Skip to content

Commit 8fceb19

Browse files
mohammedanasmohammedanas
committed
Merge branch 'master' into RDM-4374
* master: RDM-4542: Use lowercase email for User Profile retrieval (#452) FR-901 Revert "RDM-3325: White space validation rules applied on text fields (#284)" (#459) RDM-4610: CVE-2019-0232 fix (#458) increased default callback timeout from 15sec to 60 sec Rdm 3897- Retrieve all the case data (#376) RDM-3325: White space validation rules applied on text fields (#284) RDM-4369: Support reserved characters in userId email address (#420) Add externalId index for CMC (#418) Fix OWASP issue (#456) SIDAM Switch
2 parents 4f61294 + 9989477 commit 8fceb19

File tree

20 files changed

+385
-75
lines changed

20 files changed

+385
-75
lines changed

‎build.gradle

+10-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
buildscript {
22
ext {
3-
springBootVersion = '2.1.3.RELEASE'
3+
springBootVersion = '2.1.4.RELEASE'
44
}
55
dependencies {
66
classpath 'org.jsonschema2pojo:jsonschema2pojo-gradle-plugin:0.5.1'
@@ -256,6 +256,15 @@ dependencyManagement {
256256
imports {
257257
mavenBom "org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"
258258
}
259+
260+
dependencies {
261+
// CVE-2019-0232 - Java and Command Line injections in Windows
262+
dependencySet(group: 'org.apache.tomcat.embed', version: '9.0.19') {
263+
entry 'tomcat-embed-core'
264+
entry 'tomcat-embed-el'
265+
entry 'tomcat-embed-websocket'
266+
}
267+
}
259268
}
260269

261270
task projectVersion {

‎charts/ccd-data-store-api/values.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ java:
2222

2323
CCD_DRAFT_TTL_DAYS: 180
2424

25-
DATA_STORE_S2S_AUTHORISED_SERVICES: ccd_data,ccd_gw,ccd_ps,probate_backend,divorce_ccd_submission,sscs,sscs_bulkscan,cmc,cmc_claim_store,jui_webapp,pui_webapp,bulk_scan_orchestrator,fpl_case_service,iac,finrem_ccd_data_migrator
25+
DATA_STORE_S2S_AUTHORISED_SERVICES: ccd_data,ccd_gw,ccd_ps,probate_backend,divorce_ccd_submission,sscs,sscs_bulkscan,cmc,cmc_claim_store,jui_webapp,pui_webapp,bulk_scan_orchestrator,fpl_case_service,iac,finrem_ccd_data_migrator,finrem_case_orchestration
2626

2727
DEFINITION_CACHE_MAX_IDLE_SEC: 259200
2828
DEFINITION_CACHE_LATEST_VERSION_TTL_SEC: 1
@@ -46,4 +46,3 @@ java:
4646
CCD_DEFAULTPRINTURL: https://return-case-doc-ccd.nonprod.platform.hmcts.net/jurisdictions/:jid/case-types/:ctid/cases/:cid
4747
postgresql:
4848
postgresqlDatabase: ccd_data_store
49-

‎dependency-check-suppressions.xml

+6
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,12 @@
137137
<gav regex="true">^org\.springframework:spring-.+:.*$</gav>
138138
<cve>CVE-2018-15756</cve>
139139
</suppress>
140+
<suppress>
141+
<notes>We are using SecureRandom without a custom seed so not affected. This will however be
142+
fixed with spring boot 2.1.4 upgrade which is using spring-security.* of 5.1.5 or higher</notes>
143+
<gav regex="true">^org\.springframework:spring-security.+:.*$</gav>
144+
<cve>CVE-2019-3795</cve>
145+
</suppress>
140146

141147
<suppress>
142148
<notes><![CDATA[

‎infrastructure/main.tf

+1
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ module "ccd-data-store-api" {
9999
asp_rg = "${(var.asp_rg == "use_shared") ? local.sharedASPResourceGroup : var.asp_rg}"
100100
website_local_cache_sizeinmb = 2000
101101
capacity = "${var.capacity}"
102+
java_container_version = "9.0"
102103

103104
app_settings = {
104105
DATA_STORE_DB_HOST = "${module.data-store-db.host_name}"

‎infrastructure/prod.tfvars

-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ database_sku_name = "GP_Gen5_8"
1212
database_sku_capacity = "8"
1313

1414
http_client_connection_timeout = 10000
15-
#http_client_read_timeout = 15000
1615
http_client_max_total = 200
1716
#http_client_seconds_idle_connection = 120
1817
http_client_max_client_per_route = 40

‎infrastructure/saat.tfvars

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
idam_api_url = "https://idam-api-idam-saat.service.core-compute-idam-saat.internal"
1+
idam_api_url = "http://idam-api-idam-saat.service.core-compute-idam-saat.internal"
22
asp_name = "ccd-data-store-api-saat"
33
asp_rg = "ccd-data-store-api-saat"
44
elastic_search_enabled = "false"

‎infrastructure/sprod.tfvars

-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ database_sku_capacity = "8"
99
database_storage_mb = "52224"
1010

1111
http_client_connection_timeout = 10000
12-
#http_client_read_timeout = 15000
1312
http_client_max_total = 200
1413
#http_client_seconds_idle_connection = 120
1514
http_client_max_client_per_route = 40

‎infrastructure/variables.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ variable "database_storage_mb" {
108108

109109
variable "authorised-services" {
110110
type = "string"
111-
default = "ccd_data,ccd_gw,ccd_ps,probate_backend,divorce_ccd_submission,sscs,sscs_bulkscan,cmc,cmc_claim_store,jui_webapp,pui_webapp,bulk_scan_orchestrator,fpl_case_service,iac,finrem_ccd_data_migrator"
111+
default = "ccd_data,ccd_gw,ccd_ps,probate_backend,divorce_ccd_submission,sscs,sscs_bulkscan,cmc,cmc_claim_store,jui_webapp,pui_webapp,bulk_scan_orchestrator,fpl_case_service,iac,finrem_ccd_data_migrator,finrem_case_orchestration"
112112
}
113113

114114
variable "idam_api_url" {
@@ -183,7 +183,7 @@ variable "http_client_connection_timeout" {
183183

184184
variable "http_client_read_timeout" {
185185
type = "string"
186-
default = "15000"
186+
default = "60000"
187187
}
188188

189189
variable "http_client_max_total" {

‎src/main/java/uk/gov/hmcts/ccd/ApplicationParams.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ public class ApplicationParams {
103103
@Value("${search.elastic.nodes.discovery.filter}")
104104
private String elasticsearchNodeDiscoveryFilter;
105105

106-
private static String encode(final String stringToEncode) {
106+
public static String encode(final String stringToEncode) {
107107
try {
108108
return URLEncoder.encode(stringToEncode, "UTF-8");
109109
} catch (UnsupportedEncodingException e) {

‎src/main/java/uk/gov/hmcts/ccd/data/user/DefaultUserRepository.java

+15-6
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
package uk.gov.hmcts.ccd.data.user;
22

3+
import java.net.URI;
4+
import java.net.URISyntaxException;
35
import java.util.HashMap;
46
import java.util.List;
57
import java.util.Map;
68
import java.util.Objects;
9+
import java.util.Optional;
710
import java.util.Set;
811
import java.util.stream.Collectors;
912

@@ -21,9 +24,10 @@
2124
import org.springframework.security.core.GrantedAuthority;
2225
import org.springframework.security.core.context.SecurityContextHolder;
2326
import org.springframework.stereotype.Repository;
24-
import org.springframework.web.client.HttpStatusCodeException;
2527
import org.springframework.web.client.RestClientException;
28+
import org.springframework.web.client.RestClientResponseException;
2629
import org.springframework.web.client.RestTemplate;
30+
import org.springframework.web.util.UriComponentsBuilder;
2731
import uk.gov.hmcts.ccd.ApplicationParams;
2832
import uk.gov.hmcts.ccd.AuthCheckerConfiguration;
2933
import uk.gov.hmcts.ccd.data.SecurityUtils;
@@ -111,17 +115,22 @@ public UserDefault getUserDefaultSettings(final String userId) {
111115
LOG.debug("retrieving default user settings for user {}", userId);
112116
final HttpEntity requestEntity = new HttpEntity(securityUtils.authorizationHeaders());
113117
final Map<String, String> queryParams = new HashMap<>();
114-
queryParams.put("uid", userId);
115-
return restTemplate.exchange(applicationParams.userDefaultSettingsURL(),
116-
HttpMethod.GET, requestEntity, UserDefault.class, queryParams).getBody();
117-
} catch (HttpStatusCodeException e) {
118+
queryParams.put("uid", ApplicationParams.encode(userId.toLowerCase()));
119+
final String encodedUrl = UriComponentsBuilder.fromHttpUrl(applicationParams.userDefaultSettingsURL())
120+
.buildAndExpand(queryParams).toUriString();
121+
return restTemplate.exchange(new URI(encodedUrl), HttpMethod.GET, requestEntity, UserDefault.class)
122+
.getBody();
123+
} catch (RestClientResponseException e) {
118124
LOG.error("Failed to retrieve user profile", e);
119-
final List<String> headerMessages = e.getResponseHeaders().get("Message");
125+
final List<String> headerMessages = Optional.ofNullable(e.getResponseHeaders())
126+
.map(headers -> headers.get("Message")).orElse(null);
120127
final String message = headerMessages != null ? headerMessages.get(0) : e.getMessage();
121128
if (message != null) {
122129
throw new BadRequestException(message);
123130
}
124131
throw new ServiceException("Problem getting user default settings for " + userId);
132+
} catch (URISyntaxException e) {
133+
throw new BadRequestException(e.getMessage());
125134
}
126135
}
127136

‎src/main/java/uk/gov/hmcts/ccd/domain/model/std/CaseDataContent.java

+11
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,9 @@ public class CaseDataContent {
3131
@JsonProperty("draft_id")
3232
private String draftId;
3333

34+
@JsonProperty("case_reference")
35+
private String caseReference;
36+
3437
public Event getEvent() {
3538
return event;
3639
}
@@ -99,4 +102,12 @@ public String getDraftId() {
99102
public void setDraftId(String draftId) {
100103
this.draftId = draftId;
101104
}
105+
106+
public String getCaseReference() {
107+
return caseReference;
108+
}
109+
110+
public void setCaseReference(String caseReference) {
111+
this.caseReference = caseReference;
112+
}
102113
}

‎src/main/java/uk/gov/hmcts/ccd/domain/service/common/CaseService.java

+13-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
import uk.gov.hmcts.ccd.data.casedetails.CachedCaseDetailsRepository;
1414
import uk.gov.hmcts.ccd.data.casedetails.CaseDetailsRepository;
1515
import uk.gov.hmcts.ccd.domain.model.definition.CaseDetails;
16+
import uk.gov.hmcts.ccd.domain.model.std.CaseDataContent;
1617
import uk.gov.hmcts.ccd.endpoint.exceptions.BadRequestException;
1718
import uk.gov.hmcts.ccd.endpoint.exceptions.ResourceNotFoundException;
1819

@@ -47,7 +48,7 @@ public String hashData(CaseDetails caseDetails) {
4748
}
4849

4950
/**
50-
* @param caseTypeId caseTypeId of new case details
51+
* @param caseTypeId caseTypeId of new case details
5152
* @param jurisdictionId jurisdictionId of new case details
5253
* @return <code>CaseDetails</code> - new case details object
5354
*/
@@ -59,6 +60,17 @@ public CaseDetails createNewCaseDetails(String caseTypeId, String jurisdictionId
5960
return caseDetails;
6061
}
6162

63+
/**
64+
* @param content Data received from the client.
65+
* @param caseDetails of the case.
66+
* @return <code>Optional&lt;CaseDetails&gt;<code/> - CaseDetails wrapped in Optional
67+
*/
68+
public CaseDetails populateCurrentCaseDetailsWithEventFields(CaseDataContent content, CaseDetails caseDetails) {
69+
70+
content.getEventData().forEach((key, value) -> caseDetails.getData().put(key, value));
71+
return caseDetails;
72+
}
73+
6274
public CaseDetails clone(CaseDetails source) {
6375
final CaseDetails clone;
6476

‎src/main/java/uk/gov/hmcts/ccd/domain/service/createevent/MidEventCallback.java

+23-10
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import com.fasterxml.jackson.databind.JsonNode;
99
import com.fasterxml.jackson.databind.ObjectMapper;
1010
import com.fasterxml.jackson.databind.node.ObjectNode;
11+
import org.apache.commons.lang3.StringUtils;
1112
import org.springframework.beans.factory.annotation.Autowired;
1213
import org.springframework.beans.factory.annotation.Qualifier;
1314
import org.springframework.stereotype.Service;
@@ -62,16 +63,28 @@ public JsonNode invoke(String caseTypeId,
6263
.findFirst();
6364

6465
if (wizardPageOptional.isPresent() && !isBlank(wizardPageOptional.get().getCallBackURLMidEvent())) {
65-
CaseDetails newCaseDetails = caseService.createNewCaseDetails(caseTypeId, caseType.getJurisdictionId(),
66-
content.getEventData() == null ? content.getData() : content.getEventData());
67-
68-
CaseDetails caseDetails = callbackInvoker.invokeMidEventCallback(wizardPageOptional.get(),
69-
caseType,
70-
caseEvent,
71-
null,
72-
newCaseDetails,
73-
content.getIgnoreWarning());
74-
return dataJsonNode(caseDetails.getData());
66+
67+
CaseDetails caseDetailsBefore = null;
68+
CaseDetails currentOrNewCaseDetails;
69+
if (StringUtils.isNotEmpty(content.getCaseReference())) {
70+
CaseDetails caseDetails = caseService.getCaseDetails(caseType.getJurisdictionId(), content.getCaseReference());
71+
caseDetailsBefore = caseService.clone(caseDetails);
72+
currentOrNewCaseDetails = caseService.populateCurrentCaseDetailsWithEventFields(content,
73+
caseDetails);
74+
75+
} else {
76+
currentOrNewCaseDetails = caseService.createNewCaseDetails(caseTypeId, caseType.getJurisdictionId(),
77+
content.getEventData() == null ? content.getData() : content.getEventData());
78+
}
79+
80+
CaseDetails caseDetailsFromMidEventCallback = callbackInvoker.invokeMidEventCallback(wizardPageOptional.get(),
81+
caseType,
82+
caseEvent,
83+
caseDetailsBefore,
84+
currentOrNewCaseDetails,
85+
content.getIgnoreWarning());
86+
87+
return dataJsonNode(caseDetailsFromMidEventCallback.getData());
7588
}
7689
}
7790
return dataJsonNode(content.getData());

‎src/main/resources/db/changelog/db.changelog-RDM-4396.xml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
4+
5+
6+
<changeSet id="rdm-4396" author="[email protected]">
7+
<sql dbms="postgresql"
8+
endDelimiter="\nGO"
9+
splitStatements="true"
10+
stripComments="true">
11+
CREATE INDEX idx_case_data_case_external_id ON public.case_data USING BTREE ((TRIM(UPPER(data#>>'{externalId}'))));
12+
</sql>
13+
</changeSet>
14+
</databaseChangeLog>

‎src/main/resources/db/changelog/db.changelog-master.xml

+1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,5 @@
2323
<include file="db/changelog/db.changelog-RDM-3922.xml"/>
2424
<include file="db/changelog/db.changelog-RDM-3922-part-2.xml"/>
2525
<include file="db/changelog/db.changelog-RDM-4060-part-1.xml"/>
26+
<include file="db/changelog/db.changelog-RDM-4396.xml"/>
2627
</databaseChangeLog>

0 commit comments

Comments
 (0)