Remove insecure dependency on PolicyEngineAPI

The insecure dependency tyrus-container-grizzly-client is
part of Tyrus, a Java web socket implementation library.

A direct substitution of this library is not available so
the code in AutoClientEnd.java and ManualClientEnd.java
was adapted to work with the library
org.java-websocket.Java-WebSocket
that does not seem to have any vulnerabilities when tested
with the org.owasp.dependency-check-maven plugin.

The purpose of this submission is to see if the new library
does indeed remove the vulnerability. If so, the implementation
in AutoClientEnd and ManualClientEnd must be cleaned up.

Change-Id: I961635aaea42c2f847edf11ee77e2961cdfb097b
Issue-ID: POLICY-744
Signed-off-by: liamfallon <liam.fallon@ericsson.com>

diff --git a/PolicyEngineAPI/pom.xml b/PolicyEngineAPI/pom.xml
index 4b1cc45..ebfab47 100644 (file)
--- a/PolicyEngineAPI/pom.xml
+++ b/PolicyEngineAPI/pom.xml
@@ -60,19 +60,14 @@
                        <version>1.1</version>
                </dependency>
                <dependency>
-                       <groupId>org.glassfish.tyrus</groupId>
-                       <artifactId>tyrus-client</artifactId>
-                       <version>1.13</version>
-               </dependency>
-               <dependency>
-                       <groupId>org.glassfish.tyrus</groupId>
-                       <artifactId>tyrus-container-grizzly-client</artifactId>
-                       <version>1.13</version>
+                       <groupId>org.java-websocket</groupId>
+                       <artifactId>Java-WebSocket</artifactId>
+                       <version>1.3.8</version>
                </dependency>
                <dependency>
                        <groupId>org.springframework</groupId>
                        <artifactId>spring-webmvc</artifactId>
-                       <version>4.3.3.RELEASE</version>
+                       <version>4.3.15.RELEASE</version>
                </dependency>
                <dependency>
                    <groupId>com.google.code.gson</groupId>

diff --git a/PolicyEngineAPI/src/main/java/org/onap/policy/std/AutoClientEnd.java b/PolicyEngineAPI/src/main/java/org/onap/policy/std/AutoClientEnd.java
index 6a1c586..3f97e19 100644 (file)
--- a/PolicyEngineAPI/src/main/java/org/onap/policy/std/AutoClientEnd.java
+++ b/PolicyEngineAPI/src/main/java/org/onap/policy/std/AutoClientEnd.java
@@ -22,17 +22,16 @@ package org.onap.policy.std;
 
 import java.io.IOException;
 import java.net.URI;
-import java.net.URISyntaxException;
 
 import javax.websocket.ClientEndpoint;
-import javax.websocket.DeploymentException;
 import javax.websocket.OnClose;
 import javax.websocket.OnError;
 import javax.websocket.OnMessage;
 import javax.websocket.OnOpen;
 import javax.websocket.Session;
 
-import org.glassfish.tyrus.client.ClientManager;
+import org.java_websocket.client.WebSocketClient;
+import org.java_websocket.handshake.ServerHandshake;
 import org.onap.policy.api.NotificationHandler;
 import org.onap.policy.api.NotificationScheme;
 import org.onap.policy.api.NotificationType;
@@ -42,10 +41,10 @@ import org.onap.policy.common.logging.flexlogger.Logger;
 import org.onap.policy.xacml.api.XACMLErrorConstants; 
 
 @ClientEndpoint
-public class AutoClientEnd {
+public class AutoClientEnd extends WebSocketClient {
        private static StdPDPNotification notification = null;
        private static StdPDPNotification oldNotification = null;
-       private static ClientManager client = null;
+       private static AutoClientEnd client = null;
        private static NotificationScheme scheme = null;
        private static NotificationHandler handler = null;
        private static String url = null;
@@ -56,6 +55,30 @@ public class AutoClientEnd {
        private static boolean error = false;
        private static Logger logger = FlexLogger.getLogger(AutoClientEnd.class.getName());
        
+       private AutoClientEnd(URI serverUri) {
+               super(serverUri);
+       }
+
+       @Override
+       public void onClose(int arg0, String arg1, boolean arg2) {
+               // Not implemented
+       }
+
+       @Override
+       public void onError(Exception arg0) {
+               // Not implemented
+       }
+
+       @Override
+       public void onMessage(String arg0) {
+               // Not implemented
+       }
+
+       @Override
+       public void onOpen(ServerHandshake arg0) {
+               // Not implemented
+       }
+
        public static void setAuto(NotificationScheme scheme,
                        NotificationHandler handler) {
                AutoClientEnd.scheme = scheme;
@@ -83,17 +106,19 @@ public class AutoClientEnd {
                        AutoClientEnd.client != null) {
                        return;
                }
-               
-               // Stop and Start needs to be done.
-               client = ClientManager.createClient();
-               if(url.contains("https")){
+
+               if (url.contains("https")) {
                        url = url.replaceAll("https", "wss");
-               }else {
+               }
+               else {
                        url = url.replaceAll("http", "ws");
                }
+               
+               
+               // Stop and Start needs to be done.
                try {
                        logger.info("Starting Auto Notification with the PDP server : " + url);
-                       client.connectToServer(AutoClientEnd.class, new URI(url + "notifications"));
+                       client = new AutoClientEnd(new URI(url  + "notifications"));
                        status = true;
                        if(error){
                                // The URL's will be in Sync according to design Spec. 
@@ -107,7 +132,7 @@ public class AutoClientEnd {
                                error = false;
                        }
                        //
-               } catch (DeploymentException | IOException | URISyntaxException e) {
+               } catch (Exception e) {
                        logger.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR + e);
                        client = null;
                        status = false;
@@ -125,7 +150,7 @@ public class AutoClientEnd {
                if (client == null) {
                        return;
                }
-               client.shutdown();
+               client.close();
                if(session!=null){
                        try {
                                stop = true;

diff --git a/PolicyEngineAPI/src/main/java/org/onap/policy/std/ManualClientEnd.java b/PolicyEngineAPI/src/main/java/org/onap/policy/std/ManualClientEnd.java
index db3fdf1..991bdca 100644 (file)
--- a/PolicyEngineAPI/src/main/java/org/onap/policy/std/ManualClientEnd.java
+++ b/PolicyEngineAPI/src/main/java/org/onap/policy/std/ManualClientEnd.java
@@ -22,18 +22,17 @@ package org.onap.policy.std;
 
 import java.io.IOException;
 import java.net.URI;
-import java.net.URISyntaxException;
 import java.util.concurrent.CountDownLatch;
 
 import javax.websocket.ClientEndpoint;
-import javax.websocket.DeploymentException;
 import javax.websocket.OnClose;
 import javax.websocket.OnError;
 import javax.websocket.OnMessage;
 import javax.websocket.OnOpen;
 import javax.websocket.Session;
 
-import org.glassfish.tyrus.client.ClientManager;
+import org.java_websocket.client.WebSocketClient;
+import org.java_websocket.handshake.ServerHandshake;
 import org.onap.policy.api.NotificationScheme;
 import org.onap.policy.api.NotificationType;
 import org.onap.policy.api.PDPNotification;
@@ -44,24 +43,51 @@ import org.onap.policy.xacml.api.XACMLErrorConstants;
 import org.onap.policy.common.logging.flexlogger.*; 
 
 @ClientEndpoint
-public class ManualClientEnd {
+public class ManualClientEnd extends WebSocketClient {
        private static CountDownLatch latch;
        private static StdPDPNotification notification = null;
        private static String resultJson = null;
        private static Logger logger = FlexLogger.getLogger(ManualClientEnd.class.getName());
+       private static ManualClientEnd client;
        
+       public ManualClientEnd(URI serverUri) {
+               super(serverUri);
+       }
+
+       @Override
+       public void onClose(int arg0, String arg1, boolean arg2) {
+               // Not implemented
+       }
+
+       @Override
+       public void onError(Exception arg0) {
+               // Not implemented
+       }
+
+       @Override
+       public void onMessage(String arg0) {
+               // Not implemented
+       }
+
+       @Override
+       public void onOpen(ServerHandshake arg0) {
+               // Not implemented
+       }
+
        public static void start(String url) {
                latch = new CountDownLatch(1);
-               ClientManager client = ClientManager.createClient();
-               if(url.contains("https")){
+
+               if (url.contains("https")) {
                        url = url.replaceAll("https", "wss");
-               }else {
+               }
+               else {
                        url = url.replaceAll("http", "ws");
                }
+               
                try {
-                       client.connectToServer(ManualClientEnd.class, new URI(url+"notifications"));
+                       client = new ManualClientEnd(new URI(url+"notifications"));
                        latch.await();
-               } catch (DeploymentException | URISyntaxException | InterruptedException |IOException e) {
+               } catch (Exception e) {
                        logger.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR + e);
                }
        }
@@ -113,6 +139,7 @@ public class ManualClientEnd {
        public void onClose(Session session) {
                logger.info("Session ended with "+ session.getId());
                latch.countDown();
+               client.close();
        }
        
        @OnMessage

diff --git a/PolicyEngineAPI/src/test/java/org/onap/policy/std/test/ManualClientEndTest.java b/PolicyEngineAPI/src/test/java/org/onap/policy/std/test/ManualClientEndTest.java
index 2ae522c..b87fa74 100644 (file)
--- a/PolicyEngineAPI/src/test/java/org/onap/policy/std/test/ManualClientEndTest.java
+++ b/PolicyEngineAPI/src/test/java/org/onap/policy/std/test/ManualClientEndTest.java
@@ -23,6 +23,9 @@ package org.onap.policy.std.test;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 
+import java.net.URI;
+import java.net.URL;
+
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
@@ -45,8 +48,9 @@ public class ManualClientEndTest {
        @Test
        public void testManualClientEnd_1()
                throws Exception {
-               ManualClientEnd result = new ManualClientEnd();
-               assertNotNull(result);
+               ManualClientEnd mce = new ManualClientEnd(new URI("http://www.onap.org"));
+               assertNotNull(mce);
+               mce.close();
                // add additional test code here
        }
 
@@ -79,7 +83,7 @@ public class ManualClientEndTest {
        @Test
        public void testStart_1()
                throws Exception {
-               String url = "";
+               String url = "This is not a URL";
 
                ManualClientEnd.start(url);