HP Fortify false positives and fixes

mawhitby · mawhitby · commit 64e06298abe2 · 2017-11-15T11:58:13.000-05:00
diff --git a/core/ingest/src/main/java/mil/nga/giat/geowave/core/ingest/local/AbstractLocalFileDriver.java b/core/ingest/src/main/java/mil/nga/giat/geowave/core/ingest/local/AbstractLocalFileDriver.java
@@ -108,6 +108,9 @@ private static void setURLStreamHandlerFactory()
 			IllegalAccessException {
 
 		Field factoryField = URL.class.getDeclaredField("factory");
+		// HP Fortify "Access Control" false positive
+		// The need to change the accessibility here is
+		// necessary, has been review and judged to be safe
 		factoryField.setAccessible(true);
 
 		URLStreamHandlerFactory urlStreamHandlerFactory = (URLStreamHandlerFactory) factoryField.get(null);
@@ -118,6 +121,9 @@ private static void setURLStreamHandlerFactory()
 		}
 		else {
 			Field lockField = URL.class.getDeclaredField("streamHandlerLock");
+			// HP Fortify "Access Control" false positive
+			// The need to change the accessibility here is
+			// necessary, has been review and judged to be safe
 			lockField.setAccessible(true);
 			synchronized (lockField.get(null)) {
 
@@ -150,6 +156,11 @@ protected void processInput(
 					configFile,
 					null);
 		}
+		
+		if (configProperties == null) {
+			LOGGER.error("Unable to load properties form " + configFile.getAbsolutePath());
+			return;
+		}
 
 		// If input path is S3
 		if (inputPath.startsWith("s3://")) {
@@ -175,6 +186,9 @@ protected void processInput(
 					s3EndpointUrl = "s3://" + s3EndpointUrl;
 				}
 				FileSystem fs = FileSystems.newFileSystem(
+						// HP Fortify "Path Traversal" false positive
+						// What Fortify considers "user input" comes only
+						// from users with OS-level access anyway
 						new URI(
 								s3EndpointUrl + "/"),
 						new HashMap<String, Object>(),
@@ -215,6 +229,9 @@ else if (inputPath.startsWith("hdfs://")) {
 
 				URI uri = new URI(
 						hdfsFSUrl + hdfsInputPath);
+				// HP Fortify "Path Traversal" false positive
+				// What Fortify considers "user input" comes only
+				// from users with OS-level access anyway
 				path = Paths.get(uri);
 				if (!Files.exists(path)) {
 					LOGGER.error("Input path " + inputPath + " does not exist");
diff --git a/core/ingest/src/main/java/mil/nga/giat/geowave/core/ingest/s3/S3URLConnection.java b/core/ingest/src/main/java/mil/nga/giat/geowave/core/ingest/s3/S3URLConnection.java
@@ -62,13 +62,13 @@ private ClientConfiguration buildClientConfig() {
 				null);
 		final String protocol = System.getProperty(
 				PROP_S3_HANDLER_PROTOCOL,
-				"https").toLowerCase();
+				"https");
 		final String signerOverride = System.getProperty(
 				PROP_S3_HANDLER_SIGNER_OVERRIDE,
 				null);
 
 		final ClientConfiguration clientConfig = new ClientConfiguration()
-				.withProtocol("https".equals(protocol) ? Protocol.HTTPS : Protocol.HTTP);
+				.withProtocol("https".equalsIgnoreCase(protocol) ? Protocol.HTTPS : Protocol.HTTP);
 
 		if (userAgent != null) {
 			clientConfig.setUserAgent(userAgent);
