Updated and removed some dependencies for security purpose (develop/dogfish version)

src/main/java/ca/openosp/openo/billings/ca/bc/Teleplan/TeleplanCodesManager.java

@@ -30,12 +30,15 @@
 import java.io.File;
 import java.io.FileReader;
 import java.math.BigDecimal;
+import java.nio.file.Path;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
 
 import ca.openosp.openo.utility.MiscUtils;
 
+import ca.openosp.OscarProperties;
+
 
 /**
  * @author jay
@@ -60,7 +63,18 @@ public TeleplanCodesManager() {
 REM075 **          Description          This is a Title description   **                      
 REM076 **                                                             **        
      */
-    public List parse(File f) throws Exception {
+    public List parse(File f) throws Exception {        
+        // Define allowed directory (configure this based on your needs)
+        File allowedDir = new File(OscarProperties.getInstance().getProperty("DOCUMENT_DIR"));
+
+        // Convert to Path and normalize
+        Path filePath = f.toPath().normalize().toAbsolutePath();
+        Path allowedPath = allowedDir.toPath().normalize().toAbsolutePath();
+
+        if (!filePath.startsWith(allowedPath)) {
+            throw new SecurityException("File access not allowed outside designated directory");
+        }
+
         BufferedReader buff = new BufferedReader(new FileReader(f));
 
         String line = null;

src/main/java/ca/openosp/openo/billings/ca/bc/Teleplan/TeleplanResponse.java

@@ -33,6 +33,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
+import java.nio.file.Path;
 
 import org.apache.logging.log4j.Logger;
 import ca.openosp.openo.utility.MiscUtils;
@@ -85,10 +86,21 @@ void processResponseStream(InputStream in) {
                 File file = new File(tempFile);
                 realFilename = "teleplan" + this.getFilename() + randNum;
                 File file2 = new File(directory + realFilename);
+
+                // Define allowed directory (configure this based on your needs)
+                File allowedDir = new File(OscarProperties.getInstance().getProperty("DOCUMENT_DIR"));
+
+                // Convert to Path and normalize
+                Path filePath = file2.toPath().normalize().toAbsolutePath();
+                Path allowedPath = allowedDir.toPath().normalize().toAbsolutePath();
+
+                if (!filePath.startsWith(allowedPath)) {
+                    throw new SecurityException("File access not allowed outside designated directory");
+                }
+
                 boolean success = file.renameTo(file2);
                 if (!success) {
                     log.error("File was not successfully renamed");
-                    // 
                 }
             }
 

src/main/java/ca/openosp/openo/billings/ca/bc/pageUtil/ManageTeleplan2Action.java

@@ -29,6 +29,7 @@
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.FileReader;
+import java.nio.file.Path;
 import java.util.Date;
 import java.util.Enumeration;
 import java.util.List;
@@ -159,6 +160,18 @@ public String updateteleplanICDCodesList()
         log.debug("real filename " + tr.getRealFilename());
 
         File file = tr.getFile();
+
+        // Define allowed directory (configure this based on your needs)
+        File allowedDir = new File(OscarProperties.getInstance().getProperty("DOCUMENT_DIR"));
+
+        // Convert to Path and normalize
+        Path filePath = file.toPath().normalize().toAbsolutePath();
+        Path allowedPath = allowedDir.toPath().normalize().toAbsolutePath();
+
+        if (!filePath.startsWith(allowedPath)) {
+            throw new SecurityException("File access not allowed outside designated directory");
+        }
+
         BufferedReader buff = new BufferedReader(new FileReader(file));
 
         String line = null;
@@ -220,6 +233,18 @@ public String updateExplanatoryCodesList()
         log.debug("real filename " + tr.getRealFilename());
 
         File file = tr.getFile();
+
+        // Define allowed directory (configure this based on your needs)
+        File allowedDir = new File(OscarProperties.getInstance().getProperty("DOCUMENT_DIR"));
+
+        // Convert to Path and normalize
+        Path filePath = file.toPath().normalize().toAbsolutePath();
+        Path allowedPath = allowedDir.toPath().normalize().toAbsolutePath();
+
+        if (!filePath.startsWith(allowedPath)) {
+            throw new SecurityException("File access not allowed outside designated directory");
+        }
+
         BufferedReader buff = new BufferedReader(new FileReader(file));
 
         String line = null;
@@ -510,6 +535,19 @@ public String checkElig()
         String realFile = tr.getRealFilename();
         if (realFile != null && !realFile.trim().equals("")) {
             File file = tr.getFile();
+
+            // Define allowed directory (configure this based on your needs)
+            File allowedDir = new File(OscarProperties.getInstance().getProperty("DOCUMENT_DIR"));
+
+            // Convert to Path and normalize
+            Path filePath = file.toPath().normalize().toAbsolutePath();
+            Path allowedPath = allowedDir.toPath().normalize().toAbsolutePath();
+
+
+            if (!filePath.startsWith(allowedPath)) {
+                throw new SecurityException("File access not allowed outside designated directory");
+            }
+
             BufferedReader buff = new BufferedReader(new FileReader(file));
             StringBuilder sb = new StringBuilder();
             String line = null;