fixes: wso2/api-manager#2663

Author: BLasan

components/apimgt/org.wso2.carbon.apimgt.impl/src/main/java/org/wso2/carbon/apimgt/impl/APIConstants.java

@@ -3104,6 +3104,7 @@ public enum ConfigType {
     public static final String SYNAPSE_POLICY_DEFINITION_EXTENSION_XML = ".xml";
     public static final String CC_POLICY_DEFINITION_EXTENSION = ".gotmpl";
     public static final String YAML_CONTENT_TYPE = "yaml";
+    public static final String J2_CONTENT_TYPE = "j2";
     public static final String COMMON_OPERATION_POLICY_SPECIFICATIONS_LOCATION = "repository" + File.separator
             + "resources" + File.separator + "operation_policies" + File.separator + "specifications";
     public static final String COMMON_OPERATION_POLICY_DEFINITIONS_LOCATION = "repository" + File.separator

components/apimgt/org.wso2.carbon.apimgt.rest.api.publisher.v1/src/main/java/org/wso2/carbon/apimgt/rest/api/publisher/v1/impl/OperationPoliciesApiServiceImpl.java

@@ -98,6 +98,7 @@ public Response addCommonOperationPolicy(InputStream policySpecFileInputStream,
                 if (org.apache.commons.lang3.StringUtils.isBlank(fileContentType)) {
                     fileContentType = policySpecFileDetail.getContentType().toString();
                 }
+
                 if (APIConstants.YAML_CONTENT_TYPE.equals(fileContentType)) {
                     jsonContent = CommonUtil.yamlToJson(jsonContent);
                 }
@@ -107,6 +108,14 @@ public Response addCommonOperationPolicy(InputStream policySpecFileInputStream,
                         .prepareOperationPolicyData(policySpecification, organization);
 
                 if (synapsePolicyDefinitionFileInputStream != null) {
+                    String defFileName = synapsePolicyDefinitionFileDetail.getDataHandler().getName();
+                    String defFileContentType = FilenameUtils.getExtension(defFileName);
+                    if (org.apache.commons.lang3.StringUtils.isBlank(defFileContentType)) {
+                        defFileContentType = synapsePolicyDefinitionFileDetail.getContentType().toString();
+                    }
+                    if (!APIConstants.J2_CONTENT_TYPE.equals(defFileContentType)) {
+                        throw new APIManagementException("Unsupported file type for Operation Policy");
+                    }
                     String synapsePolicyDefinition =
                             RestApiPublisherUtils.readInputStream(synapsePolicyDefinitionFileInputStream,
                                     synapsePolicyDefinitionFileDetail);
@@ -117,6 +126,14 @@ public Response addCommonOperationPolicy(InputStream policySpecFileInputStream,
                 }
 
                 if (ccPolicyDefinitionFileInputStream != null) {
+                    String defFileName = ccPolicyDefinitionFileDetail.getDataHandler().getName();
+                    String defFileContentType = FilenameUtils.getExtension(defFileName);
+                    if (org.apache.commons.lang3.StringUtils.isBlank(defFileContentType)) {
+                        defFileContentType = ccPolicyDefinitionFileDetail.getContentType().toString();
+                    }
+                    if (!APIConstants.CC_POLICY_DEFINITION_EXTENSION.equals(defFileContentType)) {
+                        throw new APIManagementException("Unsupported file type for Operation Policy");
+                    }
                     String choreoConnectPolicyDefinition = RestApiPublisherUtils
                             .readInputStream(ccPolicyDefinitionFileInputStream, ccPolicyDefinitionFileDetail);
                     ccPolicyDefinition = new OperationPolicyDefinition();