Persistent XSS vulnerability in microservices form
[portal.git] / ecomp-portal-BE-common / src / main / java / org / onap / portalapp / portal / controller / MicroserviceController.java
1 /*-
2  * ============LICENSE_START==========================================
3  * ONAP Portal
4  * ===================================================================
5  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6  * ===================================================================
7  *
8  * Unless otherwise specified, all software contained herein is licensed
9  * under the Apache License, Version 2.0 (the "License");
10  * you may not use this software except in compliance with the License.
11  * You may obtain a copy of the License at
12  *
13  *             http://www.apache.org/licenses/LICENSE-2.0
14  *
15  * Unless required by applicable law or agreed to in writing, software
16  * distributed under the License is distributed on an "AS IS" BASIS,
17  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18  * See the License for the specific language governing permissions and
19  * limitations under the License.
20  *
21  * Unless otherwise specified, all documentation contained herein is licensed
22  * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
23  * you may not use this documentation except in compliance with the License.
24  * You may obtain a copy of the License at
25  *
26  *             https://creativecommons.org/licenses/by/4.0/
27  *
28  * Unless required by applicable law or agreed to in writing, documentation
29  * distributed under the License is distributed on an "AS IS" BASIS,
30  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
31  * See the License for the specific language governing permissions and
32  * limitations under the License.
33  *
34  * ============LICENSE_END============================================
35  *
36  * 
37  */
38 package org.onap.portalapp.portal.controller;
39
40 import java.util.List;
41
42 import java.util.Set;
43 import javax.servlet.http.HttpServletRequest;
44 import javax.servlet.http.HttpServletResponse;
45
46 import javax.validation.ConstraintViolation;
47 import javax.validation.Valid;
48 import javax.validation.Validation;
49 import javax.validation.Validator;
50 import javax.validation.ValidatorFactory;
51 import org.onap.portalapp.controller.EPRestrictedBaseController;
52 import org.onap.portalapp.portal.domain.MicroserviceData;
53 import org.onap.portalapp.portal.domain.WidgetCatalog;
54 import org.onap.portalapp.portal.domain.WidgetServiceHeaders;
55 import org.onap.portalapp.portal.ecomp.model.PortalRestResponse;
56 import org.onap.portalapp.portal.ecomp.model.PortalRestStatusEnum;
57 import org.onap.portalapp.portal.logging.aop.EPAuditLog;
58 import org.onap.portalapp.portal.service.WidgetMService;
59 import org.onap.portalapp.portal.service.MicroserviceService;
60 import org.onap.portalapp.portal.utils.EcompPortalUtils;
61 import org.onap.portalapp.validation.DataValidator;
62 import org.onap.portalsdk.core.util.SystemProperties;
63 import org.springframework.beans.factory.annotation.Autowired;
64 import org.springframework.context.annotation.EnableAspectJAutoProxy;
65 import org.springframework.core.ParameterizedTypeReference;
66 import org.springframework.http.HttpEntity;
67 import org.springframework.http.HttpMethod;
68 import org.springframework.http.ResponseEntity;
69 import org.springframework.web.bind.annotation.PathVariable;
70 import org.springframework.web.bind.annotation.RequestBody;
71 import org.springframework.web.bind.annotation.RequestMapping;
72 import org.springframework.web.bind.annotation.RequestMethod;
73 import org.springframework.web.bind.annotation.RestController;
74 import org.springframework.web.client.RestTemplate;
75
76 @SuppressWarnings("unchecked")
77 @RestController
78 @org.springframework.context.annotation.Configuration
79 @EnableAspectJAutoProxy
80 @EPAuditLog
81 public class MicroserviceController extends EPRestrictedBaseController {
82         private final DataValidator dataValidator = new DataValidator();
83         
84         String whatService = "widgets-service";
85         RestTemplate template = new RestTemplate();
86
87         @Autowired
88         private WidgetMService widgetMService;
89
90         @Autowired
91         private MicroserviceService microserviceService;
92
93         @RequestMapping(value = { "/portalApi/microservices" }, method = RequestMethod.POST)
94         public PortalRestResponse<String> createMicroservice(HttpServletRequest request, HttpServletResponse response,
95                         @Valid @RequestBody MicroserviceData newServiceData) throws Exception {
96                 if (newServiceData == null) {
97                         return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "FAILURE",
98                                 "MicroserviceData cannot be null or empty");
99                 }else {
100                         if(!dataValidator.isValid(newServiceData)){
101                                 return new PortalRestResponse<>(PortalRestStatusEnum.ERROR,
102                                         "ERROR", "MicroserviceData is not valid");
103                         }
104                 }
105                 long serviceId = microserviceService.saveMicroservice(newServiceData);
106
107                 try {
108                         microserviceService.saveServiceParameters(serviceId, newServiceData.getParameterList());
109                 } catch (Exception e) {
110                         return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "FAILURE", e.getMessage());
111                 }
112
113                 return new PortalRestResponse<>(PortalRestStatusEnum.OK, "SUCCESS", "");
114         }
115
116         @RequestMapping(value = { "/portalApi/microservices" }, method = RequestMethod.GET)
117         public List<MicroserviceData> getMicroservice(HttpServletRequest request, HttpServletResponse response)
118                         throws Exception {
119                 return microserviceService.getMicroserviceData();
120         }
121
122         @RequestMapping(value = { "/portalApi/microservices/{serviceId}" }, method = RequestMethod.PUT)
123         public PortalRestResponse<String> updateMicroservice(HttpServletRequest request, HttpServletResponse response,
124                         @PathVariable("serviceId") long serviceId, @Valid @RequestBody MicroserviceData newServiceData) {
125
126                 if (newServiceData == null) {
127                         return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "FAILURE",
128                                 "MicroserviceData cannot be null or empty");
129                 }else {
130                         if(!dataValidator.isValid(newServiceData)){
131                                 return new PortalRestResponse<>(PortalRestStatusEnum.ERROR,
132                                         "ERROR", "MicroserviceData is not valid");
133                         }
134                 }
135                 try {
136                         microserviceService.updateMicroservice(serviceId, newServiceData);
137                 } catch (Exception e) {
138                         return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "FAILURE", e.getMessage());
139                 }
140                 return new PortalRestResponse<>(PortalRestStatusEnum.OK, "SUCCESS", "");
141         }
142         
143         @RequestMapping(value = { "/portalApi/microservices/{serviceId}" }, method = RequestMethod.DELETE)
144         public PortalRestResponse<String> deleteMicroservice(HttpServletRequest request, HttpServletResponse response,
145                         @PathVariable("serviceId") long serviceId) {
146                 try {
147                         ParameterizedTypeReference<List<WidgetCatalog>> typeRef = new ParameterizedTypeReference<List<WidgetCatalog>>() {
148                         };
149                         // If this service is assoicated with widgets, cannnot be deleted
150                         ResponseEntity<List<WidgetCatalog>> ans = template.exchange(
151                                         EcompPortalUtils.widgetMsProtocol() + "://" + widgetMService.getServiceLocation(whatService, SystemProperties.getProperty("microservices.widget.local.port"))
152                                                         + "/widget/microservices/widgetCatalog/service/" + serviceId,
153                                         HttpMethod.GET, new HttpEntity(WidgetServiceHeaders.getInstance()), typeRef);
154                         List<WidgetCatalog> widgets = ans.getBody();
155                         if(widgets.size() == 0)
156                                 microserviceService.deleteMicroservice(serviceId);
157                         else{
158                                 StringBuilder sb = new StringBuilder();
159                                 for(int i = 0; i < widgets.size(); i++){
160                                         sb.append("'").append(widgets.get(i).getName()).append("' ");
161                                         if(i < (widgets.size()-1)){
162                                                 sb.append(",");
163                                         }
164                                 }
165                                 return new PortalRestResponse<>(PortalRestStatusEnum.WARN, "SOME WIDGETS ASSOICATE WITH THIS SERVICE",
166                                         sb.toString());
167                         }
168                 } catch (Exception e) {
169                         return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "FAILURE", e.getMessage());
170                 }
171                 return new PortalRestResponse<>(PortalRestStatusEnum.OK, "SUCCESS", "");
172         }
173
174 }