Merge "Tried to Fix Some Vulnerability Issues"
authortang peng <tang.peng5@zte.com.cn>
Fri, 14 Aug 2020 02:50:12 +0000 (02:50 +0000)
committerGerrit Code Review <gerrit@onap.org>
Fri, 14 Aug 2020 02:50:12 +0000 (02:50 +0000)
pom.xml
rulemgt-standalone/src/main/assembly/bin/run.sh
rulemgt-standalone/src/main/assembly/conf/rulemgt.yml
rulemgt/src/main/java/org/onap/holmes/rulemgt/RuleActiveApp.java
rulemgt/src/main/java/org/onap/holmes/rulemgt/msb/MsbQuery.java
rulemgt/src/main/java/org/onap/holmes/rulemgt/resources/RuleMgtResources.java
rulemgt/src/test/java/org/onap/holmes/rulemgt/bolt/enginebolt/EngineServiceTest.java
rulemgt/src/test/java/org/onap/holmes/rulemgt/bolt/enginebolt/EngineWrapperTest.java
rulemgt/src/test/java/org/onap/holmes/rulemgt/wrapper/RuleMgtWrapperTest.java

diff --git a/pom.xml b/pom.xml
index 07b5f60..cb7bf34 100644 (file)
--- a/pom.xml
+++ b/pom.xml
@@ -14,7 +14,8 @@
   ~ See the License for the specific language governing permissions and\r
   ~ limitations under the License.\r
   -->\r
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">\r
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"\r
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">\r
     <modelVersion>4.0.0</modelVersion>\r
     <parent>\r
         <groupId>org.onap.oparent</groupId>\r
@@ -45,8 +46,8 @@
         <bundle.name>${project.artifactId}-${project.version}</bundle.name>\r
 \r
         <powermock.version>2.0.7</powermock.version>\r
-        <dropwizard.version>2.0.9</dropwizard.version>\r
-        <jersey.version>2.30.1</jersey.version>\r
+        <dropwizard.version>2.0.10</dropwizard.version>\r
+        <jersey.version>2.31</jersey.version>\r
         <jacoco.version>0.8.5</jacoco.version>\r
         <slf4j.version>1.7.25</slf4j.version>\r
 \r
         </sonar.coverage.jacoco.xmlReportPaths>\r
     </properties>\r
 \r
+    <dependencyManagement>\r
+        <dependencies>\r
+            <dependency>\r
+                <groupId>org.glassfish.jersey</groupId>\r
+                <artifactId>jersey-bom</artifactId>\r
+                <version>${jersey.version}</version>\r
+                <type>pom</type>\r
+                <scope>import</scope>\r
+            </dependency>\r
+        </dependencies>\r
+    </dependencyManagement>\r
+\r
     <dependencies>\r
         <dependency>\r
             <groupId>ch.qos.logback</groupId>\r
                     <groupId>org.eclipse.jetty</groupId>\r
                     <artifactId>jetty-server</artifactId>\r
                 </exclusion>\r
+                <exclusion>\r
+                    <groupId>org.checkerframework</groupId>\r
+                    <artifactId>checker-qual</artifactId>\r
+                </exclusion>\r
             </exclusions>\r
         </dependency>\r
         <dependency>\r
         <dependency>\r
             <groupId>org.onap.holmes.common</groupId>\r
             <artifactId>holmes-actions</artifactId>\r
-            <version>1.2.13</version>\r
+            <version>1.3.0</version>\r
             <exclusions>\r
                 <exclusion>\r
                     <groupId>org.glassfish.jersey.containers</groupId>\r
         <dependency>\r
             <groupId>org.postgresql</groupId>\r
             <artifactId>postgresql</artifactId>\r
-            <version>42.2.5</version>\r
+            <version>42.2.13</version>\r
         </dependency>\r
         <dependency>\r
             <groupId>junit</groupId>\r
         <dependency>\r
             <groupId>io.swagger</groupId>\r
             <artifactId>swagger-jersey2-jaxrs</artifactId>\r
-            <version>1.5.3</version>\r
+            <version>1.6.1</version>\r
             <exclusions>\r
                 <exclusion>\r
                     <groupId>com.fasterxml.jackson.core</groupId>\r
                     <groupId>org.glassfish.jersey.containers</groupId>\r
                     <artifactId>jersey-container-servlet-core</artifactId>\r
                 </exclusion>\r
+                <exclusion>\r
+                    <groupId>com.fasterxml.jackson.jaxrs</groupId>\r
+                    <artifactId>jackson-jaxrs-json-provider</artifactId>\r
+                </exclusion>\r
+                <exclusion>\r
+                    <groupId>com.fasterxml.jackson.jaxrs</groupId>\r
+                    <artifactId>jackson-datatype-joda</artifactId>\r
+                </exclusion>\r
             </exclusions>\r
             <scope>provided</scope>\r
         </dependency>\r
         <dependency>\r
             <groupId>org.glassfish.jersey.core</groupId>\r
             <artifactId>jersey-server</artifactId>\r
-            <version>${jersey.version}</version>\r
             <exclusions>\r
                 <exclusion>\r
                     <groupId>javax.validation</groupId>\r
         <dependency>\r
             <groupId>org.glassfish.jersey.core</groupId>\r
             <artifactId>jersey-client</artifactId>\r
-            <version>${jersey.version}</version>\r
         </dependency>\r
         <dependency>\r
             <groupId>org.glassfish.jersey.core</groupId>\r
             <artifactId>jersey-common</artifactId>\r
-            <version>${jersey.version}</version>\r
+        </dependency>\r
+        <dependency>\r
+            <groupId>javax.annotation</groupId>\r
+            <artifactId>javax.annotation-api</artifactId>\r
+            <version>1.3.2</version>\r
+        </dependency>\r
+        <dependency>\r
+            <groupId>javax.xml.bind</groupId>\r
+            <artifactId>jaxb-api</artifactId>\r
+            <version>2.4.0-b180725.0427</version>\r
+        </dependency>\r
+        <dependency>\r
+            <groupId>org.glassfish.jaxb</groupId>\r
+            <artifactId>jaxb-runtime</artifactId>\r
+            <version>2.4.0-b180725.0644</version>\r
         </dependency>\r
     </dependencies>\r
 \r
     <build>\r
         <plugins>\r
+            <plugin>\r
+                <groupId>org.apache.maven.plugins</groupId>\r
+                <artifactId>maven-compiler-plugin</artifactId>\r
+                <version>3.8.0</version>\r
+                <configuration>\r
+                    <release>11</release>\r
+                </configuration>\r
+            </plugin>\r
+<!--            <plugin>-->\r
+<!--                <groupId>org.apache.maven.plugins</groupId>-->\r
+<!--                <artifactId>maven-enforcer-plugin</artifactId>-->\r
+<!--                <version>1.4.1</version>-->\r
+<!--                <executions>-->\r
+<!--                    <execution>-->\r
+<!--                        <id>enforce</id>-->\r
+<!--                        <configuration>-->\r
+<!--                            <rules>-->\r
+<!--                                <dependencyConvergence/>-->\r
+<!--                            </rules>-->\r
+<!--                        </configuration>-->\r
+<!--                        <goals>-->\r
+<!--                            <goal>enforce</goal>-->\r
+<!--                        </goals>-->\r
+<!--                    </execution>-->\r
+<!--                </executions>-->\r
+<!--            </plugin>-->\r
             <plugin>\r
                 <groupId>org.jacoco</groupId>\r
                 <artifactId>jacoco-maven-plugin</artifactId>\r
index fbc7e21..85e7fcc 100644 (file)
@@ -25,7 +25,7 @@ JAVA="$JAVA_HOME/bin/java"
 echo @JAVA@ $JAVA
 main_path=$RUNHOME/..
 cd $main_path
-JAVA_OPTS="-Xms50m -Xmx128m"
+JAVA_OPTS="-Xms256m -Xmx1g"
 port=9201
 #JAVA_OPTS="$JAVA_OPTS -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,address=*:$port,server=y,suspend=n"
 echo @JAVA_OPTS@ $JAVA_OPTS
index 26a94e8..ca857a1 100644 (file)
@@ -15,7 +15,7 @@ server:
   connector:
     type: https
     port: 9101
-    keyStorePath: /home/holmes/conf/holmes.keystore
+    keyStorePath: /opt/onap/conf/holmes.keystore
     keyStorePassword: holmes
     validateCerts: false
     validatePeers: false
index 21855f8..c839b5a 100644 (file)
@@ -51,7 +51,6 @@ public class RuleActiveApp extends IOCApplication<RuleAppConfig> {
     public void run(RuleAppConfig configuration, Environment environment) throws Exception {
         super.run(configuration, environment);
 
-        environment.jersey().register(new RuleMgtResources());
         try {
             new MSBRegisterUtil().register2Msb(createMicroServiceInfo());
         } catch (CorrelationException e) {
index 51ed0f2..df0783d 100644 (file)
@@ -1,5 +1,5 @@
 /**
- * Copyright 2017 ZTE Corporation.
+ * Copyright 2017-2020 ZTE Corporation.
  * <p>
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  */
 package org.onap.holmes.rulemgt.msb;
 
-import lombok.extern.slf4j.Slf4j;
-import org.glassfish.hk2.api.ServiceLocator;
 import org.onap.holmes.common.dropwizard.ioc.utils.ServiceLocatorHolder;
-import org.onap.holmes.rulemgt.send.RuleAllocator;
 import org.onap.holmes.rulemgt.send.Ip4AddingRule;
-import org.onap.holmes.rulemgt.wrapper.RuleMgtWrapper;
+import org.onap.holmes.rulemgt.send.RuleAllocator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.util.List;
 import java.util.Timer;
 import java.util.TimerTask;
 
+import static java.util.concurrent.TimeUnit.SECONDS;
 
-@Slf4j
 public class MsbQuery {
 
-    private RuleAllocator ruleAllocator;
-
+    static final private Logger log = LoggerFactory.getLogger(MsbQuery.class);
+    final private RuleAllocator ruleAllocator;
     private Ip4AddingRule ip4AddingRule;
-
     private EngineInsQueryTool engineInsQueryTool;
 
-    private RuleMgtWrapper ruleMgtWrapper;
-
-    private List<String> timerIpList;
-
     public MsbQuery() {
         ruleAllocator = new RuleAllocator();
-
-        ServiceLocator locator = ServiceLocatorHolder.getLocator();
-        ip4AddingRule = locator.getService(Ip4AddingRule.class);
-        engineInsQueryTool = locator.getService(EngineInsQueryTool.class);
-        ruleMgtWrapper = locator.getService(RuleMgtWrapper.class);
+        ip4AddingRule = ServiceLocatorHolder.getLocator().getService(Ip4AddingRule.class);
+        engineInsQueryTool = ServiceLocatorHolder.getLocator().getService(EngineInsQueryTool.class);
     }
 
     public void startTimer() {
         try {
-            timer();
+            new Timer().schedule(new TimerTask() {
+
+                public void run() {
+                    try {
+                        List<String> timerIpList = engineInsQueryTool.getInstanceList();
+                        log.info(String.format("There are %d engine instance(s) running currently.", timerIpList.size()));
+
+                        ip4AddingRule.setIpList(timerIpList);
+                        ruleAllocator.allocateRules(timerIpList);
+                    } catch (Exception e) {
+                        log.error("The timing query engine instance failed ", e);
+                    }
+                }
+
+            }, SECONDS.toMillis(10), SECONDS.toMillis(30));
         } catch (Exception e) {
             log.error("MSBQuery startTimer timer task failed !" + e.getMessage(), e);
             try {
-                Thread.sleep(30000);
+                SECONDS.sleep(30);
             } catch (InterruptedException e1) {
                 Thread.currentThread().interrupt();
             }
         }
-
-
-    }
-
-    public void timer() throws Exception {
-        Timer timer = new Timer();
-        timer.schedule(new TimerTask() {
-
-            public void run() {
-                try {
-                    timerIpList = engineInsQueryTool.getInstanceList();
-                    log.info(String.format("There are %d engine instance(s) running currently.", timerIpList.size()));
-
-                    ip4AddingRule.setIpList(timerIpList);
-                    ruleAllocator.allocateRules(timerIpList);
-                } catch (Exception e) {
-                    log.error("The timing query engine instance failed ", e);
-                }
-            }
-
-        }, 10000, 30000);
-
     }
-
 }
index 8e5b7a0..445c2f9 100644 (file)
@@ -1,5 +1,5 @@
 /**\r
- * Copyright 2017 ZTE Corporation.\r
+ * Copyright 2017-2020 ZTE Corporation.\r
  *\r
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except\r
  * in compliance with the License. You may obtain a copy of the License at\r
@@ -18,19 +18,6 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;\r
 import io.swagger.annotations.ApiParam;\r
 import io.swagger.annotations.SwaggerDefinition;\r
-import java.util.Locale;\r
-import javax.inject.Inject;\r
-import javax.servlet.http.HttpServletRequest;\r
-import javax.ws.rs.DELETE;\r
-import javax.ws.rs.GET;\r
-import javax.ws.rs.POST;\r
-import javax.ws.rs.PUT;\r
-import javax.ws.rs.Path;\r
-import javax.ws.rs.PathParam;\r
-import javax.ws.rs.Produces;\r
-import javax.ws.rs.QueryParam;\r
-import javax.ws.rs.core.Context;\r
-import javax.ws.rs.core.MediaType;\r
 import lombok.extern.slf4j.Slf4j;\r
 import org.jvnet.hk2.annotations.Service;\r
 import org.onap.holmes.common.exception.CorrelationException;\r
@@ -47,6 +34,13 @@ import org.onap.holmes.rulemgt.bean.response.RuleQueryListResponse;
 import org.onap.holmes.rulemgt.constant.RuleMgtConstant;\r
 import org.onap.holmes.rulemgt.wrapper.RuleMgtWrapper;\r
 \r
+import javax.inject.Inject;\r
+import javax.servlet.http.HttpServletRequest;\r
+import javax.ws.rs.*;\r
+import javax.ws.rs.core.Context;\r
+import javax.ws.rs.core.MediaType;\r
+import java.util.Locale;\r
+\r
 @Service\r
 @SwaggerDefinition\r
 @Path("/rule")\r
index 82e51a5..91be5d3 100644 (file)
@@ -1,12 +1,12 @@
 /**\r
  * Copyright 2017 ZTE Corporation.\r
- *\r
+ * <p>\r
  * Licensed under the Apache License, Version 2.0 (the "License");\r
  * you may not use this file except in compliance with the License.\r
  * You may obtain a copy of the License at\r
- *\r
- *     http://www.apache.org/licenses/LICENSE-2.0\r
- *\r
+ * <p>\r
+ * http://www.apache.org/licenses/LICENSE-2.0\r
+ * <p>\r
  * Unless required by applicable law or agreed to in writing, software\r
  * distributed under the License is distributed on an "AS IS" BASIS,\r
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
 package org.onap.holmes.rulemgt.bolt.enginebolt;\r
 \r
 \r
-import static org.hamcrest.MatcherAssert.assertThat;\r
-import static org.hamcrest.Matchers.equalTo;\r
-\r
-import java.util.HashMap;\r
 import org.apache.http.HttpResponse;\r
 import org.apache.http.client.methods.CloseableHttpResponse;\r
 import org.apache.http.impl.client.CloseableHttpClient;\r
@@ -30,22 +26,28 @@ import org.junit.Before;
 import org.junit.Rule;\r
 import org.junit.Test;\r
 import org.junit.rules.ExpectedException;\r
+import org.junit.runner.RunWith;\r
 import org.onap.holmes.common.utils.HttpsUtils;\r
 import org.onap.holmes.rulemgt.bean.request.CorrelationDeployRule4Engine;\r
 import org.powermock.api.easymock.PowerMock;\r
 import org.powermock.core.classloader.annotations.PowerMockIgnore;\r
 import org.powermock.core.classloader.annotations.PrepareForTest;\r
+import org.powermock.modules.junit4.PowerMockRunner;\r
 import org.powermock.modules.junit4.rule.PowerMockRule;\r
 import org.powermock.reflect.Whitebox;\r
 \r
+import java.util.HashMap;\r
+\r
+import static org.hamcrest.MatcherAssert.assertThat;\r
+import static org.hamcrest.Matchers.equalTo;\r
+\r
 @PrepareForTest({HttpClients.class, CloseableHttpClient.class, HttpsUtils.class})\r
 @PowerMockIgnore("javax.net.ssl.*")\r
+@RunWith(PowerMockRunner.class)\r
 public class EngineServiceTest {\r
 \r
     @Rule\r
     public ExpectedException thrown = ExpectedException.none();\r
-    @Rule\r
-    public PowerMockRule powerMockRule = new PowerMockRule();\r
     private EngineService engineService;\r
     private HttpResponse httpResponseMock;\r
     private CloseableHttpClient closeableHttpClient;\r
index 0664db7..0dd2fbd 100644 (file)
@@ -17,9 +17,6 @@
 package org.onap.holmes.rulemgt.bolt.enginebolt;\r
 \r
 \r
-import static org.hamcrest.MatcherAssert.assertThat;\r
-import static org.hamcrest.Matchers.equalTo;\r
-\r
 import org.apache.http.HttpResponse;\r
 import org.apache.http.StatusLine;\r
 import org.easymock.EasyMock;\r
@@ -28,16 +25,18 @@ import org.junit.Rule;
 import org.junit.Test;\r
 import org.junit.rules.ExpectedException;\r
 import org.junit.runner.RunWith;\r
+import org.onap.holmes.common.exception.CorrelationException;\r
 import org.onap.holmes.common.utils.HttpsUtils;\r
 import org.onap.holmes.rulemgt.bean.request.CorrelationCheckRule4Engine;\r
 import org.onap.holmes.rulemgt.bean.request.CorrelationDeployRule4Engine;\r
-import org.onap.holmes.common.exception.CorrelationException;\r
 import org.powermock.api.easymock.PowerMock;\r
-import org.powermock.api.mockito.PowerMockito;\r
 import org.powermock.core.classloader.annotations.PrepareForTest;\r
 import org.powermock.modules.junit4.PowerMockRunner;\r
 import org.powermock.reflect.Whitebox;\r
 \r
+import static org.hamcrest.MatcherAssert.assertThat;\r
+import static org.hamcrest.Matchers.equalTo;\r
+\r
 @PrepareForTest({EngineWrapper.class, EngineService.class, HttpsUtils.class, HttpResponse.class,\r
         StatusLine.class})\r
 @RunWith(PowerMockRunner.class)\r
@@ -97,7 +96,7 @@ public class EngineWrapperTest {
     public void deployEngine_parse_content_exception() throws Exception {\r
         PowerMock.resetAll();\r
         String content = "";\r
-        PowerMockito.mockStatic(HttpsUtils.class);\r
+        PowerMock.mockStatic(HttpsUtils.class);\r
         thrown.expect(CorrelationException.class);\r
         thrown.expectMessage(\r
                 "Failed to parse the value returned by the engine management service.");\r
@@ -107,7 +106,7 @@ public class EngineWrapperTest {
                 .andReturn(httpResponse);\r
         EasyMock.expect(httpResponse.getStatusLine()).andReturn(statusLineMock);\r
         EasyMock.expect(statusLineMock.getStatusCode()).andReturn(200);\r
-        PowerMockito.when(HttpsUtils.extractResponseEntity(httpResponse)).thenReturn(content);\r
+        EasyMock.expect(HttpsUtils.extractResponseEntity(httpResponse)).andReturn(content);\r
         PowerMock.replayAll();\r
 \r
         engineWrapper.deployEngine(new CorrelationDeployRule4Engine(),"10.96.33.34");\r
@@ -119,14 +118,14 @@ public class EngineWrapperTest {
     public void deployEngine_success() throws Exception {\r
         PowerMock.resetAll();\r
         String content = "{\"packageName\":\"test\"}";\r
-        PowerMockito.mockStatic(HttpsUtils.class);\r
+        PowerMock.mockStatic(HttpsUtils.class);\r
         EasyMock.expect(\r
                 engineServiceMock.deploy(EasyMock.anyObject(CorrelationDeployRule4Engine.class),\r
                         EasyMock.anyObject(String.class)))\r
                 .andReturn(httpResponse);\r
         EasyMock.expect(httpResponse.getStatusLine()).andReturn(statusLineMock);\r
         EasyMock.expect(statusLineMock.getStatusCode()).andReturn(200);\r
-        PowerMockito.when(HttpsUtils.extractResponseEntity(httpResponse)).thenReturn(content);\r
+        EasyMock.expect(HttpsUtils.extractResponseEntity(httpResponse)).andReturn(content);\r
         PowerMock.replayAll();\r
 \r
         String result = engineWrapper.deployEngine(new CorrelationDeployRule4Engine(),"10.96.33.34");\r
index 90384ce..7033aff 100644 (file)
@@ -22,6 +22,7 @@ import org.junit.Before;
 import org.junit.Rule;\r
 import org.junit.Test;\r
 import org.junit.rules.ExpectedException;\r
+import org.junit.runner.RunWith;\r
 import org.onap.holmes.common.api.entity.CorrelationRule;\r
 import org.onap.holmes.common.exception.CorrelationException;\r
 import org.onap.holmes.common.utils.DbDaoUtil;\r
@@ -33,7 +34,7 @@ import org.onap.holmes.rulemgt.db.CorrelationRuleDao;
 import org.onap.holmes.rulemgt.db.CorrelationRuleQueryDao;\r
 import org.onap.holmes.rulemgt.send.Ip4AddingRule;\r
 import org.powermock.api.easymock.PowerMock;\r
-import org.powermock.modules.junit4.rule.PowerMockRule;\r
+import org.powermock.modules.junit4.PowerMockRunner;\r
 import org.powermock.reflect.Whitebox;\r
 \r
 import java.util.ArrayList;\r
@@ -44,12 +45,11 @@ import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;\r
 import static org.hamcrest.Matchers.is;\r
 \r
+@RunWith(PowerMockRunner.class)\r
 public class RuleMgtWrapperTest {\r
 \r
     @Rule\r
     public ExpectedException thrown = ExpectedException.none();\r
-    @Rule\r
-    public PowerMockRule powerMockRule = new PowerMockRule();\r
 \r
     private RuleMgtWrapper ruleMgtWrapper;\r
 \r