Resolved Fortify System Information Leak issues
[policy/engine.git] / ONAP-PAP-REST / src / main / java / org / onap / policy / pap / xacml / rest / controller / DescriptiveDictionaryController.java
1 /*-
2  * ============LICENSE_START=======================================================
3  * ONAP-PAP-REST
4  * ================================================================================
5  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6  * ================================================================================
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  * 
11  *      http://www.apache.org/licenses/LICENSE-2.0
12  * 
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  * ============LICENSE_END=========================================================
19  */
20
21 package org.onap.policy.pap.xacml.rest.controller;
22
23 import java.io.IOException;
24 import java.io.PrintWriter;
25 import java.io.UnsupportedEncodingException;
26 import java.util.Date;
27 import java.util.HashMap;
28 import java.util.LinkedHashMap;
29 import java.util.List;
30 import java.util.Map;
31
32 import javax.servlet.http.HttpServletRequest;
33 import javax.servlet.http.HttpServletResponse;
34
35 import org.json.JSONObject;
36 import org.onap.policy.common.logging.flexlogger.FlexLogger;
37 import org.onap.policy.common.logging.flexlogger.Logger;
38 import org.onap.policy.pap.xacml.rest.adapters.GridData;
39 import org.onap.policy.pap.xacml.rest.util.JsonMessage;
40 import org.onap.policy.rest.dao.CommonClassDao;
41 import org.onap.policy.rest.jpa.DescriptiveScope;
42 import org.onap.policy.rest.jpa.UserInfo;
43 import org.onap.policy.utils.PolicyUtils;
44 import org.onap.policy.xacml.api.XACMLErrorConstants;
45 import org.springframework.beans.factory.annotation.Autowired;
46 import org.springframework.http.MediaType;
47 import org.springframework.stereotype.Controller;
48 import org.springframework.web.bind.annotation.RequestMapping;
49 import org.springframework.web.servlet.ModelAndView;
50
51 import com.fasterxml.jackson.databind.DeserializationFeature;
52 import com.fasterxml.jackson.databind.JsonNode;
53 import com.fasterxml.jackson.databind.ObjectMapper;
54
55 @Controller
56 public class DescriptiveDictionaryController {
57
58         private static final Logger LOGGER  = FlexLogger.getLogger(DescriptiveDictionaryController.class);
59         
60         private static CommonClassDao commonClassDao;
61         
62         @Autowired
63         public DescriptiveDictionaryController(CommonClassDao commonClassDao){
64                 DescriptiveDictionaryController.commonClassDao = commonClassDao;
65         }
66         
67         public DescriptiveDictionaryController(){}
68         
69         public UserInfo getUserInfo(String loginId){
70                 UserInfo name = (UserInfo) commonClassDao.getEntityItem(UserInfo.class, "userLoginId", loginId);
71                 return name;    
72         }
73
74         @RequestMapping(value={"/get_DescriptiveScopeByName"}, method={org.springframework.web.bind.annotation.RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)
75         public void getDescriptiveDictionaryByNameEntityData(HttpServletRequest request, HttpServletResponse response){
76                 try{
77                         Map<String, Object> model = new HashMap<>();
78                         ObjectMapper mapper = new ObjectMapper();
79                         model.put("descriptiveScopeDictionaryDatas", mapper.writeValueAsString(commonClassDao.getDataByColumn(DescriptiveScope.class, "descriptiveScopeName")));
80                         JsonMessage msg = new JsonMessage(mapper.writeValueAsString(model));
81                         JSONObject j = new JSONObject(msg);
82                         response.getWriter().write(j.toString());
83                 }
84                 catch (Exception e){
85                         LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + e);
86                 }
87         }
88         
89         @RequestMapping(value={"/get_DescriptiveScope"}, method={org.springframework.web.bind.annotation.RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)
90         public void getDescriptiveDictionaryEntityData(HttpServletResponse response){
91                 try{
92                         Map<String, Object> model = new HashMap<>();
93                         ObjectMapper mapper = new ObjectMapper();
94                         model.put("descriptiveScopeDictionaryDatas", mapper.writeValueAsString(commonClassDao.getData(DescriptiveScope.class)));
95                         JsonMessage msg = new JsonMessage(mapper.writeValueAsString(model));
96                         JSONObject j = new JSONObject(msg);
97             response.addHeader("successMapKey", "success"); 
98             response.addHeader("operation", "getDictionary");
99                         response.getWriter().write(j.toString());
100                 }
101                 catch (Exception e){
102             LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + e);
103             response.setStatus(HttpServletResponse.SC_BAD_REQUEST);                             
104             response.addHeader("error", "dictionaryDBQuery");
105                 }
106         }
107         
108         @RequestMapping(value={"/descriptive_dictionary/save_descriptive"}, method={org.springframework.web.bind.annotation.RequestMethod.POST})
109         public ModelAndView saveDescriptiveDictionary(HttpServletRequest request, HttpServletResponse response)throws UnsupportedEncodingException, IOException{
110                 try {
111                         boolean duplicateflag = false;
112             boolean isFakeUpdate = false;
113             boolean fromAPI = false;
114             if (request.getParameter("apiflag")!=null && request.getParameter("apiflag").equalsIgnoreCase("api")) {
115                 fromAPI = true;
116             }
117                         ObjectMapper mapper = new ObjectMapper();
118                         mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
119                         JsonNode root = mapper.readTree(request.getReader());
120             DescriptiveScope descriptiveScope;
121             GridData data;
122             String userId = null;
123             if (fromAPI) {
124                 descriptiveScope = (DescriptiveScope)mapper.readValue(root.get("dictionaryFields").toString(), DescriptiveScope.class);
125                 data = (GridData)mapper.readValue(root.get("dictionaryFields").toString(), GridData.class);
126                 userId = "API";
127                 
128                 //check if update operation or create, get id for data to be updated and update attributeData
129                 if (request.getParameter("operation").equals("update")) {
130                         List<Object> duplicateData =  commonClassDao.checkDuplicateEntry(descriptiveScope.getScopeName(), "descriptiveScopeName", DescriptiveScope.class);
131                         int id = 0;
132                         DescriptiveScope dbdata = (DescriptiveScope) duplicateData.get(0);
133                         id = dbdata.getId();
134                         if(id==0){
135                                 isFakeUpdate=true;
136                                 descriptiveScope.setId(1);
137                         } else {
138                                 descriptiveScope.setId(id);
139                         }
140                         descriptiveScope.setUserCreatedBy(this.getUserInfo(userId));
141                 }
142             } else {
143                 descriptiveScope = (DescriptiveScope)mapper.readValue(root.get("descriptiveScopeDictionaryData").toString(), DescriptiveScope.class);
144                 data = (GridData)mapper.readValue(root.get("descriptiveScopeDictionaryData").toString(), GridData.class);
145                 userId = root.get("userid").textValue();
146             }
147                         String header = "";
148                         int counter = 0;
149                         if(data.getAttributes().size() > 0){
150                                 for(Object attribute : data.getAttributes()){
151                                         if(attribute instanceof LinkedHashMap<?, ?>){
152                                                 String key = ((LinkedHashMap<?, ?>) attribute).get("option").toString();
153                                                 String value = ((LinkedHashMap<?, ?>) attribute).get("number").toString();
154                                                 if(counter>0){
155                                                         header = header + "AND";
156                                                 }
157                                                 header = header + key + ":";
158                                                 header = header + value;
159                                                 counter ++;
160                                         }
161                                 }
162                         }
163                         descriptiveScope.setSearch(header);
164                         if(descriptiveScope.getId() == 0){
165                                 List<Object> duplicateData =  commonClassDao.checkDuplicateEntry(descriptiveScope.getScopeName(), "descriptiveScopeName", DescriptiveScope.class);
166                                 if(!duplicateData.isEmpty()){
167                                         duplicateflag = true;
168                                 }else{
169                                         descriptiveScope.setUserCreatedBy(this.getUserInfo(userId));
170                                         descriptiveScope.setUserModifiedBy(this.getUserInfo(userId));
171                                         commonClassDao.save(descriptiveScope);
172                                 }
173                         }else{
174                                 if(!isFakeUpdate){
175                                         descriptiveScope.setUserModifiedBy(this.getUserInfo(userId));
176                                         descriptiveScope.setModifiedDate(new Date());
177                                         commonClassDao.update(descriptiveScope); 
178                                 }
179                         } 
180             String responseString = "";
181             if(duplicateflag){
182                 responseString = "Duplicate";
183             }else{
184                 responseString =  mapper.writeValueAsString(commonClassDao.getData(DescriptiveScope.class));
185             }
186             
187             if (fromAPI) {
188                 if (responseString!=null && !responseString.equals("Duplicate")) {
189                         if(isFakeUpdate){
190                                 responseString = "Exists";
191                         } else {
192                                 responseString = "Success";
193                         }
194                 }
195                 ModelAndView result = new ModelAndView();
196                 result.setViewName(responseString);
197                 return result;
198             } else {
199                 response.setCharacterEncoding("UTF-8");
200                 response.setContentType("application / json");
201                 request.setCharacterEncoding("UTF-8");
202  
203                 PrintWriter out = response.getWriter();
204                 JSONObject j = new JSONObject("{descriptiveScopeDictionaryDatas: " + responseString + "}");
205                 out.write(j.toString());
206                 return null;
207             }
208  
209         }catch (Exception e){
210                 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + e);
211                         response.setCharacterEncoding("UTF-8");
212                         request.setCharacterEncoding("UTF-8");
213                         PrintWriter out = response.getWriter();
214                         out.write(PolicyUtils.CATCH_EXCEPTION);
215                 }
216                 return null;
217         }
218
219         @RequestMapping(value={"/descriptive_dictionary/remove_descriptiveScope"}, method={org.springframework.web.bind.annotation.RequestMethod.POST})
220         public ModelAndView removeDescriptiveDictionary(HttpServletRequest request, HttpServletResponse response) throws UnsupportedEncodingException, IOException{
221                 try{
222                         ObjectMapper mapper = new ObjectMapper();
223                         mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
224                         JsonNode root = mapper.readTree(request.getReader());
225                         DescriptiveScope descriptiveScope = (DescriptiveScope)mapper.readValue(root.get("data").toString(), DescriptiveScope.class);
226                         commonClassDao.delete(descriptiveScope);
227                         response.setCharacterEncoding("UTF-8");
228                         response.setContentType("application / json");
229                         request.setCharacterEncoding("UTF-8");
230
231                         PrintWriter out = response.getWriter();
232
233                         String responseString = mapper.writeValueAsString(commonClassDao.getData(DescriptiveScope.class));
234                         JSONObject j = new JSONObject("{descriptiveScopeDictionaryDatas: " + responseString + "}");
235                         out.write(j.toString());
236
237                         return null;
238                 }
239                 catch (Exception e){
240                         LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + e);
241                         response.setCharacterEncoding("UTF-8");
242                         request.setCharacterEncoding("UTF-8");
243                         PrintWriter out = response.getWriter();
244                         out.write(PolicyUtils.CATCH_EXCEPTION);
245                 }
246                 return null;
247         }
248 }
249