Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes to ogc-server-statistics to pass all tests #2392

Merged
merged 3 commits into from Jan 22, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 10 additions & 0 deletions ogc-server-statistics/pom.xml
Expand Up @@ -10,6 +10,7 @@
<name>ogc-server-statistics</name>
<url>http://maven.apache.org</url>
<properties>
<java.version>1.8</java.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>
<build>
Expand All @@ -19,6 +20,15 @@
<artifactId>maven-surefire-plugin</artifactId>
<version>2.16</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>${java.version}</source>
<target>${java.version}</target>
<encoding>${project.build.sourceEncoding}</encoding>
</configuration>
</plugin>
</plugins>
</build>
<dependencies>
Expand Down
Expand Up @@ -77,31 +77,17 @@ public void execute() throws DataCommandException {
assert this.connection != null: "database connection is null, use setConnection";

// executes the sql statement and populates the list with the data present in the result set
ResultSet rs = null;
PreparedStatement pStmt=null;
try {
pStmt = prepareStatement();

rs = pStmt.executeQuery();

this.resultList = new LinkedList<Map<String,Object>>();
try (PreparedStatement pStmt = prepareStatement()){
try (ResultSet rs = pStmt.executeQuery()) {

while (rs.next()) {
this.resultList.add( getRow(rs));
}
this.resultList = new LinkedList<>();

while (rs.next()) {
this.resultList.add(getRow(rs));
}
}
} catch (SQLException e) {

throw new DataCommandException(e.getMessage());

} finally{
try {
if(rs != null) rs.close();
if(pStmt != null) pStmt.close();

} catch (SQLException e1) {
throw new DataCommandException(e1.getMessage());
}
throw new DataCommandException(e);
}
}

Expand Down
Expand Up @@ -19,7 +19,9 @@

package org.georchestra.ogcservstatistics.dataservices;

import java.sql.*;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;

/**
* This Singleton maintains the configuration data required to access to the database where
Expand Down
Expand Up @@ -19,6 +19,8 @@

package org.georchestra.ogcservstatistics.dataservices;

import static org.georchestra.ogcservstatistics.dataservices.LogColumns.QUALIFIED_TABLE_NAME;

import java.sql.SQLException;
import java.sql.Statement;

Expand All @@ -28,7 +30,7 @@
* @author Mauricio Pazos
*
*/
final public class DeleteAllCommand extends AbstractDataCommand {
public final class DeleteAllCommand extends AbstractDataCommand {

/**
* This method will execute a SQL Delete!
Expand All @@ -37,23 +39,10 @@ final public class DeleteAllCommand extends AbstractDataCommand {
*/
@Override
public void execute() throws DataCommandException {

//PreparedStatement pStmt=null;
Statement pStmt=null;
try {
pStmt = this.connection.createStatement();
pStmt.execute("DELETE FROM ogcstatistics.OGC_SERVICES_LOG");

try (Statement pStmt = this.connection.createStatement()){
pStmt.execute(String.format("DELETE FROM %s", QUALIFIED_TABLE_NAME));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm aware that QUALIFIED_TABLE_NAME is not an user input, but String.format() to format SQL queries is prone to sql injections

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right. In this case it's safe as QUALIFIED_TABLE_NAME is a constant to avoid possible typos. It would also make it safe in the event the table name changed (e.g. it has the schema hardcoded, might that change eventually?).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No plan to change this.
Honestly, this looks safe enough for me.

} catch (SQLException e) {
e.printStackTrace();
throw new DataCommandException(e);
} finally{
try {
if(pStmt != null) pStmt.close();

} catch (SQLException e1) {
throw new DataCommandException(e1.getMessage());
}
}
}
}
Expand Up @@ -19,87 +19,91 @@

package org.georchestra.ogcservstatistics.dataservices;

import org.georchestra.ogcservstatistics.log4j.OGCServiceParser;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.DATE_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.LAYER_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.ORG_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.QUALIFIED_TABLE_NAME;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.REQUEST_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.SECROLE_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.SERVICE_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.USER_COLUMN;

import java.sql.Array;
import java.sql.PreparedStatement;
import java.sql.SQLException;
import java.util.Map;

import org.apache.log4j.Logger;

/**
* Insert an ogc service log
*
* @author Mauricio Pazos
*
*/
public final class InsertCommand extends AbstractDataCommand {

private static final Logger LOGGER = Logger.getLogger(InsertCommand.class);

private static final String SQL_INSERT= "INSERT INTO ogcstatistics.ogc_services_log(" + OGCServiceParser.USER_COLUMN +
"," + OGCServiceParser.DATE_COLUMN +
"," + OGCServiceParser.SERVICE_COLUMN +
"," + OGCServiceParser.LAYER_COLUMN +
"," + OGCServiceParser.REQUEST_COLUMN +
"," + OGCServiceParser.ORG_COLUMN +
"," + OGCServiceParser.SECROLE_COLUMN +
") VALUES (?, ?, ?, ?, ?, ?, string_to_array(?, ','))";

private Map<String, Object> rowValues;


public void setRowValues(final Map<String, Object> ogcServiceLog) {

this.rowValues = ogcServiceLog;
}
private static final String SQL_INSERT = "INSERT INTO " + QUALIFIED_TABLE_NAME + "(" + USER_COLUMN + ","
+ DATE_COLUMN + "," + SERVICE_COLUMN + "," + LAYER_COLUMN + "," + REQUEST_COLUMN + "," + ORG_COLUMN + ","
+ SECROLE_COLUMN + ") VALUES (?, ?, ?, ?, ?, ?, string_to_array(?, ','))";

private Map<String, Object> rowValues;

public void setRowValues(final Map<String, Object> ogcServiceLog) {

this.rowValues = ogcServiceLog;
}

private PreparedStatement prepareStatement() throws SQLException {

assert this.connection != null : "database connection is null, use setConnection";

PreparedStatement pStmt = this.connection.prepareStatement(SQL_INSERT);
pStmt.setString(1, (String) this.rowValues.get(USER_COLUMN));

java.sql.Timestamp sqlDate = new java.sql.Timestamp(
((java.util.Date) this.rowValues.get(DATE_COLUMN)).getTime());
pStmt.setTimestamp(2, sqlDate);
pStmt.setString(3, ((String) this.rowValues.get(SERVICE_COLUMN)).trim());
pStmt.setString(4, ((String) this.rowValues.get(LAYER_COLUMN)).trim());
pStmt.setString(5, ((String) this.rowValues.get(REQUEST_COLUMN)).trim());
pStmt.setString(6, ((String) this.rowValues.get(ORG_COLUMN)).trim());
pStmt.setString(7, ((String) this.rowValues.get(SECROLE_COLUMN)).trim());

private PreparedStatement prepareStatement() throws SQLException {
return pStmt;
}

assert this.connection != null: "database connection is null, use setConnection";
@Override
public void execute() throws DataCommandException {

PreparedStatement pStmt = this.connection.prepareStatement(SQL_INSERT);
pStmt.setString(1, (String)this.rowValues.get(OGCServiceParser.USER_COLUMN));
assert this.connection != null : "database connection is null, use setConnection";

java.sql.Timestamp sqlDate = new java.sql.Timestamp(((java.util.Date) this.rowValues.get(OGCServiceParser.DATE_COLUMN)).getTime());
pStmt.setTimestamp(2, sqlDate);
pStmt.setString(3, ((String)this.rowValues.get(OGCServiceParser.SERVICE_COLUMN)).trim());
pStmt.setString(4, ((String)this.rowValues.get(OGCServiceParser.LAYER_COLUMN)).trim());
pStmt.setString(5, ((String)this.rowValues.get(OGCServiceParser.REQUEST_COLUMN)).trim());
pStmt.setString(6, ((String)this.rowValues.get(OGCServiceParser.ORG_COLUMN)).trim());
pStmt.setString(7, ((String)this.rowValues.get(OGCServiceParser.SECROLE_COLUMN)).trim());

return pStmt;
try {
this.connection.setAutoCommit(false);
} catch (SQLException e) {
throw new DataCommandException(e);
}

@Override
public void execute() throws DataCommandException {

assert this.connection != null: "database connection is null, use setConnection";

// executes the sql statement and checks that the update operation will be inserted one row in the table
PreparedStatement pStmt=null;
try {
this.connection.setAutoCommit(false);
pStmt = prepareStatement();
pStmt.executeUpdate();
this.connection.commit();
} catch (SQLException e) {
if(this.connection != null){
try {
this.connection.rollback();
} catch (SQLException e1) {
e1.printStackTrace();
throw new DataCommandException(e.getMessage());
}
throw new DataCommandException(e.getMessage());
}
} finally{
try {
if(pStmt != null) pStmt.close();
this.connection.setAutoCommit(true);

} catch (SQLException e1) {
throw new DataCommandException(e1.getMessage());
}
}

// executes the sql statement and checks that the update operation will be
// inserted one row in the table
try (PreparedStatement pStmt = prepareStatement()) {
pStmt.executeUpdate();
this.connection.commit();
} catch (SQLException e) {
try {
this.connection.rollback();
} catch (SQLException e1) {
throw new DataCommandException(e);
}
throw new DataCommandException(e);
} finally {
try {
this.connection.setAutoCommit(true);
} catch (SQLException e1) {
// ignore, it's bad practice to throw exceptions in finally blocks
LOGGER.warn("Error rolling back SQL transaction", e1);
}
}
}
}
@@ -0,0 +1,39 @@
/*
* Copyright (C) 2019 by the geOrchestra PSC
*
* This file is part of geOrchestra.
*
* geOrchestra is free software: you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free
* Software Foundation, either version 3 of the License, or (at your option)
* any later version.
*
* geOrchestra is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
* more details.
*
* You should have received a copy of the GNU General Public License along with
* geOrchestra. If not, see <http://www.gnu.org/licenses/>.
*/
package org.georchestra.ogcservstatistics.dataservices;

/**
* Constants for log's table and column names
*/
public final class LogColumns {

public static final String QUALIFIED_TABLE_NAME = "ogcstatistics.OGC_SERVICES_LOG";

public static final String DATE_COLUMN = "date";
public static final String USER_COLUMN = "user_name";
public static final String SERVICE_COLUMN = "service";
public static final String LAYER_COLUMN = "layer";
public static final String REQUEST_COLUMN = "request";
public static final String ORG_COLUMN = "org";
public static final String SECROLE_COLUMN = "roles";

private LogColumns() {
// private constructor, force class being purely a utility class
}
}
Expand Up @@ -19,6 +19,13 @@

package org.georchestra.ogcservstatistics.dataservices;

import static org.georchestra.ogcservstatistics.dataservices.LogColumns.DATE_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.LAYER_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.QUALIFIED_TABLE_NAME;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.SECROLE_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.SERVICE_COLUMN;
import static org.georchestra.ogcservstatistics.dataservices.LogColumns.USER_COLUMN;

import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
Expand All @@ -31,31 +38,21 @@
* @author Mauricio Pazos
*
*/
final public class RetrieveAllCommand extends AbstractQueryCommand{

final static String DATE_COLUMN = "date";
final static String USER__COLUMN = "user_name";
final static String SERVICE_COLUMN = "service";
final static String LAYER_COLUMN = "layer";
final static String SECROLE_COLUMN = "secrole";
public final class RetrieveAllCommand extends AbstractQueryCommand{


final static String SQL = " SELECT "+ DATE_COLUMN+ "," + USER__COLUMN +","+ SERVICE_COLUMN+","+LAYER_COLUMN+","+SECROLE_COLUMN
+ " FROM ogcstatistics.OGC_SERVICES_LOG"
+ " ORDER BY "+ DATE_COLUMN+ "," + USER__COLUMN +","+ SERVICE_COLUMN+","+LAYER_COLUMN+","+SECROLE_COLUMN;
private static final String SQL = " SELECT "+ DATE_COLUMN+ "," + USER_COLUMN +","+ SERVICE_COLUMN+","+LAYER_COLUMN+","+SECROLE_COLUMN
+ " FROM " + QUALIFIED_TABLE_NAME
+ " ORDER BY "+ DATE_COLUMN+ "," + USER_COLUMN +","+ SERVICE_COLUMN+","+LAYER_COLUMN+","+SECROLE_COLUMN;

protected PreparedStatement prepareStatement() throws SQLException{

PreparedStatement pStmt = this.connection.prepareStatement(SQL);

return pStmt;
return connection.prepareStatement(SQL);
}

protected Map<String, Object> getRow(ResultSet rs) throws SQLException{

Map<String,Object> row = new HashMap<String, Object>(5);
Map<String,Object> row = new HashMap<>(5);
row.put(DATE_COLUMN, rs.getDate(DATE_COLUMN));
row.put(USER__COLUMN, rs.getString(USER__COLUMN));
row.put(USER_COLUMN, rs.getString(USER_COLUMN));
row.put(SERVICE_COLUMN, rs.getString(SERVICE_COLUMN));
row.put(LAYER_COLUMN, rs.getString(LAYER_COLUMN));
row.put(SECROLE_COLUMN, rs.getString(SECROLE_COLUMN));
Expand Down