Fix final 10 vulnerabilities in policy/engine

Code fixes for final 10 vulnerabilities in policy/engine

Change-Id: I234194b596bdacd5f3f9fd1becd4da9d6d0b5cf4
Issue-ID: POLICY-662
Signed-off-by: eramkve <ram.krishna.verma@ericsson.com>

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/XACMLPapServlet.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/XACMLPapServlet.java
index 9564acc..a30c9c7 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/XACMLPapServlet.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/XACMLPapServlet.java
@@ -792,7 +792,6 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                } else {
                        PolicyLogger.info("requestID was provided in call to XACMLPapSrvlet (doGet)");
                }
-               try {
                        loggingContext.metricStarted();
                        XACMLRest.dumpRequest(request);
                        loggingContext.metricEnded();
@@ -907,7 +906,18 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                                                request.getRemoteHost().equals(request.getLocalAddr())) {
                                        // Return status information - basically all the groups
                                        loggingContext.setServiceName("PAP.getGroups");
-                                       Set<OnapPDPGroup> groups = papEngine.getOnapPDPGroups();
+                                       Set<OnapPDPGroup> groups = null;
+                                       try {
+                                           groups = papEngine.getOnapPDPGroups();
+                                       } catch(PAPException e) {
+                                           LOGGER.debug(e);
+                                           PolicyLogger.error(MessageCodes.ERROR_UNKNOWN, e, "XACMLPapServlet", " GET exception");
+                                           loggingContext.transactionEnded();
+                                           PolicyLogger.audit("Transaction Failed - See Error.log");
+                                           setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
+                                           im.endTransaction();
+                                           return;
+                                       }
                                        // convert response object to JSON and include in the response
                                        mapperWriteValue(new ObjectMapper(), response,  groups);
                                        response.setHeader("content-type", "application/json");
@@ -984,15 +994,6 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                                PolicyLogger.audit("Transaction Failed - See Error.log");
                                setResponseError(response,HttpServletResponse.SC_NOT_FOUND, message);
                        }
-               }  catch (PAPException e) {
-                       LOGGER.debug(e);
-                       PolicyLogger.error(MessageCodes.ERROR_UNKNOWN, e, "XACMLPapServlet", " GET exception");
-                       loggingContext.transactionEnded();
-                       PolicyLogger.audit("Transaction Failed - See Error.log");
-                       setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
-                       im.endTransaction();
-                       return;
-               }
                loggingContext.transactionEnded();
                PolicyLogger.audit("Transaction Ended");
                im.endTransaction();
@@ -1892,7 +1893,16 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                                } else {
                                        // request is for top-level properties about all groups
                                        loggingContext.setServiceName("AC:PAP.getAllGroups");
-                                       Set<OnapPDPGroup> groups = papEngine.getOnapPDPGroups();
+                                       Set<OnapPDPGroup> groups = null;
+                                       try {
+                                           groups = papEngine.getOnapPDPGroups();
+                                       } catch(PAPException e) {
+                                           PolicyLogger.error(MessageCodes.ERROR_PROCESS_FLOW, e, "XACMLPapServlet", " AC Get exception");
+                                           loggingContext.transactionEnded();
+                                           PolicyLogger.audit("Transaction Failed - See Error.log");
+                                           setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
+                                           return;
+                                       }
                                        // convert response object to JSON and include in the response
                                        mapperWriteValue(new ObjectMapper(), response,  groups);
                                        if (LOGGER.isDebugEnabled()) {
@@ -2039,7 +2049,12 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                                LOGGER.info("JSON request from AC: " + json);
                                // convert Object sent as JSON into local object
                                ObjectMapper mapper = new ObjectMapper();
-                               Object objectFromJSON = mapper.readValue(json, StdPDP.class);
+                               Object objectFromJSON = null;
+                               try {
+                                   objectFromJSON = mapper.readValue(json, StdPDP.class);
+                               } catch(Exception e) {
+                                   LOGGER.error(e);
+                               }
                                if (pdpId == null ||
                                                objectFromJSON == null ||
                                                ! (objectFromJSON instanceof StdPDP) ||
@@ -2144,7 +2159,12 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                                LOGGER.info("JSON request from AC: " + json);
                                // convert Object sent as JSON into local object
                                ObjectMapper mapper = new ObjectMapper();
-                               Object objectFromJSON  = mapper.readValue(json, StdPDPGroup.class);
+                               Object objectFromJSON = null;
+                               try {
+                                   objectFromJSON  = mapper.readValue(json, StdPDPGroup.class);
+                               } catch(Exception e) {
+                                   LOGGER.error(e);
+                               }
                                if (objectFromJSON == null || ! (objectFromJSON instanceof StdPDPGroup) ||
                                                ! ((StdPDPGroup)objectFromJSON).getId().equals(group.getId())) {
                                        PolicyLogger.error(MessageCodes.ERROR_DATA_ISSUE + " Group update had bad input. id=" + group.getId() + " objectFromJSON="+objectFromJSON);
@@ -2209,14 +2229,6 @@ public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeList
                        PolicyLogger.audit("Transaction Failed - See Error.log");
                        setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
                        return;
-               } catch (IOException | JsonException e) {
-                   LOGGER.debug(e);
-                   acPutTransaction.rollbackTransaction();
-                   PolicyLogger.error(MessageCodes.ERROR_PROCESS_FLOW, e, "XACMLPapServlet", " AC PUT exception");
-                   loggingContext.transactionEnded();
-                   PolicyLogger.audit("Transaction Failed - See Error.log");
-                   setResponseError(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
-                   return;
                }
        }
        

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/ActionPolicyDictionaryController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/ActionPolicyDictionaryController.java
index 3d275c3..59a7ed3 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/ActionPolicyDictionaryController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/ActionPolicyDictionaryController.java
@@ -64,7 +64,7 @@ public class ActionPolicyDictionaryController {
        }
 
        private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
        
        @RequestMapping(value={"/get_ActionPolicyDictDataByName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/BRMSDictionaryController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/BRMSDictionaryController.java
index f07ca34..0ab5cf9 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/BRMSDictionaryController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/BRMSDictionaryController.java
@@ -91,7 +91,7 @@ public class BRMSDictionaryController{
        }
        
        private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
 
        @RequestMapping(value={"/get_BRMSParamDataByName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/ClosedLoopDictionaryController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/ClosedLoopDictionaryController.java
index 2b05567..5d28c82 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/ClosedLoopDictionaryController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/ClosedLoopDictionaryController.java
@@ -89,7 +89,7 @@ public class ClosedLoopDictionaryController{
        }
 
        private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
        
        @RequestMapping(value={"/get_VSCLActionDataByName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DecisionPolicyDictionaryController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DecisionPolicyDictionaryController.java
index 9b79303..6e68d78 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DecisionPolicyDictionaryController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DecisionPolicyDictionaryController.java
@@ -66,7 +66,7 @@ public class DecisionPolicyDictionaryController {
        }
        
        private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
        
        @RequestMapping(value={"/get_SettingsDictionaryDataByName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DescriptiveDictionaryController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DescriptiveDictionaryController.java
index 364a4f7..db71096 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DescriptiveDictionaryController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DescriptiveDictionaryController.java
@@ -65,7 +65,7 @@ public class DescriptiveDictionaryController {
        }
 
        private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
        
        @RequestMapping(value={"/get_DescriptiveScopeByName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryController.java
index 7e30635..0b7693c 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/DictionaryController.java
@@ -69,7 +69,7 @@ public class DictionaryController {
        }
        
        private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
        
        @RequestMapping(value={"/get_AttributeDatabyAttributeName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/FirewallDictionaryController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/FirewallDictionaryController.java
index d02cbca..bd1fb0e 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/FirewallDictionaryController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/FirewallDictionaryController.java
@@ -113,7 +113,7 @@ public class FirewallDictionaryController {
        }       
 
        private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
        
        @RequestMapping(value={"/get_PrefixListDataByName"}, method={RequestMethod.GET} , produces=MediaType.APPLICATION_JSON_VALUE)

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/MicroServiceDictionaryController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/MicroServiceDictionaryController.java
index 20e75a0..becf5ad 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/MicroServiceDictionaryController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/MicroServiceDictionaryController.java
@@ -92,7 +92,7 @@ public class MicroServiceDictionaryController {
     }  
        
     private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
     
        @Autowired

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/PolicyScopeDictionaryController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/PolicyScopeDictionaryController.java
index 40c9d72..fd3d2f6 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/PolicyScopeDictionaryController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/PolicyScopeDictionaryController.java
@@ -71,7 +71,7 @@ public class PolicyScopeDictionaryController {
        }       
 
        private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
        
        @Autowired

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/SafePolicyController.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/SafePolicyController.java
index 23450cb..209ba4f 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/SafePolicyController.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/controller/SafePolicyController.java
@@ -66,7 +66,7 @@ public class SafePolicyController {
        }       
        
        private DictionaryUtils getDictionaryUtilsInstance(){
-               return DictionaryUtils.dictionaryUtils != null ? DictionaryUtils.getDictionaryUtils() : new DictionaryUtils();
+               return DictionaryUtils.getDictionaryUtils();
        }
        
        @RequestMapping(value = { "/get_RiskTypeDataByName" }, method = {RequestMethod.GET }, produces = MediaType.APPLICATION_JSON_VALUE)

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/util/DictionaryUtils.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/util/DictionaryUtils.java
index e185959..5610577 100644 (file)
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/util/DictionaryUtils.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/util/DictionaryUtils.java
@@ -58,10 +58,10 @@ public class DictionaryUtils {
        
        private static CommonClassDao commonClassDao;
        
-       public static DictionaryUtils dictionaryUtils;
+       private static DictionaryUtils dictionaryUtils;
        
        public static synchronized DictionaryUtils getDictionaryUtils() {
-               return dictionaryUtils;
+           return dictionaryUtils != null ? dictionaryUtils : new DictionaryUtils();
        }
 
        public static synchronized void setDictionaryUtils(DictionaryUtils dictionaryUtils) {