From: Sunder Tattavarada <statta@research.att.com>
Date: Tue, 18 Jun 2019 16:04:28 +0000 (+0000)
Subject: Merge "Fix sql injection vulnerability"
X-Git-Tag: 3.2.0~272
X-Git-Url: https://gerrit.onap.org/r/gitweb?p=portal.git;a=commitdiff_plain;h=37ea104d5c99b4100381cc0e8e79be3feb98a0ec;hp=80ddb55b9f5569c6443104150cb74ba2ae4fcb08

Merge "Fix sql injection vulnerability"
---

diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java
index 39aed6ba..a440c311 100644
--- a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java
+++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java
@@ -539,7 +539,10 @@ public class UserRolesCommonServiceImpl  {
 					// Delete from fn_user_role
 					@SuppressWarnings("unchecked")
 					List<EPUserApp> userRoles = localSession.createQuery(
-							"from " + EPUserApp.class.getName() + " where app.id=" + appId + " and role_id=" + roleId)
+							"from :name where app.id=:appId and role_id=:roleId")
+							.setParameter("name",EPUserApp.class.getName())
+							.setParameter("appId",appId)
+							.setParameter("roleId",roleId)
 							.list();
 
 					logger.debug(EELFLoggerDelegate.debugLogger, "syncAppRoles: number of userRoles to delete: " + userRoles.size());
diff --git a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImplTest.java b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImplTest.java
index d3ac4b9e..680d766d 100644
--- a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImplTest.java
+++ b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImplTest.java
@@ -454,9 +454,11 @@ public class UserRolesCommonServiceImplTest {
 		Mockito.when(epRoleQuery.setParameter("appId",mockApp.getId())).thenReturn(epRoleQuery);
 
 		Mockito.doReturn(mockEPRoleList).when(epRoleQuery).list();
-		Mockito.when(session.createQuery(
-				"from " + EPUserApp.class.getName() + " where app.id=" + mockApp.getId() + " and role_id=" + 15l))
+		Mockito.when(session.createQuery("from :name where app.id=:appId and role_id=:roleId"))
 				.thenReturn(epUserAppsQuery);
+		Mockito.when(epUserAppsQuery.setParameter("name",EPUserApp.class.getName())).thenReturn(epUserAppsQuery);
+		Mockito.when(epUserAppsQuery.setParameter("appId",mockApp.getId())).thenReturn(epUserAppsQuery);
+		Mockito.when(epUserAppsQuery.setParameter("roleId",15l)).thenReturn(epUserAppsQuery);
 		Mockito.doReturn(mockUserRolesList).when(epUserAppsQuery).list();
 
 		Mockito.when(session.createQuery("from " + FunctionalMenuRole.class.getName() + " where roleId=" + 15l))