Temenos Digital
Min(s) read
Unreleased Resources
This document is applicable for versions 202406 and 202407.
Description
The code fails to release a system resource.
Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker can potentially launch a denial of service attack by depleting the resource pool.
Recommendation
Release resources in a final block and close the streams and sockets explicitly.
Solution
Path:
localservices/ Fabric /java /DBPAdminIntegration /src /main /java /com /kony /AdminConsole /Utilities /HTTPOperations.java
In the above path replace the following code:
package com.kony.AdminConsole.Utilities;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import org.apache.http.HttpEntity;
import org.apache.http.HttpHeaders;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.HttpClient;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.entity.ContentType;
import org.apache.http.entity.InputStreamEntity;
import org.apache.http.entity.StringEntity;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.message.BasicNameValuePair;
import com.temenos.logger.Logger;
import com.temenos.logger.alert.Alert;
import org.json.JSONObject;
public class HTTPOperations {
private static final Alert alert = Logger.forAlert().forModule("Infinity", "DIGITALBANKING");
public String hitPOSTServiceAndGetResponse(String URL, HashMap<String, String> postParameters, String contentType,
String konyFabricAuthToken, HashMap<String, String> customHeaderParameters) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpPost httpPostRequestInstance = new HttpPost(URL);
List<NameValuePair> postParametersNameValuePairList = new ArrayList<>();
if (postParameters != null) {
for (String currKey : postParameters.keySet()) {
String currValue = postParameters.get(currKey);
postParametersNameValuePairList.add(new BasicNameValuePair(currKey, currValue));
}
}
InputStream responseStream = null;
try {
httpPostRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
httpPostRequestInstance.setEntity(
new UrlEncodedFormEntity(postParametersNameValuePairList, StandardCharsets.UTF_8.name()));
if (!CommonUtilities.isEmptyString(contentType)) {
httpPostRequestInstance.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
}
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpPostRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpPostRequestInstance.setHeader(currKey, currValue);
}
}
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpPostRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsString(responseStream);
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public String hitPOSTServiceAndGetResponse(String URL, JSONObject jsonPostParameter, String contentType,
String konyFabricAuthToken, HashMap<String, String> customHeaderParameters) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpPost httpPostRequestInstance = new HttpPost(URL);
String jsonString = jsonPostParameter != null ? jsonPostParameter.toString() : "";
InputStream responseStream = null;
try {
StringEntity requestEntity = new StringEntity(jsonString, ContentType.APPLICATION_JSON);
httpPostRequestInstance.setEntity(requestEntity);
httpPostRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
if (!CommonUtilities.isEmptyString(contentType)) {
httpPostRequestInstance.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
}
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpPostRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpPostRequestInstance.setHeader(currKey, currValue);
}
}
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpPostRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsString(responseStream);
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public String hitPOSTStreamServiceAndGetResponse(String URL, InputStream inputStream, String contentType,
String konyFabricAuthToken, HashMap<String, String> customHeaderParameters, String username) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpPost httpPostRequestInstance = new HttpPost(URL);
InputStream responseStream = null;
try {
InputStreamEntity entity = new InputStreamEntity(inputStream);
httpPostRequestInstance.setEntity(entity);
httpPostRequestInstance.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
httpPostRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
httpPostRequestInstance.setHeader("username", username);
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpPostRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpPostRequestInstance.setHeader(currKey, currValue);
}
}
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpPostRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsString(responseStream);
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public File hitPOSTServiceAndGetResponseForFile(String URL, JSONObject jsonPostParameter, String contentType,
String konyFabricAuthToken, HashMap<String, String> customHeaderParameters) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpPost httpPostRequestInstance = new HttpPost(URL);
String jsonString = jsonPostParameter != null ? jsonPostParameter.toString() : "";
InputStream responseStream = null;
try {
StringEntity requestEntity = new StringEntity(jsonString, ContentType.APPLICATION_JSON);
httpPostRequestInstance.setEntity(requestEntity);
httpPostRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
if (!CommonUtilities.isEmptyString(contentType)) {
httpPostRequestInstance.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
}
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpPostRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpPostRequestInstance.setHeader(currKey, currValue);
}
}
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpPostRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsFile(responseStream);
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public String hitGETServiceAndGetResponse(String URL, String konyFabricAuthToken,
HashMap<String, String> customHeaderParameters) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpGet httpGetRequestInstance = new HttpGet(URL);
InputStream responseStream = null;
try {
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpGetRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
httpGetRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpGetRequestInstance.setHeader(currKey, currValue);
}
}
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpGetRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsString(responseStream);
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public String getInputStreamAsString(InputStream sourceInputStream) {
ByteArrayOutputStream result = new ByteArrayOutputStream();
byte[] buffer = new byte[1024];
int length;
try {
while ((length = sourceInputStream.read(buffer)) != -1) {
result.write(buffer, 0, length);
}
return result.toString(StandardCharsets.UTF_8.name());
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
return "";
}
public File getInputStreamAsFile(InputStream sourceInputStream) {
if (sourceInputStream == null) {
return null;
}
File file = null;
FileOutputStream fileOutputStream = null;
try {
file = File.createTempFile("tempFile", ".tmp");
fileOutputStream = new FileOutputStream(file);
byte[] buffer = new byte[1024];
int length;
while ((length = sourceInputStream.read(buffer)) != -1) {
fileOutputStream.write(buffer, 0, length);
}
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (fileOutputStream != null) {
try {
fileOutputStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
try {
sourceInputStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
return file;
}
}
Path:
localservices /Fabric /java /SecureMessages /DBPAdminIntegration /src /main /java /com /kony /AdminConsole /Utilities /HTTPOperations.java
In the above path replace the following code:
package com.kony.AdminConsole.Utilities;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import org.apache.http.HttpEntity;
import org.apache.http.HttpHeaders;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.HttpClient;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.entity.ContentType;
import org.apache.http.entity.InputStreamEntity;
import org.apache.http.entity.StringEntity;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.message.BasicNameValuePair;
import com.temenos.logger.Logger;
import com.temenos.logger.alert.Alert;
import com.temenos.logger.diagnostics.Diagnostic;
import org.json.JSONObject;
public class HTTPOperations {
private static final Alert alert = Logger.forAlert().forModule("Infinity", "DIGITALBANKING");
private static final Diagnostic diagnostic = Logger.forDiagnostic().forModule("Infinity", "DIGITALBANKING");
public String hitPOSTServiceAndGetResponse(String URL, HashMap<String, String> postParameters, String contentType,
String konyFabricAuthToken, HashMap<String, String> customHeaderParameters) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpPost httpPostRequestInstance = new HttpPost(URL);
List<NameValuePair> postParametersNameValuePairList = new ArrayList<>();
if (postParameters != null) {
for (String currKey : postParameters.keySet()) {
String currValue = postParameters.get(currKey);
postParametersNameValuePairList.add(new BasicNameValuePair(currKey, currValue));
}
}
InputStream responseStream = null;
try {
httpPostRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
httpPostRequestInstance.setEntity(new UrlEncodedFormEntity(postParametersNameValuePairList, StandardCharsets.UTF_8.name()));
if (!CommonUtilities.isEmptyString(contentType)) {
httpPostRequestInstance.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
}
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpPostRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpPostRequestInstance.setHeader(currKey, currValue);
}
}
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpPostRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsString(responseStream);
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public String hitPOSTServiceAndGetResponse(String URL, JSONObject jsonPostParameter, String contentType,
String konyFabricAuthToken, HashMap<String, String> customHeaderParameters) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpPost httpPostRequestInstance = new HttpPost(URL);
String jsonString = (jsonPostParameter != null) ? jsonPostParameter.toString() : "";
StringEntity requestEntity = new StringEntity(jsonString, ContentType.APPLICATION_JSON);
InputStream responseStream = null;
try {
httpPostRequestInstance.setEntity(requestEntity);
httpPostRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
if (!CommonUtilities.isEmptyString(contentType)) {
httpPostRequestInstance.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
}
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpPostRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpPostRequestInstance.setHeader(currKey, currValue);
}
}
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpPostRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsString(responseStream);
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public String hitPOSTStreamServiceAndGetResponse(String URL, InputStream inputStream, String contentType,
String konyFabricAuthToken, HashMap<String, String> customHeaderParameters, String username) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpPost httpPostRequestInstance = new HttpPost(URL);
InputStream responseStream = null;
try {
InputStreamEntity entity = new InputStreamEntity(inputStream);
httpPostRequestInstance.setEntity(entity);
httpPostRequestInstance.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpPostRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpPostRequestInstance.setHeader(currKey, currValue);
}
}
httpPostRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
httpPostRequestInstance.setHeader("username", username);
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpPostRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsString(responseStream);
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public File hitPOSTServiceAndGetResponseForFile(String URL, JSONObject jsonPostParameter, String contentType,
String konyFabricAuthToken, HashMap<String, String> customHeaderParameters) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpPost httpPostRequestInstance = new HttpPost(URL);
String jsonString = (jsonPostParameter != null) ? jsonPostParameter.toString() : "";
StringEntity requestEntity = new StringEntity(jsonString, ContentType.APPLICATION_JSON);
InputStream responseStream = null;
try {
httpPostRequestInstance.setEntity(requestEntity);
if (!CommonUtilities.isEmptyString(contentType)) {
httpPostRequestInstance.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
}
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpPostRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpPostRequestInstance.setHeader(currKey, currValue);
}
}
httpPostRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpPostRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsFile(responseStream);
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public String hitGETServiceAndGetResponse(String URL, String konyFabricAuthToken,
HashMap<String, String> customHeaderParameters) {
HttpClient httpClientInstance = HttpClients.createDefault();
HttpGet httpGetRequestInstance = new HttpGet(URL);
InputStream responseStream = null;
try {
if (!CommonUtilities.isEmptyString(konyFabricAuthToken)) {
httpGetRequestInstance.setHeader("X-Kony-Authorization", konyFabricAuthToken);
httpGetRequestInstance.setHeader("X-Kony-AC-API-Access-By", "OLB");
}
// Execute and get the response.
HttpResponse httpResponseInstance = httpClientInstance.execute(httpGetRequestInstance);
HttpEntity httpResponseEntity = httpResponseInstance.getEntity();
if (httpResponseEntity != null) {
responseStream = httpResponseEntity.getContent();
return getInputStreamAsString(responseStream);
}
if (customHeaderParameters != null) {
for (String currKey : customHeaderParameters.keySet()) {
String currValue = customHeaderParameters.get(currKey);
httpGetRequestInstance.setHeader(currKey, currValue);
}
}
} catch (Exception e) {
alert.prepareError(e.getMessage()).log();
} finally {
if (responseStream != null) {
try {
responseStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
}
return null;
}
public String getInputStreamAsString(InputStream sourceInputStream) {
ByteArrayOutputStream result = new ByteArrayOutputStream();
byte[] buffer = new byte[1024];
int length;
try {
while ((length = sourceInputStream.read(buffer)) != -1) {
result.write(buffer, 0, length);
}
return result.toString(StandardCharsets.UTF_8.name());
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
} finally {
try {
sourceInputStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
return "";
}
public File getInputStreamAsFile(InputStream sourceInputStream) {
File file = null;
try {
file = File.createTempFile("a", "a");
} catch (IOException e1) {
alert.prepareError(e1.getMessage()).log();
}
try (FileOutputStream result = new FileOutputStream(file)) {
byte[] buffer = new byte[1024];
int length;
while ((length = sourceInputStream.read(buffer)) != -1) {
result.write(buffer, 0, length);
}
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
} finally {
try {
sourceInputStream.close();
} catch (IOException e) {
alert.prepareError(e.getMessage()).log();
}
}
return file;
}
}
Path:
retailbankingapis /Fabric /java /LoansPayoffAPI-Services /src /main /java /com /temenos /infinity /api /loanspayoff /eventlogs /EventLogUtils.java
- Import the package as following:
- import java.io.IOException
- Replace the LoadEventLogProperties file as following:
public JsonObject LoadEventLogProperties(FabricRequestManager fabricRequestManager) throws FileNotFoundException { JsonObject EventLogProperties = new JsonObject(); InputStream inputStream = null; BufferedReader bufferedReader = null; try { inputStream = EventLogUtils.class.getClassLoader().getResourceAsStream("LoanPayoffEventLog.json"); if (inputStream == null) { throw new FileNotFoundException("Resource not found: LoanPayoffEventLog.json"); } bufferedReader = new BufferedReader(new InputStreamReader(inputStream, "UTF-8")); EventLogProperties = new Gson().fromJson(bufferedReader, JsonObject.class); } catch (UnsupportedEncodingException e) { alert.prepareError("Unable to read file: " + e).log(); } finally { // Ensure the BufferedReader and InputStream are closed try { if (bufferedReader != null) { bufferedReader.close(); } if (inputStream != null) { inputStream.close(); } } catch (IOException e) { alert.prepareError("Error while closing resources: " + e).log(); } } return EventLogProperties; }
Path:
retailbankingapis /Fabric /java /jsonmerge-maven-plugin /src /main /java /com /temenos /infinity /JsonMergeMojo.java
Replace the following two lines in the function and execute.
[Instead of try use try with resources]
try (FileReader reader = new FileReader(a.getPath())) {
Meta obj = gson.fromJson(reader, Meta.class);
Refer to the following image:
In this topic