Reflected XSS vulnerability in saveNotification form fix.

[portal.git] / ecomp-portal-BE-common / src / main / java / org / onap / portalapp / portal / controller / ExternalAppsRestfulController.java

diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/controller/ExternalAppsRestfulController.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/controller/ExternalAppsRestfulController.java
index bd2b0a1..7615b66 100644 (file)
--- a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/controller/ExternalAppsRestfulController.java
+++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/controller/ExternalAppsRestfulController.java
@@ -4,6 +4,8 @@
  * ===================================================================
  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
  * ===================================================================
+ *  Modifications Copyright (c) 2019 Samsung
+ * ===================================================================
  *
  * Unless otherwise specified, all software contained herein is licensed
  * under the Apache License, Version 2.0 (the "License");
@@ -33,7 +35,7 @@
  *
  * ============LICENSE_END============================================
  *
- * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ * 
  */
 package org.onap.portalapp.portal.controller;
 
@@ -64,6 +66,8 @@ import org.onap.portalapp.portal.transport.FunctionalMenuItem;
 import org.onap.portalapp.portal.utils.EPCommonSystemProperties;
 import org.onap.portalapp.portal.utils.EcompPortalUtils;
 import org.onap.portalapp.portal.utils.PortalConstants;
+import org.onap.portalapp.validation.DataValidator;
+import org.onap.portalapp.validation.SecureString;
 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
 import org.onap.portalsdk.core.onboarding.crossapi.PortalAPIResponse;
 import org.slf4j.MDC;
@@ -88,6 +92,7 @@ import io.swagger.annotations.ApiOperation;
 public class ExternalAppsRestfulController extends EPRestrictedRESTfulBaseController {
 
        private EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(ExternalAppsRestfulController.class);
+       private final DataValidator DATA_VALIDATOR = new DataValidator();
 
        @Autowired
        private FunctionalMenuService functionalMenuService;
@@ -109,14 +114,21 @@ public class ExternalAppsRestfulController extends EPRestrictedRESTfulBaseContro
        @ResponseBody
        public PortalAPIResponse publishNotification(HttpServletRequest request,
                        @RequestBody EpNotificationItem notificationItem) throws Exception {
+
+               if(!DATA_VALIDATOR.isValid(notificationItem)){
+                       PortalAPIResponse response = new PortalAPIResponse(false, "failed");
+                       return response;
+               }
                String appKey = request.getHeader("uebkey");
                EPApp app = findEpApp(appKey);
                List<Long> postRoleIds = new ArrayList<Long>();
-               for (Long roleId : notificationItem.getRoleIds()) {
-                       EPRole role = epRoleService.getRole(app.getId(), roleId);
-                       if (role != null)
-                               postRoleIds.add(role.getId());
-               }
+               if (app != null) {
+        for (Long roleId : notificationItem.getRoleIds()) {
+            EPRole role = epRoleService.getRole(app.getId(), roleId);
+            if (role != null)
+                postRoleIds.add(role.getId());
+               }
+       }
 
                // --- recreate the user notification object with the POrtal Role Ids
                EpNotificationItem postItem = new EpNotificationItem();
@@ -151,10 +163,10 @@ public class ExternalAppsRestfulController extends EPRestrictedRESTfulBaseContro
                try {
                        list = this.getDataAccessService().executeNamedQuery("getMyAppDetailsByUebKey", params, null);
                } catch (Exception e) {
-                       logger.error(EELFLoggerDelegate.errorLogger, "getMyAppDetailsByUebKey failed", e);                      
+                       logger.error(EELFLoggerDelegate.errorLogger, "getMyAppDetailsByUebKey failed", e);
                }
                        
-               return (list == null || list.size() == 0) ? null : (EPApp) list.get(0);
+               return (list == null || list.isEmpty()) ? null : (EPApp) list.get(0);
        }
 
        @ApiOperation(value = "Gets favorite items within the functional menu for the current user.", response = FavoritesFunctionalMenuItemJson.class, responseContainer="List")