Merge "Fix sql injection vulnerability"
[portal.git] / ecomp-portal-BE-common / src / main / java / org / onap / portalapp / portal / scheduleraux / SchedulerAuxRestInterface.java
index 599ada5..01a52cc 100644 (file)
@@ -4,6 +4,8 @@
  * ===================================================================
  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
  * ===================================================================
+ * Modifications Copyright (c) 2019 Samsung
+ * ===================================================================
  *
  * Unless otherwise specified, all software contained herein is licensed
  * under the Apache License, Version 2.0 (the "License");
  */
 package org.onap.portalapp.portal.scheduleraux;
 
-import java.text.DateFormat;
-import java.text.SimpleDateFormat;
-import java.util.Collections;
-import java.util.Date;
-
-import javax.ws.rs.client.Client;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
-
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonDeserializationContext;
+import com.google.gson.JsonDeserializer;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonParseException;
 import org.apache.commons.codec.binary.Base64;
+import org.apache.cxf.jaxrs.impl.ResponseImpl;
 import org.eclipse.jetty.util.security.Password;
 import org.json.simple.JSONObject;
+import org.onap.portalapp.portal.logging.format.EPAppMessagesEnum;
 import org.onap.portalapp.portal.logging.logic.EPLogUtil;
 import org.onap.portalapp.portal.scheduler.SchedulerProperties;
 import org.onap.portalapp.portal.scheduler.client.HttpBasicClient;
 import org.onap.portalapp.portal.scheduler.policy.rest.RequestDetails;
+import org.onap.portalapp.util.DateUtil;
 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
 import org.springframework.http.HttpStatus;
 import org.springframework.web.client.HttpClientErrorException;
 
+import javax.ws.rs.client.Client;
+import javax.ws.rs.client.Entity;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.MultivaluedHashMap;
+import javax.ws.rs.core.Response;
+import java.lang.reflect.Type;
+import java.text.SimpleDateFormat;
+import java.util.Collections;
+import java.util.Date;
+
 public class SchedulerAuxRestInterface extends SchedulerAuxRestInt implements SchedulerAuxRestInterfaceIfc {
 
        /** The logger. */
        EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(SchedulerAuxRestInterface.class);
 
-       /** The Constant dateFormat. */
-       final static DateFormat dateFormat = new SimpleDateFormat("HH:mm:ss:SSSS");
-
        /** The client. */
        private static Client client = null;
 
@@ -77,7 +85,27 @@ public class SchedulerAuxRestInterface extends SchedulerAuxRestInt implements Sc
                super();
        }
 
+       Gson gson = null;
+
+       private final ObjectMapper mapper = new ObjectMapper();
+
+       private void init() {
+               logger.debug(EELFLoggerDelegate.debugLogger, "initializing");
+               GsonBuilder builder = new GsonBuilder();
+
+               // Register an adapter to manage the date types as long values
+               builder.registerTypeAdapter(Date.class, new JsonDeserializer<Date>() {
+                       public Date deserialize(JsonElement json, Type typeOfT, JsonDeserializationContext context)
+                                       throws JsonParseException {
+                               return new Date(json.getAsJsonPrimitive().getAsLong());
+                       }
+               });
+
+               gson = builder.create();
+       }
+       
        public void initRestClient() {
+               init();
                final String methodname = "initRestClient()";
                final String mechId = SchedulerProperties.getProperty(SchedulerProperties.SCHEDULERAUX_CLIENT_MECHID_VAL);
                final String clientPassword = SchedulerProperties
@@ -115,6 +143,7 @@ public class SchedulerAuxRestInterface extends SchedulerAuxRestInt implements Sc
                String methodName = "Get";
 
                logger.debug(EELFLoggerDelegate.debugLogger, " start", methodName);
+               SimpleDateFormat dateFormat = DateUtil.getDateFormat();
 
                String url = "";
                restObject.set(t);
@@ -133,8 +162,8 @@ public class SchedulerAuxRestInterface extends SchedulerAuxRestInt implements Sc
                if (status == 200) {
                        t = (T) cres.readEntity(t.getClass());
                        restObject.set(t);
-                       logger.debug(EELFLoggerDelegate.debugLogger, " REST api was successfull!", dateFormat.format(new Date()),
-                                       methodName);
+                       logger.debug(EELFLoggerDelegate.debugLogger, " REST api was successfull!",
+                               dateFormat.format(new Date()), methodName);
 
                } else {
                        throw new Exception(methodName + " with status=" + status + ", url= " + url);
@@ -151,6 +180,7 @@ public class SchedulerAuxRestInterface extends SchedulerAuxRestInt implements Sc
                String methodName = "Delete";
                String url = "";
                Response cres = null;
+               SimpleDateFormat dateFormat = DateUtil.getDateFormat();
 
                logRequest(r);
 
@@ -159,7 +189,7 @@ public class SchedulerAuxRestInterface extends SchedulerAuxRestInt implements Sc
 
                        url = SchedulerProperties.getProperty(SchedulerProperties.SCHEDULERAUX_SERVER_URL_VAL) + path;
                        logger.debug(EELFLoggerDelegate.debugLogger, " methodName sending request to: ",
-                                       dateFormat.format(new Date()), url, methodName);
+                               dateFormat.format(new Date()), url, methodName);
 
                        cres = client.target(url).request().accept("application/json").headers(commonHeaders)
                                        // .entity(r)
@@ -203,8 +233,8 @@ public class SchedulerAuxRestInterface extends SchedulerAuxRestInt implements Sc
                                        url, e);
                        EPLogUtil.schedulerAccessAlarm(logger, e.getStatusCode().value());
                } catch (Exception e) {
-                       logger.error(EELFLoggerDelegate.errorLogger, "Exception with the URL ", dateFormat.format(new Date()),
-                                       methodName, url, e);
+                       logger.error(EELFLoggerDelegate.errorLogger, "Exception with the URL ",
+                               dateFormat.format(new Date()), methodName, url, e);
                        EPLogUtil.schedulerAccessAlarm(logger, HttpStatus.INTERNAL_SERVER_ERROR.value());
 
                        throw e;
@@ -234,7 +264,24 @@ public class SchedulerAuxRestInterface extends SchedulerAuxRestInt implements Sc
                                        // .header("X-FromAppId", sourceID)
                                        .post(Entity.entity(requestDetails, MediaType.APPLICATION_JSON));
 
-                       t = (T) cres.readEntity(t.getClass());
+                       /* It is not recommendable to use the implementation class org.apache.cxf.jaxrs.impl.ResponseImpl in the code, 
+                       but had to force this in-order to prevent conflict with the ResponseImpl class of Jersey Client which 
+                       doesn't work as expected. Created Portal-253 for tracking */
+                       String str = ((ResponseImpl)cres).readEntity(String.class);
+                       
+                       try {
+                               if(t.getClass().getName().equals(String.class.getName())){
+                                       t=(T) str;
+                                       
+                               }else{
+                                       t = (T) gson.fromJson(str, t.getClass());
+                               }
+                               
+                       } catch (Exception e) {
+                               EPLogUtil.logEcompError(logger, EPAppMessagesEnum.BeInvalidJsonInput, e);
+                       }
+                       
+                       //t = (T) cres.readEntity(t.getClass());
                        if (t.equals("")) {
                                restObject.set(null);
                        } else {
@@ -275,4 +322,4 @@ public class SchedulerAuxRestInterface extends SchedulerAuxRestInt implements Sc
        public void logRequest(RequestDetails r) {
                // TODO Auto-generated method stub
        }
-}
\ No newline at end of file
+}