Resolved Fortify System Information Leak issues
[policy/engine.git] / POLICY-SDK-APP / src / main / java / org / onap / policy / controller / PolicyNotificationController.java
1 /*-
2  * ============LICENSE_START=======================================================
3  * ONAP Policy Engine
4  * ================================================================================
5  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6  * ================================================================================
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  * 
11  *      http://www.apache.org/licenses/LICENSE-2.0
12  * 
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  * ============LICENSE_END=========================================================
19  */
20
21 package org.onap.policy.controller;
22
23
24 /*
25  * 
26  * */
27 import java.io.File;
28 import java.io.IOException;
29 import java.io.PrintWriter;
30 import java.util.List;
31
32 import javax.script.SimpleBindings;
33 import javax.servlet.http.HttpServletRequest;
34 import javax.servlet.http.HttpServletResponse;
35
36 import org.json.JSONObject;
37 import org.onap.policy.common.logging.flexlogger.FlexLogger;
38 import org.onap.policy.common.logging.flexlogger.Logger;
39 import org.onap.policy.rest.dao.CommonClassDao;
40 import org.onap.policy.rest.jpa.WatchPolicyNotificationTable;
41 import org.onap.policy.utils.PolicyUtils;
42 import org.onap.portalsdk.core.controller.RestrictedBaseController;
43 import org.onap.portalsdk.core.web.support.UserUtils;
44 import org.springframework.beans.factory.annotation.Autowired;
45 import org.springframework.stereotype.Controller;
46 import org.springframework.web.bind.annotation.RequestMapping;
47 import org.springframework.web.servlet.ModelAndView;
48
49 import com.fasterxml.jackson.databind.DeserializationFeature;
50 import com.fasterxml.jackson.databind.JsonNode;
51 import com.fasterxml.jackson.databind.ObjectMapper;
52 import com.fasterxml.jackson.databind.node.ArrayNode;
53
54 @Controller
55 @RequestMapping({"/"})
56 public class PolicyNotificationController extends RestrictedBaseController {
57     private static Logger logger = FlexLogger.getLogger(PolicyNotificationController.class);
58
59         @Autowired
60         CommonClassDao commonClassDao;
61         
62         @RequestMapping(value={"/watchPolicy"}, method={org.springframework.web.bind.annotation.RequestMethod.POST})
63         public ModelAndView watchPolicy(HttpServletRequest request, HttpServletResponse response) throws IOException{
64                 StringBuilder path = new StringBuilder();
65                 String responseValue = "";
66                 try {
67                         String userId = UserUtils.getUserSession(request).getOrgUserId();
68                         logger.info("userid info: " + userId);
69                         ObjectMapper mapper = new ObjectMapper();
70                         mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
71                         JsonNode root = mapper.readTree(request.getReader());
72                         String name = root.get("watchData").get("name").toString();
73                         JsonNode pathList = root.get("watchData").get("path");
74                         String finalName;
75                         if(pathList.isArray()){
76                                 ArrayNode arrayNode = (ArrayNode) pathList;
77                                 for (int i = 0; i < arrayNode.size(); i++) {
78                                         JsonNode individualElement = arrayNode.get(i);
79                                         if(i == 0){
80                                                 path.append(individualElement.toString().replace("\"", "").trim());
81                                         }else{
82                                                 path.append(File.separator + individualElement.toString().replace("\"", "").trim());
83                                         }
84                                 }
85                         }
86                         
87                         if(pathList.size() > 0){
88                                 finalName = path + File.separator + name.replace("\"", "").trim();
89                         }else{
90                                 finalName = name.replace("\"", "").trim();
91                         }
92                         if(finalName.contains("\\")){
93                                 finalName = finalName.replace("\\", "\\\\");
94                         }
95                         String query = "from WatchPolicyNotificationTable where POLICYNAME = :finalName and LOGINIDS = :userId";
96                         SimpleBindings params = new SimpleBindings();
97                         params.put("finalName", finalName);
98                         params.put("userId", userId);
99                         List<Object> watchList = commonClassDao.getDataByQuery(query, params);
100                         if(watchList.isEmpty()){
101                                 if(finalName.contains("\\\\")){
102                                         finalName = finalName.replace("\\\\", File.separator);
103                                 }
104                                 WatchPolicyNotificationTable watch = new WatchPolicyNotificationTable();
105                                 watch.setPolicyName(finalName);
106                                 watch.setLoginIds(userId);
107                                 commonClassDao.save(watch);
108                                 responseValue = "You have Subscribed Successfully";
109                         }else{
110                                 commonClassDao.delete(watchList.get(0));
111                                 responseValue = "You have UnSubscribed Successfully";
112                         }
113                         
114                         response.setCharacterEncoding("UTF-8");
115                         response.setContentType("application / json");
116                         request.setCharacterEncoding("UTF-8");
117
118                         PrintWriter out = response.getWriter();
119                         String responseString = mapper.writeValueAsString(responseValue);
120                         JSONObject j = new JSONObject("{watchData: " + responseString + "}");
121                         out.write(j.toString());
122                         return null;
123                 }catch(Exception e){
124                         response.setCharacterEncoding("UTF-8");
125                         request.setCharacterEncoding("UTF-8");
126                         logger.error("Error druing watchPolicy function " + e);
127                         PrintWriter out = response.getWriter();
128                         out.write(PolicyUtils.CATCH_EXCEPTION);
129                 }
130                 return null;
131         }
132 }