PatchWork AutoFix

[CTY-git]

This pull request from patched fixes 23 issues.

---

• File changed: WebContent/swagger/lib/marked.js
  Fixed ReDoS vulnerability in regular expression construction.

  Hardcoded the regex pattern and options to prevent ReDoS attacks.
  Fix for potential ReDoS vulnerability in RegExp.

  The item.replace method was using a dynamically generated regex pattern, which could lead to a ReDoS vulnerability. The regex pattern is now hardcoded to prevent this vulnerability.

• File changed: src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
  Fixed SQL injection vulnerability in storeFeedback method by using PreparedStatement.

  The method was using a Statement object with concatenated SQL string, which is vulnerable to SQL injection attacks. It has been replaced with a PreparedStatement to parameterize the SQL query, preventing SQL injection attacks.
  Fixed SQL injection vulnerability in changePassword method

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability
  Fixed SQL injection vulnerability in addUser method

  Replaced direct string concatenation in SQL statement with prepared statement to prevent SQL injection attacks.
  Fix SQL injection vulnerability by using prepared statement.

  The SQL query was revised to utilize a prepared statement with parameterized input, thereby preventing SQL injection attacks.
  Fixed SQL injection vulnerability in addAccount method by using PreparedStatement.

  Replaced Statement with PreparedStatement to prevent SQL injection by properly sanitizing input variables.
  Sanitize SQL query by using prepared statement.

  Replaced Statement with PreparedStatement to prevent SQL injection.
  Fixed SQL injection vulnerability by using prepared statements.

  The method getTransactions was modified to use PreparedStatement instead of Statement to prevent SQL injection attacks. The parameters are now set using set methods, and the query string uses placeholders (?) instead of concatenating user input.
  Fixed SQL injection vulnerability in transferFunds method by using PreparedStatement instead of Statement.

  Modified the transferFunds method to use PreparedStatement to prevent SQL injection vulnerability.
  Fixed SQL injection vulnerability in getAccounts method.

  Replaced concatenated SQL query with a prepared statement to prevent SQL injection.
  Fixed SQL injection vulnerability in getUserInfo method by using PreparedStatement.

  Replaced Statement with PreparedStatement to prevent SQL injection by properly sanitizing the username input.
  Fixed SQL injection vulnerability in isValidUser method

  Replaced Statement with PreparedStatement to prevent SQL injection.

• File changed: src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
  Secure cookie transmission by setting the secure flag.

  Set the secure flag of the cookie to true to ensure it is transmitted over HTTPS only.

• File changed: WebContent/high_yield_investments.htm
  Fixed vulnerable link to use HTTPS

  Changed HTTP link to HTTPS for secure communication

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java
  Fixed XSS vulnerability in response writer.

  HTML-escaped the content before writing to the response writer to prevent XSS vulnerabilities.
  Validate and sanitize user input before setting session attribute

  Sanitized user input using OWASP Java Encoder to prevent trust boundary violations

• File changed: WebContent/static/security.htm
  Changed http to https in URL to prefer encrypted connection.

  The HTTP URL in the anchor tag has been replaced with an HTTPS URL to ensure a secure connection.

• File changed: src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
  Fixed use of non-cryptographically secure random number generator.

  The makeRandomString() method was using java.util.Random for generating a random string, which is not suitable for cryptographic purposes. This has been replaced with java.security.SecureRandom to ensure the generated random string is cryptographically secure.

• File changed: WebContent/static/inside_about.htm
  Replace plaintext HTTP URL with HTTPS URL to ensure secure communication.

  The HTTP URL in the anchor tag has been replaced with an HTTPS URL to ensure encrypted communication.

• File changed: WebContent/static/inside_community.htm
  Updated URLs to use HTTPS instead of HTTP for security and encryption.

  The code has been updated to use HTTPS URLs instead of HTTP to ensure data encryption and security.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
  Sanitize user input before setting session attribute

  The user input is sanitized before being set as a session attribute to prevent trust boundary violations.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
  Fixed cookie vulnerability by setting 'HttpOnly' and 'secure' flags.

  The 'HttpOnly' and 'secure' flags were not being set for the accountCookie, which is a vulnerability. This fix sets these flags to prevent client-side scripts from reading the cookie and to ensure the cookie is only transmitted over secure channels.