validate generated local service name in templates (#3007)

Signed-off-by: Henry Avetisyan <hga@yahooinc.com>

Author: havetisyan

servers/zms/src/main/java/com/yahoo/athenz/zms/DBService.java

@@ -5187,7 +5187,7 @@ boolean addSolutionTemplate(ResourceContext ctx, ObjectStoreConnection con, Stri
         auditDetails.append("{\"name\": \"").append(templateName).append('\"');
 
         // we have already verified that our template is valid, but
-        // we'll just double check to make sure it's not null
+        // we'll just double-check to make sure it's not null
 
         Template template = zmsConfig.getServerSolutionTemplates().get(templateName);
         if (template == null) {
@@ -5273,6 +5273,7 @@ boolean addSolutionTemplate(ResourceContext ctx, ObjectStoreConnection con, Stri
                 }
 
                 // add domain change event
+
                 addDomainChangeMessage(ctx, domainName, policyName, DomainChangeMessage.ObjectType.POLICY);
             }
         }
@@ -5291,6 +5292,14 @@ boolean addSolutionTemplate(ResourceContext ctx, ObjectStoreConnection con, Stri
                 String serviceIdentityName = ZMSUtils.removeDomainPrefixForService(
                         templateServiceIdentity.getName(), domainName);
 
+                // before processing, make sure to validate the generated service
+                // local name does not contain any dots. e.g. it might contain
+                // value like api.service and generated full service identity
+                // name: athenz.api.service will pass the validation check
+
+                ZMSUtils.validateObject(zmsConfig.getValidator(), serviceIdentityName,
+                        ZMSConsts.TYPE_SIMPLE_NAME, CALLER_TEMPLATE);
+
                 // retrieve our original service
 
                 ServiceIdentity originalServiceIdentity = getServiceIdentity(con, domainName,
@@ -5306,6 +5315,7 @@ boolean addSolutionTemplate(ResourceContext ctx, ObjectStoreConnection con, Stri
                 }
 
                 // add domain change event
+
                 addDomainChangeMessage(ctx, domainName, serviceIdentityName, DomainChangeMessage.ObjectType.SERVICE);
             }
         }

servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSConsts.java

@@ -320,6 +320,7 @@ public final class ZMSConsts {
     // Validator object types
     public static final String TYPE_DOMAIN_NAME      = "DomainName";
     public static final String TYPE_RESOURCE_NAME    = "ResourceName";
+    public static final String TYPE_SIMPLE_NAME      = "SimpleName";
     public static final String TYPE_ROLE             = "Role";
     public static final String TYPE_POLICY           = "Policy";
     public static final String TYPE_SERVICE_IDENTITY = "ServiceIdentity";

servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSImplTest.java

@@ -23392,7 +23392,7 @@ public void testGetServerTemplateDetailsList() {
         RsrcCtxWrapper ctx = zmsTestInitializer.getMockDomRsrcCtx();
 
         DomainTemplateDetailsList serverTemplateDetailsList = zmsImpl.getServerTemplateDetailsList(ctx);
-        assertEquals(serverTemplateDetailsList.getMetaData().size(), 14);
+        assertEquals(serverTemplateDetailsList.getMetaData().size(), 15);
         TemplateMetaData vipTemplateMetaData = null;
         for (TemplateMetaData templateMetaData : serverTemplateDetailsList.getMetaData()) {
             if (templateMetaData.getTemplateName().equals("vipng")) {

servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSTemplateTest.java

@@ -998,4 +998,48 @@ public void testPutDomainTemplateWithInvalidPolicyRuleRoleSubstitution() {
 
         zmsImpl.deleteTopLevelDomain(ctx, domainName, auditRef, null);
     }
+
+    @Test
+    public void testPutDomainTemplateWithInvalidServiceName() {
+
+        ZMSImpl zmsImpl = zmsTestInitializer.getZms();
+        RsrcCtxWrapper ctx = zmsTestInitializer.getMockDomRsrcCtx();
+        final String auditRef = zmsTestInitializer.getAuditRef();
+        String domainName = "template-invalid-service-name";
+        TopLevelDomain dom1 = zmsTestInitializer.createTopLevelDomainObject(domainName,
+                "Test Domain1", "testOrg", zmsTestInitializer.getAdminUser());
+        zmsImpl.postTopLevelDomain(ctx, auditRef, null, dom1);
+
+        final String templateName = "template_service_test";
+        DomainTemplate templateList = new DomainTemplate();
+        List<String> templateNames = new ArrayList<>();
+        templateNames.add(templateName);
+        templateList.setTemplateNames(templateNames);
+
+        // the keywords to be specified for the rule substitution
+        // "keywordsToReplace": "_service_"
+
+        // we're going to create an invalid service name
+
+        List<TemplateParam> params = new ArrayList<>();
+        params.add(new TemplateParam().setName("service").setValue("api.service"));
+        templateList.setParams(params);
+
+        try {
+            zmsImpl.putDomainTemplateExt(ctx, domainName, templateName, auditRef, templateList);
+            fail();
+        } catch (ResourceException ex) {
+            assertEquals(ex.getCode(), 400);
+            assertTrue(ex.getMessage().contains("Invalid SimpleName error: String pattern mismatch"));
+        }
+
+        // verify simple service name is successful
+
+        params = new ArrayList<>();
+        params.add(new TemplateParam().setName("service").setValue("api"));
+        templateList.setParams(params);
+
+        zmsImpl.putDomainTemplateExt(ctx, domainName, templateName, auditRef, templateList);
+        zmsImpl.deleteTopLevelDomain(ctx, domainName, auditRef, null);
+    }
 }

servers/zms/src/test/resources/solution_templates.json

@@ -637,6 +637,26 @@
                     "userAuthorityExpiration": "newValue"
                 }
             ]
+        },
+        "template_service_test": {
+            "metadata":
+            {
+                "latestVersion": 1,
+                "timestamp": "2024-02-15T00:00:00.000Z",
+                "description": "TemplateServiceTest",
+                "keywordsToReplace": "_service_",
+                "autoUpdate": false
+            },
+            "services": [
+                {
+                    "name": "_domain_._service_",
+                    "description": "Service for Testing"
+                }
+            ],
+            "roles": [
+            ],
+            "policies": [
+            ]
         }
     }
 }