@@ -169,11 +176,11 @@ public class RouteServlet extends ProxyServlet {
                     Set<IngressRoute> set = IngressRoute.getIngressRoutesForSeq(seq);\r
                     d = set.toArray(new Deleteable[0]);\r
                 } catch (NumberFormatException e) {\r
-                    resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Invalid sequence number in 'delete ingress' command.");\r
+                    sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Invalid sequence number in 'delete ingress' command.", eventlogger);\r
                     return;\r
                 }\r
             } else {\r
-                resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Invalid number of arguments in 'delete ingress' command.");\r
+                sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Invalid number of arguments in 'delete ingress' command.", eventlogger);\r
                 return;\r
             }\r
         } else if (parts[0].equals("egress")) {\r
@@ -183,16 +190,16 @@ public class RouteServlet extends ProxyServlet {
                     int subid = Integer.parseInt(parts[1]);\r
                     EgressRoute er = EgressRoute.getEgressRoute(subid);\r
                     if (er == null) {\r
-                        resp.sendError(HttpServletResponse.SC_NOT_FOUND, "The specified egress route does not exist.");\r
+                        sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "The specified egress route does not exist.", eventlogger);\r
                         return;\r
                     }\r
                     d = new Deleteable[] { er };\r
                 } catch (NumberFormatException e) {\r
-                    resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Invalid sub ID in 'delete egress' command.");\r
+                    sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Invalid sub ID in 'delete egress' command.", eventlogger);\r
                     return;\r
                 }\r
             } else {\r
-                resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Invalid number of arguments in 'delete egress' command.");\r
+                sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Invalid number of arguments in 'delete egress' command.", eventlogger);\r
                 return;\r
             }\r
         } else if (parts[0].equals("network")) {\r
@@ -205,16 +212,16 @@ public class RouteServlet extends ProxyServlet {
                     );\r
                     d = new Deleteable[] { nr };\r
                 } catch (IllegalArgumentException e) {\r
-                    resp.sendError(HttpServletResponse.SC_NOT_FOUND, "The specified network route does not exist.");\r
+                    sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "The specified network route does not exist.", eventlogger);\r
                     return;\r
                 }\r
             } else {\r
-                resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Invalid number of arguments in 'delete network' command.");\r
+                sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Invalid number of arguments in 'delete network' command.", eventlogger);\r
                 return;\r
             }\r
         }\r
         if (d == null) {\r
-            resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Bad URL.");\r
+            sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Bad URL.", eventlogger);\r
             return;\r
         }\r
         boolean rv = true;\r
@@ -231,24 +238,28 @@ public class RouteServlet extends ProxyServlet {
             // Something went wrong with the DELETE\r
             elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);\r
             eventlogger.info(elr);\r
-            resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG);\r
+            sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);\r
         }\r
     }\r
     /**\r
      * GET route table entries from the route table tree specified by the URL path.\r
      */\r
     @Override\r
-    public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {\r
+    public void doGet(HttpServletRequest req, HttpServletResponse resp) {\r
         EventLogRecord elr = new EventLogRecord(req);\r
         if (!isAuthorizedForInternal(req)) {\r
             elr.setMessage("Unauthorized.");\r
             elr.setResult(HttpServletResponse.SC_FORBIDDEN);\r
             eventlogger.info(elr);\r
-            resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Unauthorized.");\r
+            sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, "Unauthorized.", eventlogger);\r
             return;\r
         }\r
         if (isProxyOK(req) && isProxyServer()) {\r
-            super.doGet(req, resp);\r
+            try {\r
+                super.doGet(req, resp);\r
+            } catch (IOException ioe) {\r
+                eventlogger.error("IOException" + ioe.getMessage());\r
+            }\r
             return;\r
         }\r
 \r
@@ -256,7 +267,7 @@ public class RouteServlet extends ProxyServlet {
         if (!path.endsWith("/"))\r
             path += "/";\r
         if (!path.equals("/") && !path.equals("/ingress/") && !path.equals("/egress/") && !path.equals("/network/")) {\r
-            resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Bad URL.");\r
+            sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Bad URL.", eventlogger);\r
             return;\r
         }\r
 \r
@@ -283,7 +294,11 @@ public class RouteServlet extends ProxyServlet {
                 for (String key : jx.keySet()) {\r
                     sb.append(pfx);\r
                     sb.append("  \"").append(key).append("\": ");\r
-                    sb.append("\"").append(jx.getString(key)).append("\"");\r
+                    try {\r
+                        sb.append("\"").append(jx.getString(key)).append("\"");\r
+                    } catch (JSONException je) {\r
+                        eventlogger.error("JSONException" + je.getMessage());\r
+                    }\r
                     pfx = ",\n";\r
                 }\r
             }\r
@@ -305,38 +320,46 @@ public class RouteServlet extends ProxyServlet {
         sb.append("}\n");\r
         resp.setStatus(HttpServletResponse.SC_OK);\r
         resp.setContentType("application/json");\r
-        resp.getOutputStream().print(sb.toString());\r
+        try {\r
+            resp.getOutputStream().print(sb.toString());\r
+        } catch (IOException ioe) {\r
+            eventlogger.error("IOException" + ioe.getMessage());\r
+        }\r
     }\r
     /**\r
      * PUT on &lt;/internal/route/*&gt; -- not supported.\r
      */\r
     @Override\r
-    public void doPut(HttpServletRequest req, HttpServletResponse resp) throws IOException {\r
+    public void doPut(HttpServletRequest req, HttpServletResponse resp) {\r
         EventLogRecord elr = new EventLogRecord(req);\r
         if (!isAuthorizedForInternal(req)) {\r
             elr.setMessage("Unauthorized.");\r
             elr.setResult(HttpServletResponse.SC_FORBIDDEN);\r
             eventlogger.info(elr);\r
-            resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Unauthorized.");\r
+            sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, "Unauthorized.", eventlogger);\r
             return;\r
         }\r
-        resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Bad URL.");\r
+        sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Bad URL.", eventlogger);\r
     }\r
     /**\r
      * POST - modify existing route table entries in the route table tree specified by the URL path.\r
      */\r
     @Override\r
-    public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {\r
+    public void doPost(HttpServletRequest req, HttpServletResponse resp) {\r
         EventLogRecord elr = new EventLogRecord(req);\r
         if (!isAuthorizedForInternal(req)) {\r
             elr.setMessage("Unauthorized.");\r
             elr.setResult(HttpServletResponse.SC_FORBIDDEN);\r
             eventlogger.info(elr);\r
-            resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Unauthorized.");\r
+            sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, "Unauthorized.", eventlogger);\r
             return;\r
         }\r
         if (isProxyOK(req) && isProxyServer()) {\r
-            super.doPost(req, resp);\r
+            try {\r
+                super.doPost(req, resp);\r
+            } catch (IOException ioe) {\r
+                intlogger.error("IOException" + ioe.getMessage());\r
+            }\r
             return;\r
         }\r
         String path = req.getPathInfo();\r
@@ -358,7 +381,7 @@ public class RouteServlet extends ProxyServlet {
                 ins = new Insertable[] { new IngressRoute(seq, feedid, user, subnet, NodeClass.lookupNodeNames(nodepatt)) };\r
             } catch (Exception e) {\r
                 intlogger.info(e);\r
-                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid arguments in 'add ingress' command.");\r
+                sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid arguments in 'add ingress' command.", intlogger);\r
                 return;\r
             }\r
         } else if (path.startsWith("/egress/")) {\r
@@ -367,14 +390,14 @@ public class RouteServlet extends ProxyServlet {
                 int subid = Integer.parseInt(req.getParameter("sub"));\r
                 EgressRoute er = EgressRoute.getEgressRoute(subid);\r
                 if (er != null) {\r
-                    resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "An egress route already exists for that subscriber.");\r
+                    sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "An egress route already exists for that subscriber.", intlogger);\r
                     return;\r
                 }\r
                 String node = NodeClass.normalizeNodename(req.getParameter("node"));\r
                 ins = new Insertable[] { new EgressRoute(subid, node) };\r
             } catch (Exception e) {\r
                 intlogger.info(e);\r
-                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid arguments in 'add egress' command.");\r
+                sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid arguments in 'add egress' command.", intlogger);\r
                 return;\r
             }\r
         } else if (path.startsWith("/network/")) {\r
@@ -384,7 +407,7 @@ public class RouteServlet extends ProxyServlet {
                 String nto   = req.getParameter("to");\r
                 String nvia  = req.getParameter("via");\r
                 if (nfrom == null || nto == null || nvia == null) {\r
-                    resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Missing arguments in 'add network' command.");\r
+                    sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "Missing arguments in 'add network' command.", intlogger);\r
                     return;\r
                 }\r
                 nfrom = NodeClass.normalizeNodename(nfrom);\r
@@ -393,19 +416,19 @@ public class RouteServlet extends ProxyServlet {
                 NetworkRoute nr = new NetworkRoute(nfrom, nto, nvia);\r
                 for (NetworkRoute route : NetworkRoute.getAllNetworkRoutes()) {\r
                     if (route.getFromnode() == nr.getFromnode() && route.getTonode() == nr.getTonode()) {\r
-                        resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Network route table already contains a route for "+nfrom+" and "+nto);\r
+                        sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "Network route table already contains a route for " + nfrom + " and " + nto, intlogger);\r
                         return;\r
                     }\r
                 }\r
                 ins = new Insertable[] { nr };\r
             } catch (IllegalArgumentException e) {\r
                 intlogger.info(e);\r
-                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid arguments in 'add network' command.");\r
+                sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid arguments in 'add network' command.", intlogger);\r
                 return;\r
             }\r
         }\r
         if (ins == null) {\r
-            resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Bad URL.");\r
+            sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, "Bad URL.", intlogger);\r
             return;\r
         }\r
         boolean rv = true;\r
@@ -422,7 +445,7 @@ public class RouteServlet extends ProxyServlet {
             // Something went wrong with the INSERT\r
             elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);\r
             eventlogger.info(elr);\r
-            resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG);\r
+            sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, intlogger);\r
         }\r
     }\r
 }\r