2 * ============LICENSE_START==========================================
4 * ===================================================================
5 * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
6 * ===================================================================
8 * Unless otherwise specified, all software contained herein is licensed
9 * under the Apache License, Version 2.0 (the "License");
10 * you may not use this software except in compliance with the License.
11 * You may obtain a copy of the License at
13 * http://www.apache.org/licenses/LICENSE-2.0
15 * Unless required by applicable law or agreed to in writing, software
16 * distributed under the License is distributed on an "AS IS" BASIS,
17 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18 * See the License for the specific language governing permissions and
19 * limitations under the License.
21 * Unless otherwise specified, all documentation contained herein is licensed
22 * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
23 * you may not use this documentation except in compliance with the License.
24 * You may obtain a copy of the License at
26 * https://creativecommons.org/licenses/by/4.0/
28 * Unless required by applicable law or agreed to in writing, documentation
29 * distributed under the License is distributed on an "AS IS" BASIS,
30 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
31 * See the License for the specific language governing permissions and
32 * limitations under the License.
34 * ============LICENSE_END============================================
38 package org.akraino.validation.ui.filter;
40 import java.io.BufferedReader;
41 import java.io.ByteArrayInputStream;
42 import java.io.ByteArrayOutputStream;
43 import java.io.IOException;
44 import java.io.InputStreamReader;
45 import java.nio.charset.StandardCharsets;
46 import java.util.Enumeration;
47 import java.util.HashMap;
50 import javax.servlet.FilterChain;
51 import javax.servlet.ReadListener;
52 import javax.servlet.ServletException;
53 import javax.servlet.ServletInputStream;
54 import javax.servlet.http.HttpServletRequest;
55 import javax.servlet.http.HttpServletRequestWrapper;
56 import javax.servlet.http.HttpServletResponse;
58 import org.apache.commons.io.IOUtils;
59 import org.apache.commons.lang.StringUtils;
60 import org.apache.http.HttpStatus;
61 import org.onap.portalapp.util.SecurityXssValidator;
62 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
63 import org.springframework.web.filter.OncePerRequestFilter;
65 public class SecurityXssFilter extends OncePerRequestFilter {
67 private static final EELFLoggerDelegate LOGGER = EELFLoggerDelegate.getLogger(SecurityXssFilter.class);
69 private static final String APPLICATION_JSON = "application/json";
71 private static final String ERROR_BAD_REQUEST = "{\"error\":\"BAD_REQUEST\"}";
73 private SecurityXssValidator validator = SecurityXssValidator.getInstance();
75 public class RequestWrapper extends HttpServletRequestWrapper {
77 private ByteArrayOutputStream cachedBytes;
79 private Map parameter = new HashMap();
81 @SuppressWarnings("unchecked")
82 public RequestWrapper(HttpServletRequest request) {
84 Enumeration<String> parameterNames = request.getParameterNames();
85 while (parameterNames.hasMoreElements()) {
86 String paramName = parameterNames.nextElement();
87 String paramValue = request.getParameter(paramName);
88 parameter.put(paramName, paramValue);
93 public String getParameter(String name) {
94 if (parameter != null) {
95 return (String) parameter.get(name);
101 public ServletInputStream getInputStream() throws IOException {
102 if (cachedBytes == null)
105 return new CachedServletInputStream();
109 public BufferedReader getReader() throws IOException {
110 return new BufferedReader(new InputStreamReader(getInputStream()));
113 private void cacheInputStream() throws IOException {
114 cachedBytes = new ByteArrayOutputStream();
115 IOUtils.copy(super.getInputStream(), cachedBytes);
118 public class CachedServletInputStream extends ServletInputStream {
119 private ByteArrayInputStream input;
121 public CachedServletInputStream() {
122 input = new ByteArrayInputStream(cachedBytes.toByteArray());
126 public int read() throws IOException {
131 public boolean isFinished() {
136 public boolean isReady() {
141 public void setReadListener(ReadListener readListener) {
149 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
150 throws ServletException, IOException {
151 if (validateRequestType(request)) {
152 request = new RequestWrapper(request);
153 String requestData = IOUtils.toString(request.getInputStream(), StandardCharsets.UTF_8.toString());
155 if (StringUtils.isNotBlank(requestData) && validator.denyXSS(requestData)) {
156 response.setContentType(APPLICATION_JSON);
157 response.setStatus(HttpStatus.SC_BAD_REQUEST);
158 response.getWriter().write(ERROR_BAD_REQUEST);
159 throw new SecurityException(ERROR_BAD_REQUEST);
161 } catch (Exception e) {
162 LOGGER.error(EELFLoggerDelegate.errorLogger, "doFilterInternal() failed due to BAD_REQUEST", e);
163 response.getWriter().close();
166 filterChain.doFilter(request, response);
169 filterChain.doFilter(request, response);
174 private boolean validateRequestType(HttpServletRequest request) {
175 return (request.getMethod().equalsIgnoreCase("POST") || request.getMethod().equalsIgnoreCase("PUT")
176 || request.getMethod().equalsIgnoreCase("DELETE"));