취약점 점검 조치

src/main/java/nlib/col/service/CartService.java

@@ -58,7 +58,7 @@ public interface CartService
 	 * @return
 	 * @throws Exception
 	 */
-	public String insertCartItem(CollectionVO cartVO) throws Exception;
+	public String insertCartItem(CollectionVO cartVO);
 	
 	/**
 	 * (비로그인자용) 카트에 추가한다. 

src/main/java/nlib/col/service/CollectionService.java

@@ -34,7 +34,7 @@ public interface CollectionService {
 	 * @return
 	 * @throws Exception
 	 */
-	public CollectionVO getItemInfo(CollectionVO searchVO) throws Exception;
+	public CollectionVO getItemInfo(CollectionVO searchVO);
 	
 	/**
 	 * 목록의 자료정보에 상세정보를 조회하여 설정한 후 리턴한다. 

src/main/java/nlib/col/service/impl/CartDAO.java

@@ -10,20 +10,20 @@ import nlib.col.service.CollectionVO;
 @Mapper("cartDAO")
 public interface CartDAO {
 	
-	public List<CollectionVO> listCartItems(@Param("mbInfoId") String mbInfoId, @Param("cartTypeCd") String cartTypeCd) throws Exception;
+	public List<CollectionVO> listCartItems(@Param("mbInfoId") String mbInfoId, @Param("cartTypeCd") String cartTypeCd);
 	
-	public int changeCartDiv(CollectionVO cartVO) throws Exception;
+	public int changeCartDiv(CollectionVO cartVO);
 	
-	public int countCartItem(CollectionVO cartVO) throws Exception;
+	public int countCartItem(CollectionVO cartVO);
 	
-	public int insertCartItem(CollectionVO cartVO) throws Exception;
+	public int insertCartItem(CollectionVO cartVO);
 	
-	public int deleteCartItems(CollectionVO cartVO) throws Exception;
+	public int deleteCartItems(CollectionVO cartVO);
 	
-	public int changeCartType(CollectionVO cartVO) throws Exception;
+	public int changeCartType(CollectionVO cartVO);
 	
-	public int countCartItems(@Param("mbInfoId") String mbInfoId, @Param("cartTypeCd") String cartTypeCd) throws Exception;
+	public int countCartItems(@Param("mbInfoId") String mbInfoId, @Param("cartTypeCd") String cartTypeCd);
 	
-	public int changeCartProcDivCd(CollectionVO cartVO) throws Exception;
+	public int changeCartProcDivCd(CollectionVO cartVO);
 
 }

src/main/java/nlib/col/service/impl/CartServiceImpl.java

@@ -199,7 +199,7 @@ public class CartServiceImpl implements CartService
 	 * @return
 	 * @throws Exception
 	 */
-	public String insertCartItem(CollectionVO cartVO) throws Exception {
+	public String insertCartItem(CollectionVO cartVO) {
 		
 		cartVO = checkValidCartItem(cartVO);
 		
@@ -285,6 +285,7 @@ public class CartServiceImpl implements CartService
 	 */
 	public void setCookie(HttpServletResponse response, String name, String value) {
 		Cookie cookie = new Cookie(name, value);
+		cookie.setSecure(true);
 		cookie.setDomain(NlibProperty.getString("cart.cookie.domain"));
 		cookie.setPath(NlibProperty.getString("cart.cookie.path"));
 		response.addCookie(cookie);
@@ -344,7 +345,7 @@ public class CartServiceImpl implements CartService
 	 * @return
 	 * @throws Exception
 	 */
-	public CollectionVO checkValidCartItem(CollectionVO cartVO) throws Exception {
+	public CollectionVO checkValidCartItem(CollectionVO cartVO) {
 		
 		if(cartVO == null) return new CollectionVO("FCART00", "카트에 추가할 자료 정보가 없습니다.");
 		

src/main/java/nlib/col/service/impl/CollectionServiceImpl.java

@@ -61,7 +61,7 @@ public class CollectionServiceImpl implements CollectionService {
 	 * @return
 	 * @throws Exception
 	 */
-	public CollectionVO getItemInfo(CollectionVO searchVO) throws Exception {
+	public CollectionVO getItemInfo(CollectionVO searchVO) {
 
     	String message = null;
 

src/main/java/nlib/col/web/CartController.java

@@ -218,33 +218,25 @@ public class CartController extends NlibCommonController
 		
 		int changedCnt = 0; 
 	
-		try {
+		// 로그인한 경우 
-			
+		if(!StringUtil.isEmpty(mbInfoId)) {
-			// 로그인한 경우 
+			log.debug("insertCartItemAjax > masterId = " + cartVO.getMasterId());
-			if(!StringUtil.isEmpty(mbInfoId)) {
+			log.debug("insertCartItemAjax > cartDivCd = " + cartVO.getCartTypeCd());
-				log.debug("insertCartItemAjax > masterId = " + cartVO.getMasterId());
+			cartVO.setMbInfoId(mbInfoId);
-				log.debug("insertCartItemAjax > cartDivCd = " + cartVO.getCartTypeCd());
+			cartVO.setRegId(mbInfoId);
-				cartVO.setMbInfoId(mbInfoId);
+			message = cartService.insertCartItem(cartVO);
-				cartVO.setRegId(mbInfoId);
+		}
-				message = cartService.insertCartItem(cartVO);
+		// 비회원인 경우 
-			}
+		else {
-			// 비회원인 경우 
+			message = cartService.insertCartItemToCookie(request, response, cartVO);
-			else {
-				message = cartService.insertCartItemToCookie(request, response, cartVO);
-			}
-			
-			if(message == null) {
-				code = "S";
-				message = "정상적으로 추가되었습니다.";
-			} else {
-				code = "F";
-			}
-			
-		} catch(Exception e) {
-			code = "F";
-			message = "등록되지 않았습니다. : " + e.toString();
 		}
 		
+		if(message == null) {
+			code = "S";
+			message = "정상적으로 추가되었습니다.";
+		} else {
+			code = "F";
+		}
 		
 		//-------------------------------
 		// JSON변환 응답 처리

src/main/java/nlib/restful/service/DataApiInterface.java

@@ -229,7 +229,7 @@ public interface DataApiInterface {
      * @return
      * @throws Exception : 
      */
-    public static DataApiResVO checkReqCommonParams(DataApiReqVO reqVO) throws Exception {
+    public static DataApiResVO checkReqCommonParams(DataApiReqVO reqVO) {
     	
     	if(reqVO == null) {
     		return new DataApiResVO("ERR_NO_REQ", "데이터송수신 요청객체가 존재하지 않습니다.");

src/main/java/nlib/restful/service/impl/DataApiTempXml.java

@@ -16,6 +16,7 @@ import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.util.MultiValueMap;
 
+import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.dataformat.xml.XmlMapper;
 
 import nlib.restful.service.DataApiInterface;
@@ -109,8 +110,8 @@ public class DataApiTempXml implements DataApiInterface {
     		log.debug("RES resVO : resultCode    = " + resVO.getResultCode());
     		log.debug("RES resVO : resultMessage = " + resVO.getResultMessage());
     		
-    	} catch(Exception e) {
+    	} catch(JsonProcessingException e) {
-    		log.error("ERROR at DataApiTempXml.request : " + e.toString());
+    		log.error("JsonProcessingException at DataApiTempXml.request : " + e.toString());
     		return DataApiInterface.makeErrorRes("E_REQ_EXCEPTION", e.toString());
     	}
     	
@@ -125,7 +126,7 @@ public class DataApiTempXml implements DataApiInterface {
 	 * @return
 	 * @throws Exception
 	 */
-	private String getTempDataFromXmlFile(DataApiReqVO reqVO) throws Exception {
+	private String getTempDataFromXmlFile(DataApiReqVO reqVO) throws JsonProcessingException {
 	
 		HttpMethod method = reqVO.getReqMethod();
 		String fileName = reqVO.getReqUrl().substring(1).replaceAll("/", ".");
@@ -163,8 +164,6 @@ public class DataApiTempXml implements DataApiInterface {
 			    returnXmlStr = strBd.toString();
 			} catch (IOException e) {
 				log.error("XML 파일 읽는 중 오류 발생 : " + e.toString());
-				e.printStackTrace();
-				
 				resVO = new DataApiServerResponseVO("-22", String.format("%s 파일을 읽는 중 오류가 발생하였습니다(%s). ",xmlPath, e.toString()));
 				XmlMapper mapper = new XmlMapper();
 				returnXmlStr = mapper.writer().withRootName(DataApiVO.XML_EL_NAME_ROOT_NAME).writeValueAsString(resVO);

src/main/java/nlib/user/service/impl/LoginServiceImpl.java

@@ -171,6 +171,9 @@ public class LoginServiceImpl implements LoginService
 	        nlibLoginVO.setJoinCouncilNm((String)session.getAttribute("councilNm"));
 	        
 	        OAuthUniversalUser ousr = SessionConfig.getLoginInfo(sessionId);
+	        if(ousr == null) {
+	        	throw new Exception("잘모된 접근으로 사용자 로그인 정보를 확인할 수 없습니다.");
+	        }
 	        nlibLoginVO.setSnsType(ousr.getSnsType());
 	        
 	        // 실제 SecurityContext 에 authentication 정보를 등록한다.