Persistent XSS vulnerability in basicAuthAccount form fix

[portal.git] / ecomp-portal-BE-common / src / main / java / org / onap / portalapp / portal / service / BasicAuthAccountServiceImpl.java

diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/BasicAuthAccountServiceImpl.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/BasicAuthAccountServiceImpl.java
index e6b7c6e..98b0f12 100644 (file)
--- a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/BasicAuthAccountServiceImpl.java
+++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/BasicAuthAccountServiceImpl.java
@@ -33,7 +33,7 @@
  *
  * ============LICENSE_END============================================
  *
- * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ * 
  */
 package org.onap.portalapp.portal.service;
 
@@ -48,6 +48,8 @@ import org.onap.portalapp.portal.domain.BasicAuthCredentials;
 import org.onap.portalapp.portal.domain.EPEndpoint;
 import org.onap.portalapp.portal.domain.EPEndpointAccount;
 import org.onap.portalapp.portal.logging.aop.EPMetricsLog;
+import org.onap.portalapp.portal.utils.EPCommonSystemProperties;
+import org.onap.portalapp.validation.DataValidator;
 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
 import org.onap.portalsdk.core.onboarding.util.CipherUtil;
 import org.onap.portalsdk.core.service.DataAccessService;
@@ -61,12 +63,16 @@ import org.springframework.stereotype.Service;
 @EPMetricsLog
 public class BasicAuthAccountServiceImpl implements BasicAuthAccountService{
        EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(MicroserviceServiceImpl.class);
-
+       private final DataValidator dataValidator = new DataValidator();
        @Autowired
        private DataAccessService dataAccessService;
 
        @Override
        public Long saveBasicAuthAccount(BasicAuthCredentials newCredential) throws Exception {
+
+               if(!dataValidator.isValid(newCredential)){
+                       throw new Exception("saveBasicAuthAccount() failed, new credential are not safe");
+               }
                if (newCredential.getPassword() != null)
                        newCredential.setPassword(encryptedPassword(newCredential.getPassword()));
                try{
@@ -117,8 +123,13 @@ public class BasicAuthAccountServiceImpl implements BasicAuthAccountService{
        public void updateBasicAuthAccount(Long accountId, BasicAuthCredentials newCredential) throws Exception {
                try {
                        newCredential.setId(accountId);
-                       if (newCredential.getPassword() != null)
-                               newCredential.setPassword(encryptedPassword(newCredential.getPassword()));
+                       if (newCredential.getPassword() != null){
+                               if(newCredential.getPassword().equals(EPCommonSystemProperties.APP_DISPLAY_PASSWORD)){
+                                       BasicAuthCredentials oldMS = getBasicAuthCredentialsById(accountId);
+                                       newCredential.setPassword(oldMS.getPassword()); // keep the old password
+                               }else
+                                       newCredential.setPassword(encryptedPassword(newCredential.getPassword())); //new password
+                       }
                        getDataAccessService().saveDomainObject(newCredential, null);
                        
                        List<EPEndpoint> endpoints = newCredential.getEndpoints();
@@ -174,7 +185,7 @@ public class BasicAuthAccountServiceImpl implements BasicAuthAccountService{
                List<BasicAuthCredentials> list = (List<BasicAuthCredentials>) dataAccessService.getList(BasicAuthCredentials.class, null);
                for (int i = 0; i < list.size(); i++) {
                        if (list.get(i).getPassword() != null)
-                               list.get(i).setPassword(decryptedPassword(list.get(i).getPassword()));
+                               list.get(i).setPassword(EPCommonSystemProperties.APP_DISPLAY_PASSWORD);
                        list.get(i).setEndpoints(getEPEndpoints(list.get(i).getId()));
                }
                return list;
@@ -215,7 +226,7 @@ public class BasicAuthAccountServiceImpl implements BasicAuthAccountService{
        
        private String decryptedPassword(String encryptedPwd) throws Exception {
                String result = "";
-               if (encryptedPwd != null & encryptedPwd.length() > 0) {
+               if (encryptedPwd != null && encryptedPwd.length() > 0) {
                        try {
                                result = CipherUtil.decryptPKC(encryptedPwd,
                                                SystemProperties.getProperty(SystemProperties.Decryption_Key));
@@ -229,7 +240,7 @@ public class BasicAuthAccountServiceImpl implements BasicAuthAccountService{
 
        private String encryptedPassword(String decryptedPwd) throws Exception {
                String result = "";
-               if (decryptedPwd != null & decryptedPwd.length() > 0) {
+               if (decryptedPwd != null && decryptedPwd.length() > 0) {
                        try {
                                result = CipherUtil.encryptPKC(decryptedPwd,
                                                SystemProperties.getProperty(SystemProperties.Decryption_Key));
@@ -244,4 +255,22 @@ public class BasicAuthAccountServiceImpl implements BasicAuthAccountService{
        public DataAccessService getDataAccessService() {
                return dataAccessService;
        }
+       
+       @Override
+       public BasicAuthCredentials getBasicAuthCredentialsById(long id) throws Exception {
+               try {
+                       @SuppressWarnings("unchecked")
+                       List<BasicAuthCredentials> list = (List<BasicAuthCredentials>) dataAccessService
+                                       .getList(BasicAuthCredentials.class, null);
+                       for (BasicAuthCredentials auth : list) {
+                               if (auth != null && auth.getId() == id)
+                                       return auth;
+                       }
+               } catch (Exception e) {
+                       logger.error(EELFLoggerDelegate.errorLogger, "getBasicAuthCredentialsDataById failed", e);
+                       throw e;
+               }
+               return null;
+
+       }
 }