Merge pull request #369 from ChargeTimeEU/fix_issues_reported_by_scanners

Fix security and quality issues found by scanners

Author: robert-s-ubi

OCPP-J/src/main/java/eu/chargetime/ocpp/Draft_HttpHealthCheck.java

@@ -22,7 +22,7 @@ class Draft_HttpHealthCheck extends Draft {
 
     static Boolean isHttp(ClientHandshake handshakedata) {
         String upgradeField = handshakedata.getFieldValue("Upgrade");
-        return upgradeField == null || upgradeField == "";
+        return upgradeField == null || upgradeField.isEmpty();
     }
 
     @Override

OCPP-J/src/main/java/eu/chargetime/ocpp/WebSocketListener.java

@@ -271,7 +271,11 @@ public void close() {
         server.stop();
       } catch (InterruptedException ex) {
         logger.error("Failed to close listener", ex);
+        // restore thread interrupted state
+        Thread.currentThread().interrupt();
       }
+      // restore thread interrupted state
+      Thread.currentThread().interrupt();
     } finally {
       closed = true;
       server = null;

ocpp-common/src/main/java/eu/chargetime/ocpp/Communicator.java

@@ -363,6 +363,10 @@ public void run() {
           Thread.sleep(DELAY_IN_MILLISECONDS);
           if (!hasFailed()) popRetryMessage();
         }
+      } catch (InterruptedException ex) {
+        logger.warn("RetryRunner::run() interrupted", ex);
+        // restore thread interrupted state
+        Thread.currentThread().interrupt();
       } catch (Exception ex) {
         logger.warn("RetryRunner::run() failed", ex);
       }

ocpp-common/src/main/java/eu/chargetime/ocpp/utilities/SugarUtil.java

@@ -31,6 +31,7 @@ of this software and associated documentation files (the "Software"), to deal
 import java.io.IOException;
 import java.io.StringWriter;
 import java.time.ZonedDateTime;
+import javax.xml.XMLConstants;
 import javax.xml.soap.SOAPException;
 import javax.xml.soap.SOAPMessage;
 import javax.xml.transform.Transformer;
@@ -50,6 +51,9 @@ public static String docToString(Document doc) {
     try {
       StringWriter sw = new StringWriter();
       TransformerFactory tf = TransformerFactory.newInstance();
+      // disable access to external entities to prevent XXE attacks
+      tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+      tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
       Transformer transformer = tf.newTransformer();
       transformer.transform(new DOMSource(doc), new StreamResult(sw));
       return sw.toString();

ocpp-v1_6-example/json-client-implementation/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>2.5.6</version>
+		<version>3.2.0</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 	<groupId>eu.chargetime.ocpp</groupId>

ocpp-v1_6-example/json-client-implementation/src/test/java/eu/chargetime/ocpp/jsonclientimplementation/ocpphandler/OCPPHandlerTest.java

@@ -47,8 +47,13 @@ public void testOCPPAuthorizeHandler() {
                     .toCompletableFuture().get();
             assertTrue(true);
             assertEquals(AuthorizationStatus.Accepted,authorizeConfirmation.getIdTagInfo().getStatus());
-        } catch (OccurenceConstraintException | UnsupportedFeatureException
-                | ExecutionException | InterruptedException e) {
+        } catch (InterruptedException e) {
+          log.error("Thread interrupted: " + e);
+          // restore thread interrupted state
+          Thread.currentThread().interrupt();
+          log.error("Test will fail");
+          assertTrue(false);
+        } catch (OccurenceConstraintException | UnsupportedFeatureException | ExecutionException e) {
             log.error("Exception occurred: " + e);
             log.error("Test will fail");
             assertTrue(false);

ocpp-v1_6-example/json_server_example/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>2.5.6</version>
+		<version>3.2.0</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 	<groupId>eu.chargetime.ocpp</groupId>

ocpp-v1_6-test/src/main/java/eu/chargetime/ocpp/test/SOAPTestClient.java

@@ -143,7 +143,9 @@ private void openWS() {
                 try {
                   soapMessage = transmitter.relay(message.getMessage()).get();
                 } catch (InterruptedException e) {
-                  logger.warn("openWS() transmitter.relay failed", e);
+                  logger.warn("openWS() transmitter.relay interrupted", e);
+                  // restore thread interrupted state
+                  Thread.currentThread().interrupt();
                 } catch (ExecutionException e) {
                   logger.warn("openWS() transmitter.relay failed", e);
                 }

ocpp-v1_6/src/main/java/eu/chargetime/ocpp/SOAPClient.java

@@ -150,7 +150,9 @@ private void openWS() {
                 try {
                   soapMessage = transmitter.relay(message.getMessage()).get();
                 } catch (InterruptedException e) {
-                  logger.warn("openWS() transmitter.relay failed", e);
+                  logger.warn("openWS() transmitter.relay interrupted", e);
+                  // restore thread interrupted state
+                  Thread.currentThread().interrupt();
                 } catch (ExecutionException e) {
                   logger.warn("openWS() transmitter.relay failed", e);
                 }

ocpp-v1_6/src/main/java/eu/chargetime/ocpp/WebServiceListener.java

@@ -146,7 +146,11 @@ public void timeout() {
       SOAPMessage confirmation = null;
       try {
         confirmation = chargeBoxes.get(identity).relay(message).get();
-      } catch (InterruptedException | ExecutionException e) {
+      } catch (InterruptedException e) {
+        logger.warn("incomingRequest() chargeBoxes.relay interrupted", e);
+        // restore thread interrupted state
+        Thread.currentThread().interrupt();
+      } catch (ExecutionException e) {
         logger.warn("incomingRequest() chargeBoxes.relay failed", e);
       }