Fix vulnerabilities and bugs in policy/engine

Code fixes for 1 bug and 17 vulnerabilities reported by Sonar in
policy/engine

Change-Id: I7b641795c790ec15418bd9ae3a414279e1b0f733
Issue-ID: POLICY-662
Signed-off-by: eramkve <ram.krishna.verma@ericsson.com>

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/XACMLPapServlet.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/XACMLPapServlet.java
index 84cd72f..9564acc 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/XACMLPapServlet.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/XACMLPapServlet.java
@@ -46,7 +46,7 @@ import java.util.Scanner;
 import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.CopyOnWriteArrayList;
-
+import javax.json.JsonException;
 import javax.persistence.EntityManagerFactory;
 import javax.persistence.Persistence;
 import javax.persistence.PersistenceException;
@@ -1017,26 +1017,24 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                        im.startTransaction();
                        loggingContext.metricEnded();
                        PolicyLogger.metrics("XACMLPapServlet doPut im startTransaction");
+               } catch(AdministrativeStateException e) {
+                   String message = "PUT interface called for PAP " + papResourceName + 
+                           " but it has an Administrative state of " + im.getStateManager().getAdminState() +
+                           "\n Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
+               } catch(StandbyStatusException e) {
+                   String message = "PUT interface called for PAP " + papResourceName + 
+                           " but it has a Standby Status of " + im.getStateManager().getStandbyStatus() +
+                           "\n Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
                } catch (IntegrityMonitorException e) {
-                       String message = "PUT interface called for PAP " + papResourceName;
-                       if (e instanceof AdministrativeStateException) {
-                               message += " but it has an Administrative state of "
-                                       + im.getStateManager().getAdminState();
-                       } else if (e instanceof StandbyStatusException) {
-                               message += " but it has a Standby Status of "
-                                       + im.getStateManager().getStandbyStatus();
-                       } else {
-                               message += " but an exception occurred";
-
-                       }
-                       message += "\n Exception Message: " + e.getMessage();
-
-                       LOGGER.info(message, e);
-                       PolicyLogger.error(MessageCodes.ERROR_SYSTEM_ERROR + " " + message);
-                       loggingContext.transactionEnded();
-                       PolicyLogger.audit("Transaction Failed - See Error.log");
-                       setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, message);
-                       return;
+                   String message = "PUT interface called for PAP " + papResourceName +
+                           " but an exception occurred" +
+                           "\n Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
                }
 
                loggingContext.metricStarted();
@@ -2211,6 +2209,14 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                        PolicyLogger.audit("Transaction Failed - See Error.log");
                        setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
                        return;
+               } catch (IOException | JsonException e) {
+                   LOGGER.debug(e);
+                   acPutTransaction.rollbackTransaction();
+                   PolicyLogger.error(MessageCodes.ERROR_PROCESS_FLOW, e, "XACMLPapServlet", " AC PUT exception");
+                   loggingContext.transactionEnded();
+                   PolicyLogger.audit("Transaction Failed - See Error.log");
+                   setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
+                   return;
                }
        }
        
@@ -2822,24 +2828,21 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                        PolicyLogger.audit("Transaction Failed - See Error.log");
                        response.setStatus(HttpServletResponse.SC_OK);
                        return;
-               }catch (ForwardProgressException | AdministrativeStateException | StandbyStatusException e){
-                       String submsg;
-                       if (e instanceof ForwardProgressException) {
-                               submsg = " is not making forward progress.";
-                       } else if (e instanceof AdministrativeStateException) {
-                               submsg = " Administrative State is LOCKED.";
-                       } else {
-                               submsg = " Standby Status is NOT PROVIDING SERVICE.";
-                       }
-
-                       String message = "GET:/pap/test called and PAP " + papResourceName + submsg
-                                       + " Exception Message: " + e.getMessage();
-                       LOGGER.info(message, e);
-                       PolicyLogger.error(MessageCodes.ERROR_SYSTEM_ERROR + " " + message);
-                       loggingContext.transactionEnded();
-                       PolicyLogger.audit("Transaction Failed - See Error.log");
-                       setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, message);
-                       return;
+               }catch (ForwardProgressException e){
+                   String message = "GET:/pap/test called and PAP " + papResourceName + " is not making forward progress."
+                           + " Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
+               }catch (AdministrativeStateException e){
+                   String message = "GET:/pap/test called and PAP " + papResourceName + " Administrative State is LOCKED."
+                           + " Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
+               }catch (StandbyStatusException e){
+                   String message = "GET:/pap/test called and PAP " + papResourceName + " Standby Status is NOT PROVIDING SERVICE."
+                           + " Exception Message: " + e.getMessage();
+                   logMessage(e, message, loggingContext, response);
+                   return;
                }catch (Exception e) {
                        //A subsystem is not making progress, is locked, standby or is not responding
                        String eMsg = e.getMessage();
@@ -3014,4 +3017,12 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
        public static void setMsPolicyName(String msPolicyName) {
                XACMLPapServlet.msPolicyName = msPolicyName;
        }
+       
+       private void logMessage(Exception e, String message, ONAPLoggingContext loggingContext, HttpServletResponse response) {
+           LOGGER.info(message, e);
+           PolicyLogger.error(MessageCodes.ERROR_SYSTEM_ERROR + " " + message);
+           loggingContext.transactionEnded();
+           PolicyLogger.audit("Transaction Failed - See Error.log");
+           setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, message);
+       }
 }

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/components/PolicyDBDao.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/components/PolicyDBDao.java
index 9ac8582..8b4651f 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/components/PolicyDBDao.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/components/PolicyDBDao.java
@@ -127,7 +127,7 @@ public class PolicyDBDao {
        public static final String duplicatePolicyId = "Somehow, more than one policy with the id ";
        public static final String foundInDB = " were found in the database";
        
-       public static boolean isJunit = false;
+       private static boolean isJunit = false;
 
        public static void setJunit(boolean isJunit) {
                PolicyDBDao.isJunit = isJunit;
@@ -1250,6 +1250,9 @@ public class PolicyDBDao {
                                        for(PDPPolicy policy : policies){
                                                try{
                                                        String[] stringArray = getNameScopeAndVersionFromPdpPolicy(policy.getId());
+                                                       if(stringArray == null) {
+                                                           throw new IllegalArgumentException("Invalid input - policyID must contain name, scope and version");
+                                                       }
                                                        List<PolicyEntity> policyEntityList;
                                                        Query getPolicyEntitiesQuery = em.createNamedQuery("PolicyEntity.findByNameAndScope");
                                                        getPolicyEntitiesQuery.setParameter("name", stringArray[0]);

diff --git a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/XACMLPdpLoader.java b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/XACMLPdpLoader.java
index 5c9f860..102d43f 100644 (file)
--- a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/XACMLPdpLoader.java
+++ b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/XACMLPdpLoader.java
@@ -550,20 +550,14 @@ public class XACMLPdpLoader {
                                                                        // properties
                                                                        //
                                                                        changed = true;
+                                                               } catch (MalformedURLException e) {
+                                                                       papUrls.failed();
+                                                                       LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Policy '" + policy
+                                                                               + "' had bad URL in new configuration, URL='" + propLocation + "'");
                                                                } catch (Exception e) {
                                                                        papUrls.failed();
-                                                                       if (e instanceof MalformedURLException) {
-                                                                               LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Policy '"
-                                                                                               + policy
-                                                                                               + "' had bad URL in new configuration, URL='"
-                                                                                               + propLocation + "'");
-                                                                               
-                                                                       } else {
-                                                                               LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Error while retrieving policy "
-                                                                                               + policy
-                                                                                               + " from URL "
-                                                                                               + url + ", e=" + e);
-                                                                       }
+                                                                       LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Error while retrieving policy "
+                                                                               + policy + " from URL " + url + ", e=" + e);
                                                                }
                                                                papUrls.getNext();
                                                        }

diff --git a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/api/services/PAPServices.java b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/api/services/PAPServices.java
index 5919484..3c0ea38 100644 (file)
--- a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/api/services/PAPServices.java
+++ b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/api/services/PAPServices.java
@@ -54,12 +54,16 @@ public class PAPServices {
     
     private int responseCode = 0;
     private static String environment = "DEVL";
-    public static Boolean junit = false;
+    private static Boolean isJunit = false;
     private static List<String> paps = null;
        private static final Object papResourceLock = new Object();
     private String operation = null;
     private String requestMethod = null;
-    private String encoding = null; 
+    private String encoding = null;
+
+    public static void setJunit(boolean isJunit) {
+        PAPServices.isJunit = isJunit;
+    }
 
     public PAPServices() {
         environment = PDPApiAuth.getEnvironment();
@@ -164,7 +168,7 @@ public class PAPServices {
                 } else if(content != null){
                     // the content is an object to be encoded in JSON
                     ObjectMapper mapper = new ObjectMapper();
-                    if (!junit) {
+                    if (!isJunit) {
                         mapper.writeValue(connection.getOutputStream(),
                                 content);
                     }
@@ -174,7 +178,7 @@ public class PAPServices {
                 responseCode = connection.getResponseCode();
                 // If Connected to PAP then break from the loop and continue
                 // with the Request
-                if (connection.getResponseCode() > 0 || junit) {
+                if (connection.getResponseCode() > 0 || isJunit) {
                     connected = true;
                     break;
                 } else {
@@ -183,7 +187,7 @@ public class PAPServices {
                 }
             } catch (Exception e) {
                 // This means that the PAP is not working
-                if (junit) {
+                if (isJunit) {
                     connected = true;
                     break;
                 }
@@ -212,7 +216,7 @@ public class PAPServices {
                                        XACMLErrorConstants.ERROR_SYSTEM_ERROR
                                        + "Decoding the result ", e);
                }
-               if (junit) {
+               if (isJunit) {
                        response = SUCCESS;
                }
             }else{
@@ -326,10 +330,10 @@ public class PAPServices {
     
     private String checkResponse(HttpURLConnection connection, UUID requestID) throws IOException {
         String response = null;
-        if (responseCode == 200 || junit) {         
+        if (responseCode == 200 || isJunit) {         
             // Check for successful creation of policy
             String isSuccess = null;
-            if (!junit) { // is this a junit test?
+            if (!isJunit) { // is this a junit test?
                 isSuccess = connection.getHeaderField("successMapKey");
                 operation = connection.getHeaderField("operation");
             } else {
@@ -603,7 +607,7 @@ public class PAPServices {
                 responseCode = connection.getResponseCode();
                 // If Connected to PAP then break from the loop and continue
                 // with the Request
-                if (connection.getResponseCode() > 0 || junit) {
+                if (connection.getResponseCode() > 0 || isJunit) {
                     connected = true;
                     break;
                 } else {
@@ -612,7 +616,7 @@ public class PAPServices {
                 }
             } catch (Exception e) {
                 // This means that the PAP is not working
-                if (junit) {
+                if (isJunit) {
                     connected = true;
                     break;
                 }

diff --git a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/BRMSParamPolicyServiceTest.java b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/BRMSParamPolicyServiceTest.java
index 8867a78..23e47f4 100644 (file)
--- a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/BRMSParamPolicyServiceTest.java
+++ b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/BRMSParamPolicyServiceTest.java
@@ -50,7 +50,7 @@ public class BRMSParamPolicyServiceTest {
                String succeeded = prop.getProperty("xacml.rest.pap.url");
                List<String> paps = Arrays.asList(succeeded.split(","));
                PAPServices.setPaps(paps);
-               PAPServices.junit = true;
+               PAPServices.setJunit(true);
                
                PolicyParameters policyParameters = new PolicyParameters();
         policyParameters.setPolicyConfigType(PolicyConfigType.BRMS_PARAM);
@@ -80,7 +80,7 @@ public class BRMSParamPolicyServiceTest {
        @After
        public void tearDown() throws Exception {
                PAPServices.setPaps(null);
-               PAPServices.junit = false;
+               PAPServices.setJunit(false);
        }
 
        @Test

diff --git a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/ClosedLoopFaultPolicyServiceTest.java b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/ClosedLoopFaultPolicyServiceTest.java
index de884b3..c21bc9c 100644 (file)
--- a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/ClosedLoopFaultPolicyServiceTest.java
+++ b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/ClosedLoopFaultPolicyServiceTest.java
@@ -47,7 +47,7 @@ public class ClosedLoopFaultPolicyServiceTest {
                        String succeeded = prop.getProperty("xacml.rest.pap.url");
                        List<String> paps = Arrays.asList(succeeded.split(","));
                        PAPServices.setPaps(paps);
-                       PAPServices.junit = true;
+                       PAPServices.setJunit(true);
                        
                        PolicyParameters policyParameters = new PolicyParameters();
                policyParameters.setPolicyConfigType(PolicyConfigType.ClosedLoop_Fault);
@@ -69,7 +69,7 @@ public class ClosedLoopFaultPolicyServiceTest {
                @After
                public void tearDown() throws Exception {
                        PAPServices.setPaps(null);
-                       PAPServices.junit = false;
+                       PAPServices.setJunit(false);
                }
 
                @Test

diff --git a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/ClosedLoopPMPolicyServiceTest.java b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/ClosedLoopPMPolicyServiceTest.java
index 19bb279..99dc677 100644 (file)
--- a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/ClosedLoopPMPolicyServiceTest.java
+++ b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/ClosedLoopPMPolicyServiceTest.java
@@ -47,7 +47,7 @@ public class ClosedLoopPMPolicyServiceTest {
                String succeeded = prop.getProperty("xacml.rest.pap.url");
                List<String> paps = Arrays.asList(succeeded.split(","));
                PAPServices.setPaps(paps);
-               PAPServices.junit = true;
+               PAPServices.setJunit(true);
                
                PolicyParameters policyParameters = new PolicyParameters();
         policyParameters.setPolicyConfigType(PolicyConfigType.ClosedLoop_PM);
@@ -69,7 +69,7 @@ public class ClosedLoopPMPolicyServiceTest {
        @After
        public void tearDown() throws Exception {
                PAPServices.setPaps(null);
-               PAPServices.junit = false;
+               PAPServices.setJunit(false);
        }
 
        @Test

diff --git a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/DecisionPolicyServiceTest.java b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/DecisionPolicyServiceTest.java
index 0fcb002..fe06681 100644 (file)
--- a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/DecisionPolicyServiceTest.java
+++ b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/DecisionPolicyServiceTest.java
@@ -49,7 +49,7 @@ public class DecisionPolicyServiceTest {
                String succeeded = prop.getProperty("xacml.rest.pap.url");
                List<String> paps = Arrays.asList(succeeded.split(","));
                PAPServices.setPaps(paps);
-               PAPServices.junit = true;
+               PAPServices.setJunit(true);
                
                PolicyParameters policyParameters = new PolicyParameters();
                policyParameters.setPolicyClass(PolicyClass.Decision);
@@ -94,7 +94,7 @@ public class DecisionPolicyServiceTest {
        @After
        public void tearDown() throws Exception {
                PAPServices.setPaps(null);
-               PAPServices.junit = false;
+               PAPServices.setJunit(false);
        }
 
        @Test

diff --git a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/FirewallPolicyServiceTest.java b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/FirewallPolicyServiceTest.java
index 4343a50..ccedd75 100644 (file)
--- a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/FirewallPolicyServiceTest.java
+++ b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/FirewallPolicyServiceTest.java
@@ -46,7 +46,7 @@ public class FirewallPolicyServiceTest {
                String succeeded = prop.getProperty("xacml.rest.pap.url");
                List<String> paps = Arrays.asList(succeeded.split(","));
                PAPServices.setPaps(paps);
-               PAPServices.junit = true;
+               PAPServices.setJunit(true);
                
                PolicyParameters policyParameters = new PolicyParameters();
         policyParameters.setPolicyConfigType(PolicyConfigType.Firewall); //required
@@ -67,7 +67,7 @@ public class FirewallPolicyServiceTest {
        @After
        public void tearDown() throws Exception {
                PAPServices.setPaps(null);
-               PAPServices.junit = false;
+               PAPServices.setJunit(false);
        }
 
        @Test

diff --git a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/MicroServicesPolicyServiceTest.java b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/MicroServicesPolicyServiceTest.java
index a9301e7..e460a85 100644 (file)
--- a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/MicroServicesPolicyServiceTest.java
+++ b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/MicroServicesPolicyServiceTest.java
@@ -47,7 +47,7 @@ public class MicroServicesPolicyServiceTest {
                String succeeded = prop.getProperty("xacml.rest.pap.url");
                List<String> paps = Arrays.asList(succeeded.split(","));
                PAPServices.setPaps(paps);
-               PAPServices.junit = true;
+               PAPServices.setJunit(true);
                
                PolicyParameters policyParameters = new PolicyParameters();
         policyParameters.setPolicyConfigType(PolicyConfigType.MicroService);
@@ -69,7 +69,7 @@ public class MicroServicesPolicyServiceTest {
        @After
        public void tearDown() throws Exception {
                PAPServices.setPaps(null);
-               PAPServices.junit = false;
+               PAPServices.setJunit(false);
        }
 
        @Test

diff --git a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/PAPServicesTest.java b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/PAPServicesTest.java
index 9d1d139..93fde84 100644 (file)
--- a/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/PAPServicesTest.java
+++ b/ONAP-PDP-REST/src/test/java/org/onap/policy/pdp/rest/api/services/PAPServicesTest.java
@@ -40,7 +40,7 @@ public class PAPServicesTest {
 
        @Before
        public void setUp() throws Exception {
-               PAPServices.junit = true;
+               PAPServices.setJunit(true);
                Properties prop = new Properties();
                prop.load(new FileInputStream("src/test/resources/pass.xacml.pdp.properties"));
                String succeeded = prop.getProperty("xacml.rest.pap.url");
@@ -53,7 +53,7 @@ public class PAPServicesTest {
        @After
        public void tearDown() throws Exception {
                PAPServices.setPaps(null);
-               PAPServices.junit = false;
+               PAPServices.setJunit(false);
        }
 
        @Test