somang4819/itsm_ysm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

취약점 보완

Browse Source
This commit is contained in:
KNKIM 2021-12-01 15:59:31 +09:00
parent 0ac722ad9c
commit 8886a4b484
6 changed files with 104 additions and 103 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
src/main/java/nlib/cmm/NlibCommonController.java
View File

@ -1,7 +1,7 @@
package nlib.cmm;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Base64;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@ -24,7 +24,6 @@ import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import nlib.cmm.exception.ErrorMessage;
import nlib.cmm.service.NlibProperty;
import nlib.restful.service.DataApiResVO;
import nlib.security.SecUserVO;
import nlib.user.service.LoginService;
@ -140,9 +139,12 @@ public class NlibCommonController {
setter.invoke(loginVO, getter.invoke(newLoginVO));
//log.debug("replaceNlibLoginVO > Method invoke : " + setterName + " : " + oldValue + " -> " + newValue);
} catch(Exception e) {
log.error("replaceNlibLoginVO > Method invoke error : " + setterName + ", " + getterName);
e.printStackTrace();
} catch(IllegalAccessException e) {
log.error("replaceNlibLoginVO > Method invoke IllegalAccessException : " + setterName + ", " + getterName);
} catch(IllegalArgumentException e) {
log.error("replaceNlibLoginVO > Method invoke IllegalArgumentException : " + setterName + ", " + getterName);
} catch(InvocationTargetException e) {
log.error("replaceNlibLoginVO > Method invoke InvocationTargetException : " + setterName + ", " + getterName);
}
}
@ -197,8 +199,9 @@ public class NlibCommonController {
log.debug("RETURN DATA > json:" + jsonStr);
} catch (JsonProcessingException e) {
ErrorMessage eMsg = new ErrorMessage("ERR_JSON_CONVERT", "응답객체를 JSON으로 변환 처리 중 오류가 발생하였습니다. : " + e.toString());
try { jsonStr = mapper.writeValueAsString(eMsg); } catch (JsonProcessingException ee) {}
e.printStackTrace();
try { jsonStr = mapper.writeValueAsString(eMsg); } catch (JsonProcessingException ee) {
log.error("makeResponseEntityJson > JsonProcessingException내부 JsonProcessingException : " + ee.toString());
}
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).headers(headers).body(jsonStr);
}
@ -220,8 +223,9 @@ public class NlibCommonController {
log.debug("RETURN DATA > json:" + jsonStr);
} catch (JsonProcessingException e) {
ErrorMessage eMsg = new ErrorMessage("ERR_JSON_CONVERT", "응답객체를 JSON으로 변환 처리 중 오류가 발생하였습니다. : " + e.toString());
try { jsonStr = mapper.writeValueAsString(eMsg); } catch (JsonProcessingException ee) {}
e.printStackTrace();
try { jsonStr = mapper.writeValueAsString(eMsg); } catch (JsonProcessingException ee) {
log.error("makeResponseEntityJson > JsonProcessingException내부 JsonProcessingException : " + ee.toString());
}
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).headers(headers).body(jsonStr);
}
@ -242,8 +246,9 @@ public class NlibCommonController {
log.debug("RETURN DATA > json:" + jsonStr);
} catch (JsonProcessingException e) {
ErrorMessage eMsg = new ErrorMessage("ERR_JSON_CONVERT", "응답객체를 JSON으로 변환 처리 중 오류가 발생하였습니다. : " + e.toString());
try { jsonStr = mapper.writeValueAsString(eMsg); } catch (JsonProcessingException ee) {}
e.printStackTrace();
try { jsonStr = mapper.writeValueAsString(eMsg); } catch (JsonProcessingException ee) {
log.error("makeResponseEntityJson > JsonProcessingException내부 JsonProcessingException : " + ee.toString());
}
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).headers(headers).body(jsonStr);
}

75
src/main/java/nlib/cmm/service/NlibProperty.java
View File

@ -1,6 +1,7 @@
package nlib.cmm.service;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.util.Enumeration;
@ -53,47 +54,41 @@ public class NlibProperty {
String nlibPropPath = null;
int propCount = -1;
if(properties == null) properties = new Properties();
else properties.clear();
nlibPropPath = NlibProperty.class.getResource("").getPath();
nlibPropPath = nlibPropPath.substring(0, nlibPropPath.lastIndexOf("/nlib/") + 6) + "nlib.properties";
try {
if(properties == null) properties = new Properties();
else properties.clear();
log.debug("NLIB Properties File Path : " + nlibPropPath);
try (InputStream input = new FileInputStream(nlibPropPath)) {
properties.load(input);
nlibPropPath = NlibProperty.class.getResource("").getPath();
nlibPropPath = nlibPropPath.substring(0, nlibPropPath.lastIndexOf("/nlib/") + 6) + "nlib.properties";
log.debug("NLIB Properties File Path : " + nlibPropPath);
Enumeration<String> propEnum = (Enumeration<String>)properties.propertyNames();
String propName = null;
while(propEnum.hasMoreElements()) {
propName = propEnum.nextElement();
log.debug("Loading NLIB Properties : " + propName + " = " + properties.getProperty(propName));
}
log.debug("Loading is Done!");
try (InputStream input = new FileInputStream(nlibPropPath)) {
properties.load(input);
Enumeration<String> propEnum = (Enumeration<String>)properties.propertyNames();
String propName = null;
while(propEnum.hasMoreElements()) {
propName = propEnum.nextElement();
log.debug("Loading NLIB Properties : " + propName + " = " + properties.getProperty(propName));
}
log.debug("Loading is Done!");
propCount = properties.size();
} catch (IOException ex) {
if(properties != null) properties.clear();
log.error("Error in Loading NLIB Properties : " + nlibPropPath);
ex.printStackTrace();
return -2;
}
} catch(Exception e) {
if(properties != null) properties.clear();
log.error("Error in Solving NLIB Properties Path : " + nlibPropPath);
e.printStackTrace();
propCount = properties.size();
} catch (FileNotFoundException ex) { // FileNotFoundException
if(properties != null) properties.clear();
log.error("Error in Loading NLIB Properties FileNotFoundException : " + nlibPropPath);
return -2;
} catch (IOException ex) { // FileNotFoundException
if(properties != null) properties.clear();
log.error("Error in Loading NLIB Properties : IOException " + nlibPropPath);
return -3;
}
}
return propCount;
}
@ -144,11 +139,13 @@ public class NlibProperty {
public static int getInt(String name, int defaultValue) {
try {
return getInt(name);
} catch(NumberFormatException e) {
log.error("[속성값 읽기 오류] NumberFormatException : " + e.toString());
return defaultValue;
} catch(Exception e) {
log.error("[속성값 읽기 오류] " + e.toString());
log.error("[속성값 읽기 오류] 기타 오류 " + e.toString());
return defaultValue;
}
}
/**

4
src/main/java/nlib/cmm/service/PagingVO.java
View File

@ -66,7 +66,7 @@ public class PagingVO {
public void setPageIndex(String sPageIndex) {
try {
pageIndex = Integer.parseInt(sPageIndex);
} catch(Exception e) {
} catch(NumberFormatException e) {
pageIndex = 1;
}
}
@ -83,7 +83,7 @@ public class PagingVO {
public void setPageSize(String sPageSize) {
try {
pageSize = Integer.parseInt(sPageSize);
} catch(Exception e) {
} catch(NumberFormatException e) {
pageSize = NlibProperty.getInt("list.paging.page.size", 10);
}
}

4
src/main/java/nlib/cmm/web/MainController.java
View File

@ -194,7 +194,7 @@ public class MainController extends NlibCommonController {
response.setContentType(mimetypesFileTypeMap.getContentType(bannerInfo.get("orignlFileNm")));
response.getOutputStream().write(Files.readAllBytes(Paths.get(fileName)));
exists = true;
} catch(Exception e) {
} catch(IOException e) {
log.error("메인 화면 배너 관련 파일을 확인할 수 없습니다. : bannerId=" + bannerId);
}
}
@ -206,7 +206,7 @@ public class MainController extends NlibCommonController {
response.setContentType(mimetypesFileTypeMap.getContentType(bannerInfo.get("orignlFileNm")));
response.getOutputStream().write(Files.readAllBytes(Paths.get(fileName)));
exists = true;
} catch(Exception e) {
} catch(IOException e) {
log.error("메인 화면 배너 기본 배너 파일을 확인할 수 없습니다. : main.banner.img.path=" + NlibProperty.getString("main.banner.img.path"));
}
}

4
src/main/java/nlib/restful/service/XmlConverter.java
View File

@ -37,9 +37,9 @@ public class XmlConverter {
resMap = getElementValue(rootEleName, eventReader, null);
//log.debug("Converting XML to HashMap : Done >> " + resMap);
} catch (XMLStreamException e) {
e.printStackTrace();
log.error("convert XMLStreamException : " + e.toString());
} catch (Exception e) {
e.printStackTrace();
log.error("convert Error : " + e.toString());
}
return resMap;

93
src/main/java/nlib/util/StringUtil.java
View File

@ -1,5 +1,7 @@
package nlib.util;
import java.io.UnsupportedEncodingException;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLDecoder;
import java.net.URLEncoder;
@ -126,7 +128,7 @@ public class StringUtil extends StringUtils {
try {
return Integer.parseInt(str.trim());
} catch(Exception e) {}
} catch(NumberFormatException e) { log.error("toNumber NumberFormatException : " + e.toString()); }
return defaultInt;
}
@ -169,8 +171,8 @@ public class StringUtil extends StringUtils {
try {
encodedStr = URLEncoder.encode(str, "UTF-8");
} catch(Exception e) {
log.error("encodeUrl > Error while encoding for [" + str + "] " + e.toString());
} catch(UnsupportedEncodingException e) {
log.error("encodeUrl > UnsupportedEncodingException while encoding for [" + str + "] " + e.toString());
encodedStr = str;
}
return encodedStr;
@ -189,8 +191,8 @@ public class StringUtil extends StringUtils {
try {
decodedStr = URLDecoder.decode(str, "UTF-8");
} catch(Exception e) {
log.error("encodeUrl > Error while encoding for [" + str + "] " + e.toString());
} catch(UnsupportedEncodingException e) {
log.error("encodeUrl > UnsupportedEncodingException while encoding for [" + str + "] " + e.toString());
decodedStr = str;
}
return decodedStr;
@ -241,8 +243,8 @@ public class StringUtil extends StringUtils {
final URL urlObj = new URL(url);
hostName = urlObj.getHost();
if(isEmpty(hostName)) return "";
} catch(Exception e) {
log.error("[ERROR] getHostName(..) : " + e.toString());
} catch(MalformedURLException e) {
log.error("[ERROR] getHostName(..) : MalformedURLException " + e.toString());
return "";
}
if("|localhost|nlib.nculture.org|nlib-dev.nculture.org|".contains(hostName)) hostName = "nlib";
@ -291,51 +293,48 @@ public class StringUtil extends StringUtils {
return defaultStr;
}
/** * 이메일 masking 후 리턴<br> * 변환 실패시 입력값 그대로 리턴<br> * 이메일 아이디 앞 2자리 노출<br> */
public static String maskEmail(String email){
try{
if(StringUtils.isEmpty(email) || !email.contains("@")){
return email;
}
String[] emailSplited = email.split("@");
if(emailSplited.length != 2){
return email;
}
if(emailSplited[0].length() > 2){
String str="";
for(int i=2;emailSplited[0].length()>i;i++)
{
str+="*";
}
return email.substring(0, 2) + str+"@" + emailSplited[1];
}
else{
return email;
}
/**
* 이메일 masking 후 리턴
*/
public static String maskEmail(String email) {
if (StringUtils.isEmpty(email) || !email.contains("@")) {
return email;
}
catch (Exception e){
} return email;
String[] emailSplited = email.split("@");
if (emailSplited.length != 2) {
return email;
}
if (!StringUtils.isEmpty(emailSplited[0]) && emailSplited[0].length() > 2) {
String str = "";
for (int i = 2; i < emailSplited[0].length(); i++) {
str += "*";
}
return email.substring(0, 2) + str + "@" + emailSplited[1];
}
return email;
}
/** * 이름 masking 후 리턴<br> * 변환 실패시 입력값 그대로 리턴<br>*/
public static String maskName(String name){
try{
if(StringUtils.isEmpty(name)){
return name;
}
if(name.length() == 2){
return name.substring(0, 1)+"*";
}
else if(name.length() >2){
String str="";
for(int i = 2; name.length()>i;i++)
str+="*";
return name.substring(0, 1)+str+name.substring(name.length()-1,name.length());
}
public static String maskName(String name) {
if (StringUtils.isEmpty(name)) {
return name;
}
catch (Exception e){
} return name;
if (name.length() == 2) {
return name.substring(0, 1) + "*";
} else if (name.length() > 2) {
String str = "";
for (int i = 2; name.length() > i; i++)
str += "*";
return name.substring(0, 1) + str + name.substring(name.length() - 1, name.length());
}
return name;
}
public static String getSafeParamData(String value) {