Merge "Fix final 10 vulnerabilities in policy/engine"
[policy/engine.git] / ONAP-PAP-REST / src / main / java / org / onap / policy / pap / xacml / rest / controller / BRMSDictionaryController.java
1 /*-
2  * ============LICENSE_START=======================================================
3  * ONAP-PAP-REST
4  * ================================================================================
5  * Copyright (C) 2017-2018 AT&T Intellectual Property. All rights reserved.
6  * ================================================================================
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  * 
11  *      http://www.apache.org/licenses/LICENSE-2.0
12  * 
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  * ============LICENSE_END=========================================================
19  */
20
21 package org.onap.policy.pap.xacml.rest.controller;
22
23 import java.io.IOException;
24 import java.io.StringWriter;
25 import java.nio.charset.StandardCharsets;
26 import java.util.Date;
27 import java.util.List;
28
29 import javax.servlet.http.HttpServletRequest;
30 import javax.servlet.http.HttpServletResponse;
31
32 import org.apache.commons.io.IOUtils;
33 import org.onap.policy.api.PEDependency;
34 import org.onap.policy.common.logging.flexlogger.FlexLogger;
35 import org.onap.policy.common.logging.flexlogger.Logger;
36 import org.onap.policy.pap.xacml.rest.components.CreateBRMSRuleTemplate;
37 import org.onap.policy.pap.xacml.rest.util.DictionaryUtils;
38 import org.onap.policy.rest.dao.CommonClassDao;
39 import org.onap.policy.rest.jpa.BRMSController;
40 import org.onap.policy.rest.jpa.BRMSDependency;
41 import org.onap.policy.rest.jpa.BRMSParamTemplate;
42 import org.onap.policy.rest.jpa.OnapName;
43 import org.onap.policy.rest.jpa.UserInfo;
44 import org.onap.policy.utils.PolicyUtils;
45 import org.onap.policy.xacml.api.XACMLErrorConstants;
46 import org.springframework.beans.factory.annotation.Autowired;
47 import org.springframework.http.MediaType;
48 import org.springframework.stereotype.Controller;
49 import org.springframework.web.bind.annotation.RequestMapping;
50 import org.springframework.web.bind.annotation.RequestMethod;
51 import org.springframework.web.servlet.ModelAndView;
52
53 import com.fasterxml.jackson.databind.DeserializationFeature;
54 import com.fasterxml.jackson.databind.JsonNode;
55 import com.fasterxml.jackson.databind.ObjectMapper;
56
57
58 @Controller
59 public class BRMSDictionaryController{
60         
61         private static final Logger LOGGER  = FlexLogger.getLogger(BRMSDictionaryController.class);
62
63         private static final String VALIDATIONRESPONSE = "Validation";
64
65         private static CommonClassDao commonClassDao;
66         private static String rule;
67         private static String successMsg = "Success";
68         private static String duplicateResponseString = "Duplicate";
69         private static String ruleName = "ruleName";
70         private static String errorMessage      = "Error";
71         private static String operation = "operation";
72         private static String dictionaryFields ="dictionaryFields";
73         private static String userid = "userid";
74         private static String dependencyName = "dependencyName";
75         private static String controllerName = "controllerName";
76         private static String brmsParamDatas = "brmsParamDictionaryDatas";
77         private static String brmsDependencyDatas = "brmsDependencyDictionaryDatas";
78         private static String brmsControllerDatas = "brmsControllerDictionaryDatas";
79         
80         @Autowired
81         public BRMSDictionaryController(CommonClassDao commonClassDao){
82                 BRMSDictionaryController.commonClassDao = commonClassDao;
83         }
84         
85         public static void setCommonClassDao(CommonClassDao commonClassDao2) {
86                 BRMSDictionaryController.commonClassDao = commonClassDao2;      
87         }
88
89         public BRMSDictionaryController() {
90                 super();
91         }
92         
93         private DictionaryUtils getDictionaryUtilsInstance(){
94                 return DictionaryUtils.getDictionaryUtils();
95         }
96
97         @RequestMapping(value={"/get_BRMSParamDataByName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)
98         public void getBRMSParamDictionaryByNameEntityData(HttpServletResponse response){
99                 DictionaryUtils utils = getDictionaryUtilsInstance();
100                 utils.getDataByEntity(response, brmsParamDatas, ruleName, BRMSParamTemplate.class);
101         }
102         
103         @RequestMapping(value={"/get_BRMSParamData"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)
104         public void getBRMSParamDictionaryEntityData(HttpServletResponse response){
105                 DictionaryUtils utils = getDictionaryUtilsInstance();
106                 utils.getData(response, brmsParamDatas, BRMSParamTemplate.class);
107         }
108         
109         @RequestMapping(value={"/brms_dictionary/set_BRMSParamData"}, method={RequestMethod.POST})
110         public static void setRuleData(HttpServletRequest request) throws IOException{
111                 StringWriter writer = new StringWriter();
112                 IOUtils.copy(request.getInputStream() , writer, StandardCharsets.UTF_8);
113                 String cleanStreamBoundary =  writer.toString().replaceFirst("------(.*)(?s).*octet-stream", "");
114                 rule = cleanStreamBoundary.substring(0, cleanStreamBoundary.lastIndexOf("end")+4);
115         }
116         
117         @RequestMapping(value={"/brms_dictionary/save_BRMSParam"}, method={RequestMethod.POST})
118         public ModelAndView saveBRMSParamDictionary(HttpServletRequest request, HttpServletResponse response) throws IOException {
119                 DictionaryUtils utils = getDictionaryUtilsInstance();
120                 try {
121                         boolean fromAPI = utils.isRequestFromAPI(request);
122                         ObjectMapper mapper = new ObjectMapper();
123                         mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
124                         JsonNode root = mapper.readTree(request.getReader());
125                         
126             BRMSParamTemplate bRMSParamTemplateData;
127             String userId = null;
128             if(fromAPI){
129                 bRMSParamTemplateData = mapper.readValue(root.get(dictionaryFields).toString(), BRMSParamTemplate.class);
130                                 userId = "API";
131                         }else{
132                                 bRMSParamTemplateData = mapper.readValue(root.get("brmsParamDictionaryData").toString(), BRMSParamTemplate.class);
133                                 userId = root.get(userid).textValue();
134                         }
135                         UserInfo userInfo = utils.getUserInfo(userId);
136                         
137                         List<Object> duplicateData =  commonClassDao.checkDuplicateEntry(bRMSParamTemplateData.getRuleName(), ruleName, BRMSParamTemplate.class);
138                         boolean duplicateflag = false;
139                         if(!duplicateData.isEmpty()){
140                                 BRMSParamTemplate data = (BRMSParamTemplate) duplicateData.get(0);
141                                 if(request.getParameter(operation) != null && "update".equals(request.getParameter(operation))){
142                                         bRMSParamTemplateData.setId(data.getId());
143                                 }else if((request.getParameter(operation) != null && !"update".equals(request.getParameter(operation))) || 
144                                                 (request.getParameter(operation) == null && (data.getId() != bRMSParamTemplateData.getId()))){
145                                         duplicateflag = true;
146                                 }
147                         }
148                         String responseString = null;
149             boolean validation = false;
150             if(rule != null && CreateBRMSRuleTemplate.validateRuleParams(rule)){
151                         bRMSParamTemplateData.setRule(rule);
152                         validation = true;
153                         if(!duplicateflag){
154                                 if(bRMSParamTemplateData.getId() == 0){
155                                         bRMSParamTemplateData.setUserCreatedBy(userInfo);
156                                         commonClassDao.save(bRMSParamTemplateData);
157                                 }else{
158                                         commonClassDao.update(bRMSParamTemplateData); 
159                                 } 
160                                 responseString = mapper.writeValueAsString(commonClassDao.getData(BRMSParamTemplate.class));
161                         }else{
162                                 responseString = duplicateResponseString;
163                         }
164             }
165                                 
166                         if(!validation){
167                                 responseString = VALIDATIONRESPONSE;
168                         }
169                         if(fromAPI){
170                                 if (responseString!=null && !(duplicateResponseString).equals(responseString) && !VALIDATIONRESPONSE.equals(responseString)) {
171                     responseString = successMsg;
172                 }
173                 ModelAndView result = new ModelAndView();
174                 result.setViewName(responseString);
175                 return result;
176                         }else{
177                                 utils.setResponseData(response, brmsParamDatas, responseString);
178                         }
179                 }catch(Exception e){
180                         utils.setErrorResponseData(response, e);
181                 }
182                 return null;
183         }
184
185         @RequestMapping(value={"/brms_dictionary/remove_brmsParam"}, method={RequestMethod.POST})
186         public void removeBRMSParamDictionary(HttpServletRequest request, HttpServletResponse response)throws IOException {
187                 DictionaryUtils utils = getDictionaryUtilsInstance();
188                 utils.removeData(request, response, brmsParamDatas, BRMSParamTemplate.class);
189         }
190         
191     @RequestMapping(value={"/get_BRMSDependencyDataByName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)
192     public void getBRMSDependencyDictionaryByNameEntityData(HttpServletResponse response){
193         DictionaryUtils utils = getDictionaryUtilsInstance();
194                 utils.getDataByEntity(response, brmsDependencyDatas, dependencyName, BRMSDependency.class);
195     }
196     
197     @RequestMapping(value={"/get_BRMSDependencyData"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)
198     public void getBRMSDependencyDictionaryEntityData(HttpServletResponse response){
199         DictionaryUtils utils = getDictionaryUtilsInstance();
200                 utils.getData(response, brmsDependencyDatas, BRMSDependency.class);
201     }
202     
203     @RequestMapping(value={"/brms_dictionary/save_BRMSDependencyData"}, method={RequestMethod.POST})
204     public ModelAndView saveBRMSDependencyDictionary(HttpServletRequest request, HttpServletResponse response) throws IOException {
205         DictionaryUtils utils = getDictionaryUtilsInstance();
206         try {
207                 LOGGER.debug("DictionaryController:  saveBRMSDependencyDictionary() is called");
208                 boolean fromAPI = utils.isRequestFromAPI(request);
209                 ObjectMapper mapper = new ObjectMapper();
210                 mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
211                 JsonNode root = mapper.readTree(request.getReader());
212
213                 BRMSDependency brmsDependency;
214                 String userId = null;
215                 if(fromAPI){
216                         brmsDependency = mapper.readValue(root.get(dictionaryFields).toString(), BRMSDependency.class);
217                         userId = "API";
218                 }else{
219                         brmsDependency = mapper.readValue(root.get("brmsDependencyDictionaryData").toString(), BRMSDependency.class);
220                         userId = root.get(userid).textValue();
221                 }
222                 UserInfo userInfo = utils.getUserInfo(userId);
223
224                 List<Object> duplicateData =  commonClassDao.checkDuplicateEntry(brmsDependency.getDependencyName(), dependencyName, BRMSDependency.class);
225                 boolean duplicateflag = false;
226                         if(!duplicateData.isEmpty()){
227                                 BRMSDependency data = (BRMSDependency) duplicateData.get(0);
228                                 if(request.getParameter(operation) != null && "update".equals(request.getParameter(operation))){
229                                         brmsDependency.setId(data.getId());
230                                 }else if((request.getParameter(operation) != null && !"update".equals(request.getParameter(operation))) || 
231                                                 (request.getParameter(operation) == null && (data.getId() != brmsDependency.getId()))){
232                                         duplicateflag = true;
233                                 }
234                         }
235                 LOGGER.audit("the userId from the onap portal is: " + userId);
236                 String responseString = null;
237                 if(brmsDependency.getDependency()!=null && !("").equals(brmsDependency.getDependency().trim())){
238                         PEDependency dependency = null;
239                         try{
240                                 dependency = PolicyUtils.jsonStringToObject(brmsDependency.getDependency(), PEDependency.class);
241                         }catch(Exception e){
242                                 LOGGER.error(XACMLErrorConstants.ERROR_SCHEMA_INVALID + "wrong data given for BRMS PEDependency Dictionary : " + brmsDependency.getDependency(),e);
243                         }
244                         if(dependency==null){
245                                 responseString = errorMessage;
246                         }else{
247                                 if(!duplicateflag){
248                                         brmsDependency.setUserModifiedBy(userInfo);
249                                         if(brmsDependency.getId() == 0){
250                                                 brmsDependency.setUserCreatedBy(userInfo);
251                                                 commonClassDao.save(brmsDependency);
252                                         }else{
253                                                 brmsDependency.setModifiedDate(new Date());
254                                                 commonClassDao.update(brmsDependency); 
255                                         } 
256                                         responseString = mapper.writeValueAsString(commonClassDao.getData(BRMSDependency.class));
257                                 }else{
258                                         responseString = duplicateResponseString;
259                                 }
260                         }
261                 }
262
263                 if(fromAPI){
264                         if(responseString!=null && !duplicateResponseString.equals(responseString) && !errorMessage.equals(responseString)){
265                                 responseString = successMsg;
266                         }
267                         ModelAndView result = new ModelAndView();
268                         result.setViewName(responseString);
269                         return result;
270                 }else{
271                         utils.setResponseData(response, brmsDependencyDatas, responseString);
272                 }
273         } catch (Exception e){
274                 utils.setErrorResponseData(response, e);
275         }
276         return null;
277     }
278  
279     @RequestMapping(value={"/brms_dictionary/remove_brmsDependency"}, method={RequestMethod.POST})
280     public void removeBRMSDependencyDictionary(HttpServletRequest request, HttpServletResponse response) throws IOException {
281         DictionaryUtils utils = getDictionaryUtilsInstance();
282                 utils.removeData(request, response, brmsDependencyDatas, BRMSDependency.class);
283     }
284     
285     
286     @RequestMapping(value={"/get_BRMSControllerDataByName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)
287     public void getBRMSControllerDictionaryByNameEntityData(HttpServletResponse response){
288         DictionaryUtils utils = getDictionaryUtilsInstance();
289                 utils.getDataByEntity(response, brmsControllerDatas, controllerName, BRMSController.class);
290     }
291     
292     @RequestMapping(value={"/get_BRMSControllerData"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)
293     public void getBRMSControllerDictionaryEntityData(HttpServletResponse response){
294         DictionaryUtils utils = getDictionaryUtilsInstance();
295                 utils.getData(response, brmsControllerDatas, BRMSController.class);
296     }
297     
298     @RequestMapping(value={"/brms_dictionary/save_BRMSControllerData"}, method={RequestMethod.POST})
299     public ModelAndView saveBRMSControllerDictionary(HttpServletRequest request, HttpServletResponse response) throws IOException{
300         DictionaryUtils utils = getDictionaryUtilsInstance();
301         try {
302                 LOGGER.debug("DictionaryController:  saveBRMSControllerDictionary() is called");
303                 boolean fromAPI = utils.isRequestFromAPI(request);
304                 ObjectMapper mapper = new ObjectMapper();
305                 mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
306                 JsonNode root = mapper.readTree(request.getReader());
307                 BRMSController brmsController;
308                 String userId = null;
309                 if(fromAPI){
310                         brmsController = mapper.readValue(root.get(dictionaryFields).toString(), BRMSController.class);
311                         userId = "API";
312                 }else{
313                         brmsController = mapper.readValue(root.get("brmsControllerDictionaryData").toString(), BRMSController.class);
314                         userId = root.get(userid).textValue();
315                 }
316                 UserInfo userInfo = utils.getUserInfo(userId);
317
318                 List<Object> duplicateData =  commonClassDao.checkDuplicateEntry(brmsController.getControllerName(), controllerName, BRMSController.class);
319                 boolean duplicateflag = false;
320                         if(!duplicateData.isEmpty()){
321                                 BRMSController data = (BRMSController) duplicateData.get(0);
322                                 if(request.getParameter(operation) != null && "update".equals(request.getParameter(operation))){
323                                         brmsController.setId(data.getId());
324                                 }else if((request.getParameter(operation) != null && !"update".equals(request.getParameter(operation))) || 
325                                                 (request.getParameter(operation) == null && (data.getId() != brmsController.getId()))){
326                                         duplicateflag = true;
327                                 }
328                         }
329                 String responseString = null;
330                 if(brmsController.getController()!=null && !("").equals(brmsController.getController().trim())){
331                         PEDependency dependency = null;
332                         try{
333                                 dependency = PolicyUtils.jsonStringToObject(brmsController.getController(), PEDependency.class);
334                         }catch(Exception e){
335                                 LOGGER.error(XACMLErrorConstants.ERROR_SCHEMA_INVALID + "wrong data given for BRMS Controller Dictionary : " + brmsController.getController(),e);
336                         }
337                         if(dependency==null){
338                                 responseString = errorMessage;
339                         }else{
340                                 if(!duplicateflag){
341                                         brmsController.setUserModifiedBy(userInfo);
342                                         if(brmsController.getId() == 0){
343                                                 brmsController.setUserCreatedBy(userInfo);
344                                                 commonClassDao.save(brmsController);
345                                         }else{
346                                                 brmsController.setModifiedDate(new Date());
347                                                 commonClassDao.update(brmsController); 
348                                         } 
349                                         responseString = mapper.writeValueAsString(commonClassDao.getData(OnapName.class));
350                                 }else{
351                                         responseString = duplicateResponseString;
352                                 }
353                         }
354                 }
355                 if(fromAPI){
356                         if (responseString!=null && !(duplicateResponseString).equals(responseString) && !(errorMessage).equals(responseString)) {
357                                 responseString = successMsg;
358                         }
359                         ModelAndView result = new ModelAndView();
360                         result.setViewName(responseString);
361                         return result;
362                 }else{
363                         utils.setResponseData(response, brmsControllerDatas, responseString);
364                 }
365         } catch (Exception e){
366                 utils.setErrorResponseData(response, e);
367         }
368         return null;
369     }
370  
371     @RequestMapping(value={"/brms_dictionary/remove_brmsController"}, method={RequestMethod.POST})
372     public void removeBRMSControllerDictionary(HttpServletRequest request, HttpServletResponse response) throws IOException{
373         DictionaryUtils utils = getDictionaryUtilsInstance();
374                 utils.removeData(request, response, brmsControllerDatas, BRMSController.class);
375     }
376     
377     public BRMSDependency getDependencyDataByID(String dependencyName){
378         return (BRMSDependency) commonClassDao.getEntityItem(BRMSDependency.class, BRMSDictionaryController.dependencyName, dependencyName);
379     }
380     
381     public BRMSController getControllerDataByID(String controllerName){
382         return (BRMSController) commonClassDao.getEntityItem(BRMSController.class, BRMSDictionaryController.controllerName, controllerName);
383     }   
384 }