////////////////////////////////////////////////////////////////////////
//
// Copyright (c) 2009-2014 Denim Group, Ltd.
//
// The contents of this file are subject to the Mozilla Public License
// Version 2.0 (the "License"); you may not use this file except in
// compliance with the License. You may obtain a copy of the License at
// http://www.mozilla.org/MPL/
//
// Software distributed under the License is distributed on an "AS IS"
// basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the
// License for the specific language governing rights and limitations
// under the License.
//
// The Original Code is ThreadFix.
//
// The Initial Developer of the Original Code is Denim Group, Ltd.
// Portions created by Denim Group, Ltd. are Copyright (C)
// Denim Group, Ltd. All Rights Reserved.
//
// Contributor(s): Denim Group, Ltd.
//
////////////////////////////////////////////////////////////////////////
package com.denimgroup.threadfix.service;
import com.denimgroup.threadfix.data.dao.UserDao;
import com.denimgroup.threadfix.data.dao.VulnerabilityCommentDao;
import com.denimgroup.threadfix.data.dao.VulnerabilityDao;
import com.denimgroup.threadfix.data.entities.Permission;
import com.denimgroup.threadfix.data.entities.User;
import com.denimgroup.threadfix.data.entities.Vulnerability;
import com.denimgroup.threadfix.data.entities.VulnerabilityComment;
import com.denimgroup.threadfix.logging.SanitizedLogger;
import javax.annotation.Nullable;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import java.util.Date;
import java.util.List;
import java.util.Set;
@Service
@Transactional
public class VulnerabilityCommentServiceImpl implements VulnerabilityCommentService {
private final SanitizedLogger log = new SanitizedLogger(VulnerabilityCommentService.class);
@Autowired
private VulnerabilityCommentDao vulnerabilityCommentDao;
@Autowired
private VulnerabilityDao vulnerabilityDao;
@Autowired
private UserDao userDao;
@Autowired(required = false)
@Nullable
private PermissionService permissionService;
@Override
public List<VulnerabilityComment> loadAllForVuln(Integer vulnId) {
return vulnerabilityCommentDao.retrieveAllForVuln(vulnId);
}
@Override
public String addCommentToVuln(VulnerabilityComment vulnerabilityComment, Integer vulnId) {
if (vulnerabilityComment == null || vulnerabilityComment.getComment() == null || vulnerabilityComment.getComment().trim().isEmpty()) {
log.error("Invalid comment string.");
return EMPTY;
}
String trimmedComment = vulnerabilityComment.getComment().trim().replace("\r\n", "\n");
if (trimmedComment.length() > VulnerabilityComment.COMMENT_LENGTH) {
log.error("String was too long.");
return LENGTH;
}
if (vulnId == null) {
log.error("Invalid vuln ID");
return VULN;
}
Vulnerability vuln = vulnerabilityDao.retrieveById(vulnId);
if (vuln == null) {
log.error("Invalid vuln ID");
return VULN;
}
User user = null;
Object auth = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
if (auth != null && auth instanceof ThreadFixUserDetails) {
user = userDao.retrieveById(((ThreadFixUserDetails) auth).getUserId());
}
if (user == null) {
log.error("Invalid user.");
return USER;
}
VulnerabilityComment comment = new VulnerabilityComment();
comment.setTags(vulnerabilityComment.getTags());
comment.setComment(trimmedComment);
comment.setVulnerability(vuln);
comment.setTime(new Date());
comment.setUser(user);
vulnerabilityCommentDao.saveOrUpdate(comment);
return VALID;
}
@Override
public List<VulnerabilityComment> loadMostRecentFiltered(int number) {
if (permissionService == null || permissionService.isAuthorized(Permission.READ_ACCESS, null, null)) {
return vulnerabilityCommentDao.retrieveRecent(number);
}
Set<Integer> appIds = permissionService.getAuthenticatedAppIds();
Set<Integer> teamIds = permissionService.getAuthenticatedTeamIds();
return vulnerabilityCommentDao.retrieveRecent(number, appIds, teamIds);
}
@Override
public void saveVulnerabilityComment(VulnerabilityComment vulnerabilityComment) {
vulnerabilityCommentDao.saveOrUpdate(vulnerabilityComment);
}
@Override
public VulnerabilityComment loadVulnerabilityCommentById(int commentId) {
return vulnerabilityCommentDao.retrieveById(commentId);
}
}