From c4f117e74b8ade8b420f0443955ec6b94f88cee4 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Wed, 9 Dec 2020 18:20:56 +0100 Subject: add findSecBugs extension into spotbugs plug-in --- eaaf_core/checks/spotbugs-exclude.xml | 50 ++++ eaaf_core/pom.xml | 272 +++++++++++---------- .../services/ProtocolAuthenticationService.java | 35 +-- .../impl/idp/process/ProcessDefinitionParser.java | 1 + .../at/gv/egiz/eaaf/core/impl/utils/DomUtils.java | 7 +- 5 files changed, 208 insertions(+), 157 deletions(-) create mode 100644 eaaf_core/checks/spotbugs-exclude.xml (limited to 'eaaf_core') diff --git a/eaaf_core/checks/spotbugs-exclude.xml b/eaaf_core/checks/spotbugs-exclude.xml new file mode 100644 index 00000000..aa11a955 --- /dev/null +++ b/eaaf_core/checks/spotbugs-exclude.xml @@ -0,0 +1,50 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/eaaf_core/pom.xml b/eaaf_core/pom.xml index a1eee06e..178b53a3 100644 --- a/eaaf_core/pom.xml +++ b/eaaf_core/pom.xml @@ -1,108 +1,112 @@ - + 4.0.0 - at.gv.egiz - eaaf - 1.1.11-SNAPSHOT + at.gv.egiz + eaaf + 1.1.11-SNAPSHOT at.gv.egiz.eaaf eaaf-core EAAF core components Core components for identity managment implementations - + - - at.gv.egiz.eaaf - eaaf_core_api - - - at.gv.egiz.eaaf - eaaf_core_utils - - - - at.gv.egiz.components - eventlog-api - - - at.gv.egiz.components - egiz-spring-api - - - javax.annotation - javax.annotation-api - - - org.springframework - spring-webmvc - provided - - - org.slf4j - slf4j-api - - - - commons-codec - commons-codec - - - org.apache.commons - commons-lang3 - - - org.apache.commons - commons-collections4 - - - org.apache.commons - commons-text - - - commons-fileupload - commons-fileupload - - - javax.servlet - javax.servlet-api - - - org.apache.velocity - velocity - + + at.gv.egiz.eaaf + eaaf_core_api + + + at.gv.egiz.eaaf + eaaf_core_utils + + + + at.gv.egiz.components + eventlog-api + + + at.gv.egiz.components + egiz-spring-api + + + javax.annotation + javax.annotation-api + + + org.springframework + spring-webmvc + provided + + + org.slf4j + slf4j-api + + + + commons-codec + commons-codec + + + org.apache.commons + commons-lang3 + + + org.apache.commons + commons-collections4 + + + org.apache.commons + commons-text + + + commons-fileupload + commons-fileupload + + + javax.servlet + javax.servlet-api + + + org.apache.velocity + velocity + commons-collections - commons-collections - - - jaxen - jaxen - - - xerces - xercesImpl - - - xalan - xalan - - + commons-collections + + + org.owasp.encoder + encoder + + + jaxen + jaxen + + + xerces + xercesImpl + + + xalan + xalan + + - - junit - junit - test - - - org.springframework - spring-test - test - + + junit + junit + test + + + org.springframework + spring-test + test + at.gv.egiz.eaaf eaaf_core_utils @@ -110,10 +114,10 @@ test-jar - - + + eaaf_core - + org.apache.maven.plugins @@ -124,44 +128,54 @@ 1.8 - - - compile - testCompile - - + + + compile + testCompile + + - org.apache.maven.plugins - maven-jar-plugin - 3.1.0 - - - - test-jar - - - - - + org.apache.maven.plugins + maven-jar-plugin + 3.1.0 + + + + test-jar + + + + + - - maven-surefire-plugin - ${surefire.version} - - 1 - - - - org.apache.maven.surefire - surefire-junit47 - ${surefire.version} - - - - + + maven-surefire-plugin + ${surefire.version} + + 1 + + + + org.apache.maven.surefire + surefire-junit47 + ${surefire.version} + + + + + + com.github.spotbugs + spotbugs-maven-plugin + ${spotbugs-maven-plugin.version} + + true + checks/spotbugs-exclude.xml + + + - + diff --git a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/services/ProtocolAuthenticationService.java b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/services/ProtocolAuthenticationService.java index 50bf76db..4410267e 100644 --- a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/services/ProtocolAuthenticationService.java +++ b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/services/ProtocolAuthenticationService.java @@ -20,8 +20,6 @@ package at.gv.egiz.eaaf.core.impl.idp.auth.services; import java.io.IOException; -import java.io.PrintWriter; -import java.io.StringWriter; import java.util.HashSet; import javax.annotation.PostConstruct; @@ -32,6 +30,7 @@ import javax.servlet.http.HttpServletResponse; import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.StringUtils; import org.apache.commons.text.StringEscapeUtils; +import org.owasp.encoder.Encode; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; @@ -286,7 +285,7 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer // write generic message for general exceptions final String msg = statusMessager.getMessage(IStatusMessenger.CODES_INTERNAL_ERROR_GENERIC, null); - writeHtmlErrorResponse(req, resp, msg, "9199", null, (Exception) throwable); + writeHtmlErrorResponse(req, resp, msg, "9199", null); } @@ -460,8 +459,7 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer private void writeHtmlErrorResponse(@NonNull final HttpServletRequest httpReq, @NonNull final HttpServletResponse httpResp, @NonNull final String msg, - @NonNull final String errorCode, @Nullable final Object[] params, - @NonNull final Exception error) throws EaafException { + @NonNull final String errorCode, @Nullable final Object[] params) throws EaafException { try { final IGuiBuilderConfiguration config = @@ -492,14 +490,6 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer AbstractGuiFormBuilderConfiguration.PARAM_GROUP_MSG, PARAM_GUI_ERRORCODEPARAMS, ArrayUtils.toString(errorCodeParams)); - // add stacktrace if debug is enabled - if (log.isTraceEnabled()) { - ((ModifyableGuiBuilderConfiguration) config).putCustomParameter( - AbstractGuiFormBuilderConfiguration.PARAM_GROUP_MSG, PARAM_GUI_ERRORSTACKTRACE, - getStacktraceFromException(error)); - - } - } else { log.info( "Can not ADD error message, because 'GUIBuilderConfiguration' is not modifieable "); @@ -515,18 +505,11 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer } - private String getStacktraceFromException(final Exception ex) { - final StringWriter errors = new StringWriter(); - ex.printStackTrace(new PrintWriter(errors)); - return errors.toString(); - - } - private void internalMoaidExceptionHandler(final HttpServletRequest req, final HttpServletResponse resp, final Exception e, final boolean writeExceptionToStatisicLog) throws IOException, EaafException { if (e instanceof ProtocolNotActiveException) { - resp.getWriter().write(e.getMessage()); + resp.getWriter().write(Encode.forHtml(e.getMessage())); resp.setContentType(EaafConstants.CONTENTTYPE_HTML_UTF8); resp.sendError(HttpServletResponse.SC_FORBIDDEN, StringEscapeUtils.escapeHtml4(StringEscapeUtils.escapeEcmaScript(e.getMessage()))); @@ -540,27 +523,27 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer // write error message writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - null, e); + null); } else if (e instanceof InvalidProtocolRequestException) { // send error response writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - null, e); + null); } else if (e instanceof ConfigurationException) { // send HTML formated error message writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - null, e); + null); } else if (e instanceof EaafException) { // send HTML formated error message writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - ((EaafException) e).getParams(), e); + ((EaafException) e).getParams()); } else if (e instanceof ProcessExecutionException) { // send HTML formated error message writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - null, e); + null); } diff --git a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/process/ProcessDefinitionParser.java b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/process/ProcessDefinitionParser.java index 14537d44..edca0fba 100644 --- a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/process/ProcessDefinitionParser.java +++ b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/process/ProcessDefinitionParser.java @@ -101,6 +101,7 @@ public class ProcessDefinitionParser { // Standard implementation of XMLInputFactory seems not to be thread-safe final XMLInputFactory inputFactory = XMLInputFactory.newInstance(); + inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); reader = inputFactory.createXMLEventReader(processDefinitionInputStream); final List transitionElements = new ArrayList<>(); diff --git a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DomUtils.java b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DomUtils.java index e8d5c294..4b8a7a04 100644 --- a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DomUtils.java +++ b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DomUtils.java @@ -33,6 +33,7 @@ import java.util.Map.Entry; import java.util.Set; import java.util.Vector; +import javax.xml.XMLConstants; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; @@ -45,8 +46,6 @@ import javax.xml.transform.TransformerFactory; import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; -import at.gv.egiz.eaaf.core.api.data.XmlNamespaceConstants; - import org.apache.commons.io.IOUtils; import org.apache.commons.lang3.StringUtils; import org.apache.xerces.parsers.DOMParser; @@ -71,6 +70,8 @@ import org.xml.sax.ErrorHandler; import org.xml.sax.InputSource; import org.xml.sax.SAXException; +import at.gv.egiz.eaaf.core.api.data.XmlNamespaceConstants; + /** * Various utility functions for handling XML DOM trees. * @@ -785,6 +786,7 @@ public class DomUtils { throws TransformerException, IOException { final TransformerFactory transformerFactory = TransformerFactory.newInstance(); + transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); final Transformer transformer = transformerFactory.newTransformer(); final ByteArrayOutputStream bos = new ByteArrayOutputStream(16384); @@ -1211,6 +1213,7 @@ public class DomUtils { // StringWriter stringWriter = new StringWriter(); final Result result = new StreamResult(out); final TransformerFactory factory = TransformerFactory.newInstance(); + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); final Transformer transformer = factory.newTransformer(); transformer.transform(source, result); return out.toByteArray(); -- cgit v1.2.3