Security issues fixes

Issue-ID: DMAAP-207
Change-Id: I8c95f2647676fc4c2e754bdc280b97886f53403f
Signed-off-by: Sunil Unnava <su622b@att.com>

diff --git a/.project b/.project
index 885141a..13ca257 100644 (file)
--- a/.project
+++ b/.project
@@ -10,13 +10,30 @@
                        <arguments>\r
                        </arguments>\r
                </buildCommand>\r
+               <buildCommand>\r
+                       <name>net.sf.eclipsecs.core.CheckstyleBuilder</name>\r
+                       <arguments>\r
+                       </arguments>\r
+               </buildCommand>\r
                <buildCommand>\r
                        <name>org.eclipse.m2e.core.maven2Builder</name>\r
                        <arguments>\r
                        </arguments>\r
                </buildCommand>\r
+               <buildCommand>\r
+                       <name>org.springframework.ide.eclipse.core.springbuilder</name>\r
+                       <arguments>\r
+                       </arguments>\r
+               </buildCommand>\r
+               <buildCommand>\r
+                       <name>org.springframework.ide.eclipse.boot.validation.springbootbuilder</name>\r
+                       <arguments>\r
+                       </arguments>\r
+               </buildCommand>\r
        </buildSpec>\r
        <natures>\r
+               <nature>org.springframework.ide.eclipse.core.springnature</nature>\r
+               <nature>net.sf.eclipsecs.core.CheckstyleNature</nature>\r
                <nature>org.eclipse.jdt.core.javanature</nature>\r
                <nature>org.eclipse.m2e.core.maven2Nature</nature>\r
        </natures>\r

diff --git a/pom.xml b/pom.xml
index 90ae0fe..2630493 100644 (file)
--- a/pom.xml
+++ b/pom.xml
@@ -24,7 +24,7 @@
        <modelVersion>4.0.0</modelVersion>
        <groupId>org.onap.dmaap.messagerouter.msgrtr</groupId>
        <artifactId>msgrtr</artifactId>
-       <version>1.1.0-SNAPSHOT</version>
+       <version>1.1.1-SNAPSHOT</version>
        <packaging>jar</packaging>
        <name>dmaap-messagerouter-msgrtr</name>
        <description>Message Router - Restful interface built for kafka</description>
@@ -36,7 +36,7 @@
        </parent>
        
        <properties>
-               <spring.version>3.2.14.RELEASE</spring.version>
+               <spring.version>3.2.15.RELEASE</spring.version>
                <cxf.version>3.0.4</cxf.version>
                <jstl.version>1.2</jstl.version>
                <maven.compiler.target>1.7</maven.compiler.target>
@@ -90,13 +90,62 @@
         </developers>
 
        <dependencies>
-
+       <dependency>
+               <groupId>commons-collections</groupId>
+               <artifactId>commons-collections</artifactId>
+               <version>3.2.2</version>
+       </dependency>
+       <dependency>
+               <groupId>ch.qos.logback</groupId>
+               <artifactId>logback-core</artifactId>
+               <version>1.2.0</version>
+       </dependency>
+       <dependency>
+               <groupId>ch.qos.logback</groupId>
+               <artifactId>logback-classic</artifactId>
+               <version>1.2.0</version>
+       </dependency>
+       <dependency>
+               <groupId>commons-beanutils</groupId>
+               <artifactId>commons-beanutils</artifactId>
+               <version>1.9.2</version>
+               <exclusions>
+                       <!-- We have JCL-over-SLF4J instead. -->
+                       <exclusion>
+                               <groupId>commons-logging</groupId>
+                               <artifactId>commons-logging</artifactId>
+                       </exclusion>
+               </exclusions>
+       </dependency>
+       <dependency>
+               <groupId>org.codehaus.groovy</groupId>
+               <artifactId>groovy-all</artifactId>
+               <version>2.4.4</version>
+               <scope>compile</scope>
+               <exclusions>
+                       <exclusion>
+                               <artifactId>jline</artifactId>
+                               <groupId>jline</groupId>
+                       </exclusion>
+               </exclusions>
+       </dependency>
+       <dependency>
+               <groupId>commons-fileupload</groupId>
+               <artifactId>commons-fileupload</artifactId>
+               <version>1.3.3</version>
+       </dependency>
+    
                <dependency>
                        <groupId>junit</groupId>
                        <artifactId>junit</artifactId>
                        <version>4.11</version>
                        <scope>test</scope>
                </dependency>
+               <dependency>
+                       <groupId>com.att.aft</groupId>
+                       <artifactId>dme2</artifactId>
+                       <version>3.1.200-oss</version>
+                       </dependency>
 
                <!-- slf4j logger -->
                <dependency>
@@ -233,15 +282,21 @@
                        </exclusions>
                </dependency>
                <dependency>
-                       <groupId>org.apache.httpcomponents</groupId>
-                                       <artifactId>httpclient</artifactId>
-                                       <version>4.4.1</version>
-               </dependency>
-               <dependency>
-                       <groupId>org.apache.httpcomponents</groupId>
-                                       <artifactId>httpclient-cache</artifactId>
-                                       <version>4.4.1</version>
-               </dependency>
+       <groupId>org.apache.httpcomponents</groupId>
+       <artifactId>httpclient</artifactId>
+       <version>4.5.3</version>
+</dependency>
+       <dependency>
+               <groupId>org.apache.httpcomponents</groupId>
+               <artifactId>httpclient-cache</artifactId>
+               <version>4.5.3</version>
+       </dependency>
+       <dependency>
+               <groupId>org.apache.httpcomponents</groupId>
+               <artifactId>httpcore</artifactId>
+               <version>4.4.1</version>
+       </dependency>
+               
                
                <!-- explicit jline add b/c it conflicts with the zk client -->
                <dependency>
@@ -262,24 +317,12 @@
                        <version>2.6.0</version>
                </dependency>
 
-               <dependency>
-                       <groupId>com.att.aft</groupId>
-                       <artifactId>dme2</artifactId>
-                       <version>3.1.200</version>
-               </dependency>
 
        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.8.0</version>
        </dependency>
-               <dependency>
-                       <groupId>org.mockito</groupId>
-                       <artifactId>mockito-all</artifactId>
-                       <version>1.9.5</version>
-                       <scope>test</scope>
-               </dependency>
-
 
                <dependency>
                        <groupId>com.fasterxml.jackson.core</groupId>

diff --git a/src/test/java/com/att/nsa/cambria/service/impl/AdminServiceImplemTest.java b/src/test/java/com/att/nsa/cambria/service/impl/AdminServiceImplemTest.java
index b2db07e..df486d5 100644 (file)
--- a/src/test/java/com/att/nsa/cambria/service/impl/AdminServiceImplemTest.java
+++ b/src/test/java/com/att/nsa/cambria/service/impl/AdminServiceImplemTest.java
@@ -25,23 +25,51 @@ package com.att.nsa.cambria.service.impl;
 import static org.junit.Assert.*;\r
 \r
 import java.io.IOException;\r
+import java.util.Date;\r
 \r
 import com.att.nsa.cambria.beans.DMaaPContext;\r
+import com.att.nsa.cambria.embed.EmbedConfigurationReader;\r
+import com.att.nsa.cambria.utils.ConfigurationReader;\r
 import com.att.nsa.configs.ConfigDbException;\r
+import com.att.nsa.drumlin.till.data.sha1HmacSigner;\r
 import com.att.nsa.security.ReadWriteSecuredResource.AccessDeniedException;\r
 \r
-import org.junit.After;\r
-import org.junit.Before;\r
+import org.junit.AfterClass;\r
+import org.junit.BeforeClass;\r
 import org.junit.Test;\r
+import org.springframework.mock.web.MockHttpServletRequest;\r
+import org.springframework.mock.web.MockHttpServletResponse;\r
 \r
 public class AdminServiceImplemTest {\r
+       \r
+       private static  DMaaPContext context = new DMaaPContext();\r
+       \r
+       private static EmbedConfigurationReader embedConfigurationReader = new EmbedConfigurationReader();\r
+\r
+       @BeforeClass\r
+       public static void setUp() throws Exception {\r
+\r
+               final long nowMs = System.currentTimeMillis();\r
+               Date date = new Date(nowMs + 10000);\r
+\r
+               final String serverCalculatedSignature = sha1HmacSigner.sign(date.toString(), "password");\r
+               MockHttpServletRequest request = new MockHttpServletRequest();\r
+               request.addHeader("X-Auth", "admin:" + serverCalculatedSignature);\r
+\r
+               //NsaSimpleApiKey apiKey = new NsaSimpleApiKey("admin", "password");\r
+       //      PowerMockito.when(baseNsaApiDbImpl.loadApiKey("b/7ouTn9FfEw2PQwL0ov/Q==")).thenReturn(apiKey);\r
 \r
-       @Before\r
-       public void setUp() throws Exception {\r
+               request.addHeader("X-Date", date);\r
+               request.addHeader("Date", date);\r
+               MockHttpServletResponse response = new MockHttpServletResponse();\r
+               context.setRequest(request);\r
+               context.setResponse(response);\r
+               context.setConfigReader(embedConfigurationReader.buildConfigurationReader());\r
        }\r
 \r
-       @After\r
-       public void tearDown() throws Exception {\r
+       @AfterClass\r
+       public static void tearDown() throws Exception {\r
+               embedConfigurationReader.tearDown();\r
        }\r
 \r
        \r
@@ -51,7 +79,7 @@ public class AdminServiceImplemTest {
                \r
                AdminServiceImpl adminServiceImpl = new AdminServiceImpl();\r
                try {\r
-                       adminServiceImpl.showConsumerCache(new DMaaPContext());\r
+                       adminServiceImpl.showConsumerCache(context);\r
                } catch (IOException | AccessDeniedException e) {\r
                        // TODO Auto-generated catch block\r
                        e.printStackTrace();\r
@@ -73,7 +101,7 @@ public class AdminServiceImplemTest {
                \r
                AdminServiceImpl adminServiceImpl = new AdminServiceImpl();\r
                try {\r
-                       adminServiceImpl.dropConsumerCache(new DMaaPContext());\r
+                       adminServiceImpl.dropConsumerCache(context);\r
                } catch (IOException | AccessDeniedException e) {\r
                        // TODO Auto-generated catch block\r
                        e.printStackTrace();\r
@@ -95,7 +123,7 @@ public class AdminServiceImplemTest {
                \r
                AdminServiceImpl adminServiceImpl = new AdminServiceImpl();\r
                try {\r
-                       adminServiceImpl.getBlacklist(new DMaaPContext());\r
+                       adminServiceImpl.getBlacklist(context);\r
                } catch (IOException | AccessDeniedException e) {\r
                        // TODO Auto-generated catch block\r
                        e.printStackTrace();\r
@@ -117,7 +145,7 @@ public class AdminServiceImplemTest {
                \r
                AdminServiceImpl adminServiceImpl = new AdminServiceImpl();\r
                try {\r
-                       adminServiceImpl.addToBlacklist(new DMaaPContext(), "120.120.120.120");\r
+                       adminServiceImpl.addToBlacklist(context, "120.120.120.120");\r
                } catch (IOException | AccessDeniedException | ConfigDbException e) {\r
                        // TODO Auto-generated catch block\r
                        e.printStackTrace();\r
@@ -139,7 +167,7 @@ public class AdminServiceImplemTest {
                \r
                AdminServiceImpl adminServiceImpl = new AdminServiceImpl();\r
                try {\r
-                       adminServiceImpl.addToBlacklist(new DMaaPContext(), "120.120.120.120");\r
+                       adminServiceImpl.addToBlacklist(context, "120.120.120.120");\r
                } catch (IOException | AccessDeniedException | ConfigDbException e) {\r
                        // TODO Auto-generated catch block\r
                        e.printStackTrace();\r

diff --git a/version.properties b/version.properties
index d6e413c..e1118ab 100644 (file)
--- a/version.properties
+++ b/version.properties
@@ -27,7 +27,7 @@
 
 major=1
 minor=1
-patch=0
+patch=1
 
 base_version=${major}.${minor}.${patch}