User message handling

src/main/java/org/jlab/dtm/business/session/EventFacade.java

@@ -23,6 +23,7 @@
 import javax.persistence.criteria.Root;
 import javax.persistence.criteria.Subquery;
 import org.jlab.dtm.business.params.AllEventsParams;
+import org.jlab.dtm.business.util.UserSuperFriendlyException;
 import org.jlab.dtm.persistence.entity.Event;
 import org.jlab.dtm.persistence.entity.EventType;
 import org.jlab.dtm.persistence.entity.Incident;
@@ -33,7 +34,6 @@
 import org.jlab.dtm.persistence.enumeration.IncidentEditType;
 import org.jlab.dtm.persistence.model.Period;
 import org.jlab.smoothness.business.exception.InternalException;
-import org.jlab.smoothness.business.exception.UserFriendlyException;
 import org.jlab.smoothness.business.exception.WebApplicationException;
 import org.jlab.smoothness.business.util.IOUtil;
 import org.jlab.smoothness.persistence.util.JPAUtil;
@@ -205,7 +205,7 @@ public void editEvent(BigInteger eventId, Date timeUp, String title, BigInteger
       Event openEvent = findOpenEvent(event.getEventType().getEventTypeId());
 
       if (openEvent != null && !event.equals(openEvent)) {
-        throw new UserFriendlyException(
+        throw new UserSuperFriendlyException(
             "An event of type " + event.getEventType().getName() + " is already open");
       }
 
@@ -271,11 +271,11 @@ public void validateEventTimeUp(Event event, Date timeUp) throws WebApplicationE
 
     // Don't allow timeUp more than 30 seconds into the future
     if (timeUp != null && timeUp.after(new Date(new Date().getTime() + 30000))) {
-      throw new UserFriendlyException("Event time up cannot be in the future");
+      throw new UserSuperFriendlyException("Event time up cannot be in the future");
     }
 
     if (latestIncidentTimeUp != null && timeUp.before(latestIncidentTimeUp)) {
-      throw new UserFriendlyException(
+      throw new UserSuperFriendlyException(
           "Event time up ("
               + formatter.format(timeUp)
               + ") must not be before latest incident time up ("
@@ -286,7 +286,8 @@ public void validateEventTimeUp(Event event, Date timeUp) throws WebApplicationE
     Date latestIncidentTimeDown = computeLatestIncidentTimeDown(event.getIncidentList());
 
     if (latestIncidentTimeDown != null && timeUp.before(latestIncidentTimeDown)) {
-      throw new UserFriendlyException("Event time up must not be before latest incident time down");
+      throw new UserSuperFriendlyException(
+          "Event time up must not be before latest incident time down");
     }
   }
 

src/main/java/org/jlab/dtm/business/util/UserSuperFriendlyException.java

@@ -0,0 +1,20 @@
+package org.jlab.dtm.business.util;
+
+import org.jlab.smoothness.business.exception.UserFriendlyException;
+
+/**
+ * This class is a workaround for CodeQL whining about any use of getMessage() being dangerous, even
+ * if the intent is to relay a message directly to the user.
+ */
+public class UserSuperFriendlyException extends UserFriendlyException {
+  private final String userMessage;
+
+  public UserSuperFriendlyException(String msg) {
+    super(msg);
+    this.userMessage = msg;
+  }
+
+  public String getUserMessage() {
+    return userMessage;
+  }
+}

src/main/java/org/jlab/dtm/presentation/controller/ajax/EditEvent.java

@@ -15,9 +15,9 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.jlab.dtm.business.session.EventFacade;
+import org.jlab.dtm.business.util.UserSuperFriendlyException;
 import org.jlab.dtm.persistence.util.DtmSqlUtil;
 import org.jlab.dtm.presentation.util.DtmParamConverter;
-import org.jlab.smoothness.business.exception.UserFriendlyException;
 import org.jlab.smoothness.presentation.util.ParamConverter;
 
 /**
@@ -54,10 +54,10 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
       eventFacade.editEvent(eventId, timeUp, title, eventTypeId);
     } catch (EJBAccessException e) {
       logger.log(Level.WARNING, "Unable to edit event time up due to access exception");
-      errorReason = e.getMessage();
-    } catch (UserFriendlyException e) {
+      errorReason = "Not Authorized";
+    } catch (UserSuperFriendlyException e) {
       logger.log(Level.FINE, "Unable to edit event time up: {1}", e.getMessage());
-      errorReason = e.getMessage();
+      errorReason = e.getUserMessage();
     } catch (Exception e) {
       logger.log(Level.SEVERE, "Unable to perform event action", e);
       Throwable rootCause = DtmSqlUtil.getFirstNestedSqlException(e);

src/main/java/org/jlab/dtm/presentation/controller/ajax/IncidentAction.java

@@ -15,11 +15,11 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.jlab.dtm.business.session.IncidentFacade;
+import org.jlab.dtm.business.util.UserSuperFriendlyException;
 import org.jlab.dtm.persistence.entity.Event;
 import org.jlab.dtm.persistence.entity.Incident;
 import org.jlab.dtm.persistence.util.DtmSqlUtil;
 import org.jlab.dtm.presentation.util.DtmParamConverter;
-import org.jlab.smoothness.business.exception.UserFriendlyException;
 import org.jlab.smoothness.presentation.util.ParamConverter;
 
 /**
@@ -124,19 +124,19 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
     } catch (EJBAccessException e) {
       LOGGER.log(
           Level.WARNING, "Unable to perform incident action ({0}) due to access exception", action);
-      errorReason = e.getMessage();
+      errorReason = "Not Authorized";
     } catch (NumberFormatException e) {
       LOGGER.log(
           Level.FINE,
           "Unable to perform incident action ({0}): {1}",
           new Object[] {action, e.getMessage()});
-      errorReason = "Number Format Unacceptable: " + e.getMessage();
-    } catch (UserFriendlyException e) {
+      errorReason = "Number Format Unacceptable";
+    } catch (UserSuperFriendlyException e) {
       LOGGER.log(
           Level.FINE,
           "Unable to perform incident action ({0}): {1}",
           new Object[] {action, e.getMessage()});
-      errorReason = e.getMessage();
+      errorReason = e.getUserMessage();
     } catch (Exception e) {
       Throwable rootCause = DtmSqlUtil.getFirstNestedSqlException(e);