[NAE-1944] Server-side JavaScript Code Injection (SSJI)

src/main/java/com/netgrif/application/engine/elastic/service/ElasticCaseService.java

@@ -8,6 +8,7 @@
 import com.netgrif.application.engine.elastic.service.interfaces.IElasticCasePrioritySearch;
 import com.netgrif.application.engine.elastic.service.interfaces.IElasticCaseService;
 import com.netgrif.application.engine.elastic.web.requestbodies.CaseSearchRequest;
+import com.netgrif.application.engine.petrinet.domain.PetriNetSearch;
 import com.netgrif.application.engine.petrinet.service.interfaces.IPetriNetService;
 import com.netgrif.application.engine.petrinet.web.responsebodies.PetriNetReference;
 import com.netgrif.application.engine.utils.FullPageRequest;
@@ -465,8 +466,8 @@ private boolean buildGroupQuery(CaseSearchRequest request, LoggedUser user, Loca
             return false;
         }
 
-        Map<String, Object> processQuery = new HashMap<>();
-        processQuery.put("group", request.group);
+        PetriNetSearch processQuery = new PetriNetSearch();
+        processQuery.setGroup(request.group);
         List<PetriNetReference> groupProcesses = this.petriNetService.search(processQuery, user, new FullPageRequest(), locale).getContent();
         if (groupProcesses.size() == 0)
             return true;

src/main/java/com/netgrif/application/engine/elastic/service/ElasticTaskService.java

@@ -6,6 +6,7 @@
 import com.netgrif.application.engine.elastic.service.interfaces.IElasticTaskService;
 import com.netgrif.application.engine.elastic.web.requestbodies.CaseSearchRequest;
 import com.netgrif.application.engine.elastic.web.requestbodies.ElasticTaskSearchRequest;
+import com.netgrif.application.engine.petrinet.domain.PetriNetSearch;
 import com.netgrif.application.engine.petrinet.service.interfaces.IPetriNetService;
 import com.netgrif.application.engine.petrinet.web.responsebodies.PetriNetReference;
 import com.netgrif.application.engine.utils.FullPageRequest;
@@ -423,8 +424,8 @@ public boolean buildGroupQuery(TaskSearchRequest request, LoggedUser user, Local
         if (request.group == null || request.group.isEmpty())
             return false;
 
-        Map<String, Object> processQuery = new HashMap<>();
-        processQuery.put("group", request.group);
+        PetriNetSearch processQuery = new PetriNetSearch();
+        processQuery.setGroup(request.group);
         List<PetriNetReference> groupProcesses = this.petriNetService.search(processQuery, user, new FullPageRequest(), locale).getContent();
         if (groupProcesses.size() == 0)
             return true;

src/main/java/com/netgrif/application/engine/petrinet/domain/PetriNetSearch.java

@@ -0,0 +1,33 @@
+package com.netgrif.application.engine.petrinet.domain;
+
+import com.netgrif.application.engine.auth.domain.Author;
+import com.netgrif.application.engine.petrinet.domain.version.Version;
+import lombok.Getter;
+import lombok.Setter;
+import java.util.List;
+import java.util.Map;
+
+@Getter
+@Setter
+public class PetriNetSearch {
+
+    private String importId;
+
+    private String identifier;
+
+    private String title;
+
+    private String defaultCaseName;
+
+    private String initials;
+
+    private List<String> group;
+
+    private Version version;
+
+    private Author author;
+
+    private List<String> negativeViewRoles;
+
+    private Map<String, String> tags;
+}

src/main/java/com/netgrif/application/engine/petrinet/service/PetriNetService.java

@@ -36,6 +36,7 @@
 import com.netgrif.application.engine.workflow.service.interfaces.IFieldActionsCacheService;
 import com.netgrif.application.engine.workflow.service.interfaces.IWorkflowService;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.tomcat.util.http.fileupload.IOUtils;
 import org.bson.Document;
 import org.bson.types.ObjectId;
@@ -457,35 +458,61 @@ public Optional<PetriNet> findByImportId(String id) {
     }
 
     @Override
-    public Page<PetriNetReference> search(Map<String, Object> criteria, LoggedUser user, Pageable pageable, Locale locale) {
+    public Page<PetriNetReference> search(PetriNetSearch criteriaClass, LoggedUser user, Pageable pageable, Locale locale) {
         Query query = new Query();
-        Query query_total = new Query();
+        Query queryTotal = new Query();
 
         if (!user.getSelfOrImpersonated().isAdmin())
             query.addCriteria(getProcessRolesCriteria(user.getSelfOrImpersonated()));
 
-        criteria.forEach((key, value) -> {
-            Criteria valueCriteria;
-            if (key.equalsIgnoreCase("group")) {
-                if (value instanceof List) {
-                    Collection<String> authors = this.groupService.getGroupsOwnerEmails((List<String>) value);
-                    valueCriteria = Criteria.where("author.email").in(authors);
-                } else {
-                    valueCriteria = Criteria.where("author.email").is(this.groupService.getGroupOwnerEmail((String) value));
-                }
-            } else if (value instanceof List)
-                valueCriteria = Criteria.where(key).in(value);
-            else if (key.equalsIgnoreCase("title") || key.equalsIgnoreCase("initials") || key.equalsIgnoreCase("identifier"))
-                valueCriteria = Criteria.where(key).regex((String) value, "i");
-            else
-                valueCriteria = Criteria.where(key).is(value);
-            query.addCriteria(valueCriteria);
-            query_total.addCriteria(valueCriteria);
-        });
+        if (criteriaClass.getIdentifier() != null) {
+            this.addValueCriteria(query, queryTotal, Criteria.where("identifier").regex(criteriaClass.getIdentifier(), "i"));
+        }
+        if (criteriaClass.getTitle() != null) {
+            this.addValueCriteria(query, queryTotal, Criteria.where("title.defaultValue").regex(criteriaClass.getTitle(), "i"));
+        }
+        if (criteriaClass.getInitials() != null) {
+            this.addValueCriteria(query, queryTotal, Criteria.where("initials").regex(criteriaClass.getInitials(), "i"));
+        }
+        if (criteriaClass.getDefaultCaseName() != null) {
+            this.addValueCriteria(query, queryTotal, Criteria.where("defaultCaseName.defaultValue").regex(criteriaClass.getDefaultCaseName(), "i"));
+        }
+        if (criteriaClass.getGroup() != null) {
+            if (criteriaClass.getGroup().size() == 1) {
+                this.addValueCriteria(query, queryTotal, Criteria.where("author.email").is(this.groupService.getGroupOwnerEmail(criteriaClass.getGroup().get(0))));
+            } else {
+                this.addValueCriteria(query, queryTotal,Criteria.where("author.email").in(this.groupService.getGroupsOwnerEmails(criteriaClass.getGroup())));
+            }
+        }
+        if (criteriaClass.getVersion() != null) {
+            this.addValueCriteria(query, queryTotal, Criteria.where("version").is(criteriaClass.getVersion()));
+        }
+        if (criteriaClass.getAuthor() != null) {
+            if (criteriaClass.getAuthor().getEmail() != null) {
+                this.addValueCriteria(query, queryTotal, Criteria.where("author.email").is(criteriaClass.getAuthor().getEmail()));
+            }
+            if (criteriaClass.getAuthor().getId() != null) {
+                this.addValueCriteria(query, queryTotal, Criteria.where("author.id").is(criteriaClass.getAuthor().getId()));
+            }
+            if (criteriaClass.getAuthor().getFullName() != null) {
+                this.addValueCriteria(query, queryTotal, Criteria.where("author.fullName").is(criteriaClass.getAuthor().getFullName()));
+            }
+        }
+        if (criteriaClass.getNegativeViewRoles() != null) {
+            this.addValueCriteria(query, queryTotal, Criteria.where("negativeViewRoles").in(criteriaClass.getNegativeViewRoles()));
+        }
+        if (criteriaClass.getTags() != null) {
+            criteriaClass.getTags().entrySet().forEach(stringStringEntry -> this.addValueCriteria(query, queryTotal, Criteria.where("tags." + stringStringEntry.getKey()).is(stringStringEntry.getValue())));
+        }
 
         query.with(pageable);
         List<PetriNet> nets = mongoTemplate.find(query, PetriNet.class);
-        return new PageImpl<>(nets.stream().map(net -> new PetriNetReference(net, locale)).collect(Collectors.toList()), pageable, mongoTemplate.count(query_total, PetriNet.class));
+        return new PageImpl<>(nets.stream().map(net -> new PetriNetReference(net, locale)).collect(Collectors.toList()), pageable, mongoTemplate.count(queryTotal, PetriNet.class));
+    }
+
+    private void addValueCriteria(Query query, Query queryTotal, Criteria criteria) {
+        query.addCriteria(criteria);
+        queryTotal.addCriteria(criteria);
     }
 
     @Override

src/main/java/com/netgrif/application/engine/petrinet/service/interfaces/IPetriNetService.java

@@ -3,6 +3,7 @@
 import com.netgrif.application.engine.auth.domain.LoggedUser;
 import com.netgrif.application.engine.importer.service.throwable.MissingIconKeyException;
 import com.netgrif.application.engine.petrinet.domain.PetriNet;
+import com.netgrif.application.engine.petrinet.domain.PetriNetSearch;
 import com.netgrif.application.engine.petrinet.domain.Transition;
 import com.netgrif.application.engine.petrinet.domain.VersionType;
 import com.netgrif.application.engine.petrinet.domain.dataset.Field;
@@ -69,7 +70,7 @@ public interface IPetriNetService {
 
     List<DataFieldReference> getDataFieldReferences(List<TransitionReference> transitions, Locale locale);
 
-    Page<PetriNetReference> search(Map<String, Object> criteria, LoggedUser user, Pageable pageable, Locale locale);
+    Page<PetriNetReference> search(PetriNetSearch criteria, LoggedUser user, Pageable pageable, Locale locale);
 
     Optional<PetriNet> findByImportId(String id);
 

src/main/java/com/netgrif/application/engine/petrinet/web/PetriNetController.java

@@ -6,6 +6,7 @@
 import com.netgrif.application.engine.importer.service.Importer;
 import com.netgrif.application.engine.importer.service.throwable.MissingIconKeyException;
 import com.netgrif.application.engine.petrinet.domain.PetriNet;
+import com.netgrif.application.engine.petrinet.domain.PetriNetSearch;
 import com.netgrif.application.engine.petrinet.domain.VersionType;
 import com.netgrif.application.engine.petrinet.domain.throwable.MissingPetriNetMetaDataException;
 import com.netgrif.application.engine.petrinet.domain.version.StringToVersionConverter;
@@ -171,7 +172,7 @@ public FileSystemResource getNetFile(@PathVariable("netId") String netId, @Reque
     @Operation(summary = "Search processes", security = {@SecurityRequirement(name = "BasicAuth")})
     @PostMapping(value = "/search", produces = MediaTypes.HAL_JSON_VALUE)
     public @ResponseBody
-    PagedModel<PetriNetReferenceResource> searchPetriNets(@RequestBody Map<String, Object> criteria, Authentication auth, Pageable pageable, PagedResourcesAssembler<PetriNetReference> assembler, Locale locale) {
+    PagedModel<PetriNetReferenceResource> searchPetriNets(@RequestBody PetriNetSearch criteria, Authentication auth, Pageable pageable, PagedResourcesAssembler<PetriNetReference> assembler, Locale locale) {
         LoggedUser user = (LoggedUser) auth.getPrincipal();
         Page<PetriNetReference> nets = service.search(criteria, user, pageable, locale);
         Link selfLink = WebMvcLinkBuilder.linkTo(WebMvcLinkBuilder.methodOn(PetriNetController.class)

src/main/java/com/netgrif/application/engine/petrinet/web/PublicPetriNetController.java

@@ -2,6 +2,7 @@
 
 import com.netgrif.application.engine.auth.service.interfaces.IUserService;
 import com.netgrif.application.engine.petrinet.domain.PetriNet;
+import com.netgrif.application.engine.petrinet.domain.PetriNetSearch;
 import com.netgrif.application.engine.petrinet.domain.version.StringToVersionConverter;
 import com.netgrif.application.engine.petrinet.service.interfaces.IPetriNetService;
 import com.netgrif.application.engine.petrinet.service.interfaces.IProcessRoleService;
@@ -69,7 +70,7 @@ public PetriNetReferenceResource getOne(@PathVariable("identifier") String ident
 
     @Operation(summary = "Search processes")
     @PostMapping(value = "/search", consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaTypes.HAL_JSON_VALUE)
-    public PagedModel<PetriNetReferenceResource> searchPetriNets(@RequestBody Map<String, Object> criteria, Pageable pageable, PagedResourcesAssembler<PetriNetReference> assembler, Locale locale) {
+    public PagedModel<PetriNetReferenceResource> searchPetriNets(@RequestBody PetriNetSearch criteria, Pageable pageable, PagedResourcesAssembler<PetriNetReference> assembler, Locale locale) {
         Page<PetriNetReference> nets = petriNetService.search(criteria, userService.getAnonymousLogged(), pageable, locale);
         Link selfLink = WebMvcLinkBuilder.linkTo(WebMvcLinkBuilder.methodOn(PublicPetriNetController.class)
                 .searchPetriNets(criteria, pageable, assembler, locale)).withRel("search");

src/main/java/com/netgrif/application/engine/workflow/service/CaseSearchService.java

@@ -4,6 +4,7 @@
 import com.netgrif.application.engine.importer.service.FieldFactory;
 import com.netgrif.application.engine.petrinet.domain.I18nString;
 import com.netgrif.application.engine.petrinet.domain.PetriNet;
+import com.netgrif.application.engine.petrinet.domain.PetriNetSearch;
 import com.netgrif.application.engine.petrinet.domain.dataset.FieldType;
 import com.netgrif.application.engine.petrinet.domain.dataset.UserFieldValue;
 import com.netgrif.application.engine.petrinet.service.interfaces.IPetriNetService;
@@ -347,8 +348,12 @@ private static BooleanExpression caseIdString(String caseId) {
     }
 
     public Predicate group(Object query, LoggedUser user, Locale locale) {
-        Map<String, Object> processQuery = new HashMap<>();
-        processQuery.put(GROUP, query);
+        PetriNetSearch processQuery = new PetriNetSearch();
+        if (query instanceof List) {
+            processQuery.setGroup((List<String>) query);
+        } else if (query instanceof String) {
+            processQuery.setGroup(new ArrayList<String>( Arrays.asList((String) query)) );
+        }
         List<PetriNetReference> groupProcesses = this.petriNetService.search(processQuery, user, new FullPageRequest(), locale).getContent();
         if (groupProcesses.size() == 0)
             return null;

src/main/java/com/netgrif/application/engine/workflow/service/ConfigurableMenuService.java

@@ -1,9 +1,11 @@
 package com.netgrif.application.engine.workflow.service;
 
+import com.netgrif.application.engine.auth.domain.Author;
 import com.netgrif.application.engine.auth.domain.LoggedUser;
 import com.netgrif.application.engine.auth.domain.User;
 import com.netgrif.application.engine.petrinet.domain.I18nString;
 import com.netgrif.application.engine.petrinet.domain.PetriNet;
+import com.netgrif.application.engine.petrinet.domain.PetriNetSearch;
 import com.netgrif.application.engine.petrinet.domain.dataset.EnumerationMapField;
 import com.netgrif.application.engine.petrinet.domain.dataset.MultichoiceMapField;
 import com.netgrif.application.engine.petrinet.domain.version.StringToVersionConverter;
@@ -43,8 +45,10 @@ public class ConfigurableMenuService implements IConfigurableMenuService {
     @Override
     public Map<String, I18nString> getNetsByAuthorAsMapOptions(User author, Locale locale){
         LoggedUser loggedAuthor = author.transformToLoggedUser();
-        Map<String, Object> requestQuery = new HashMap<>();
-        requestQuery.put("author.email", author.getEmail());
+        PetriNetSearch requestQuery = new PetriNetSearch();
+        Author authorQuery = new Author();
+        authorQuery.setEmail(author.getEmail());
+        requestQuery.setAuthor(authorQuery);
         List<PetriNetReference> nets = this.petriNetService.search(requestQuery, loggedAuthor, new FullPageRequest(), locale).getContent();
 
         Map<String, I18nString> options = new HashMap<>();

src/main/java/com/netgrif/application/engine/workflow/service/TaskSearchService.java

@@ -1,6 +1,7 @@
 package com.netgrif.application.engine.workflow.service;
 
 import com.netgrif.application.engine.auth.domain.LoggedUser;
+import com.netgrif.application.engine.petrinet.domain.PetriNetSearch;
 import com.netgrif.application.engine.petrinet.service.interfaces.IPetriNetService;
 import com.netgrif.application.engine.petrinet.web.responsebodies.PetriNetReference;
 import com.netgrif.application.engine.utils.FullPageRequest;
@@ -271,8 +272,8 @@ public boolean buildGroupQuery(TaskSearchRequest request, LoggedUser user, Local
         if (request.group == null || request.group.isEmpty())
             return false;
 
-        Map<String, Object> processQuery = new HashMap<>();
-        processQuery.put("group", request.group);
+        PetriNetSearch processQuery = new PetriNetSearch();
+        processQuery.setGroup(request.group);
         List<PetriNetReference> groupProcesses = this.petriNetService.search(processQuery, user, new FullPageRequest(), locale).getContent();
         if (groupProcesses.size() == 0)
             return true;