From: Sunder Tattavarada <statta@research.att.com>
Date: Tue, 18 Jun 2019 16:04:19 +0000 (+0000)
Subject: Merge "Fix sql injection vulnerability"
X-Git-Tag: 3.2.0~273
X-Git-Url: https://gerrit.onap.org/r/gitweb?p=portal.git;a=commitdiff_plain;h=80ddb55b9f5569c6443104150cb74ba2ae4fcb08;hp=89e5721f7e8e45fd0f26597a8b8082d90b47839c

Merge "Fix sql injection vulnerability"
---

diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java
index ae1670d2..39aed6ba 100644
--- a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java
+++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImpl.java
@@ -495,9 +495,13 @@ public class UserRolesCommonServiceImpl  {
 			transaction = localSession.beginTransaction();
 			// Attention! All roles from remote application supposed to be
 			// active!
+
 			@SuppressWarnings("unchecked")
-			List<EPRole> currentAppRoles = localSession
-					.createQuery("from " + EPRole.class.getName() + " where appId=" + appId).list();
+			List<EPRole> currentAppRoles = localSession.createQuery("from :name where appId = :appId")
+					.setParameter("name",EPRole.class.getName())
+					.setParameter("appId",appId)
+					.list();
+
 			List<EPRole> obsoleteRoles = new ArrayList<EPRole>();
 			for (int i = 0; i < currentAppRoles.size(); i++) {
 				EPRole oldAppRole = currentAppRoles.get(i);
diff --git a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImplTest.java b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImplTest.java
index f58e90f5..d3ac4b9e 100644
--- a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImplTest.java
+++ b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/service/UserRolesCommonServiceImplTest.java
@@ -446,8 +446,13 @@ public class UserRolesCommonServiceImplTest {
 		Mockito.when(applicationsRestClientService.get(EcompRole[].class, mockApp.getId(), "/roles"))
 				.thenReturn(mockEcompRoleArray);
 		// syncAppRolesTest
-		Mockito.when(session.createQuery("from " + EPRole.class.getName() + " where appId=" + mockApp.getId()))
+
+		Mockito.when(session.createQuery("from :name where appId = :appId"))
 				.thenReturn(epRoleQuery);
+
+		Mockito.when(epRoleQuery.setParameter("name",EPRole.class.getName())).thenReturn(epRoleQuery);
+		Mockito.when(epRoleQuery.setParameter("appId",mockApp.getId())).thenReturn(epRoleQuery);
+
 		Mockito.doReturn(mockEPRoleList).when(epRoleQuery).list();
 		Mockito.when(session.createQuery(
 				"from " + EPUserApp.class.getName() + " where app.id=" + mockApp.getId() + " and role_id=" + 15l))