PatchWork AutoFix

[CTY-git]

This pull request from patched fixes 23 issues.

---

• File changed: WebContent/swagger/lib/marked.js
  Prevent potential ReDoS vulnerability in replace function

  The replace function is vulnerable to ReDoS attacks because it constructs a regular expression from user-supplied input without proper sanitization. This change replaces the dynamically constructed regex with a hardcoded regex, mitigating the risk of ReDoS attacks.
  Fix: Prevent potential ReDoS vulnerability in item.replace

  The code was vulnerable to a Regular Expression Denial-of-Service (ReDoS) attack due to using a dynamic RegExp object. This commit fixes the vulnerability by replacing the dynamic regex with a hardcoded one.

• File changed: src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
  Fix SQL injection vulnerability in storeFeedback method

  The code has been modified to use prepared statements instead of string concatenation for constructing the SQL query. This prevents potential SQL injection vulnerabilities by ensuring that user input is properly sanitized and not interpreted as SQL commands.
  Fix SQL injection vulnerability in changePassword method

  The changePassword method was vulnerable to SQL injection because it used string concatenation to build the SQL query. This has been fixed by using a PreparedStatement instead.
  Fix SQL injection vulnerability in addUser method

  The addUser method was vulnerable to SQL injection because it directly concatenated user input into the SQL query. This commit replaces the vulnerable code with a PreparedStatement to prevent SQL injection.
  Fix SQL Injection vulnerability in addSpecialUser()

  The original code was vulnerable to SQL injection because it used string concatenation to build the SQL query. This allowed attackers to inject malicious code into the database. This commit fixes the vulnerability by using a PreparedStatement instead.
  Fix SQL injection vulnerability in addAccount()

  The addAccount() method was vulnerable to SQL injection because it used a formatted string to construct the SQL query. This change uses a PreparedStatement to prevent SQL injection.
  Fix SQL injection vulnerability in getAccount()

  The getAccount() method was vulnerable to SQL injection because it directly concatenated user input into the SQL query. This commit fixes the vulnerability by using a PreparedStatement instead of a Statement.
  Fix SQL injection vulnerability in getTransactions()

  The code was vulnerable to SQL injection because it used string formatting to construct SQL queries. This commit fixes the vulnerability by using prepared statements.
  Fix SQL injection vulnerability in transferFunds

  Replaced vulnerable string concatenation in SQL queries with prepared statements to prevent SQL injection.
  Fix SQL injection vulnerability in getAccounts()

  The vulnerable code used string formatting to construct the SQL query, leading to potential SQL injection vulnerabilities. This commit replaces the vulnerable code with a PreparedStatement, which prevents SQL injection by properly sanitizing user input.
  Fix SQL injection vulnerability in getUserInfo

  The code was vulnerable to SQL injection because it used string concatenation to build the SQL query. This has been fixed by using a prepared statement instead.
  Fix SQL injection vulnerability in isValidUser method

  The isValidUser method was vulnerable to SQL injection because it used string concatenation to construct the SQL query. This has been fixed by using a prepared statement instead.

• File changed: src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
  Set cookie secure flag to prevent XSS

  The accountCookie object is now set to be secure, which ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks.

• File changed: WebContent/high_yield_investments.htm
  Upgrade HTTP URL to HTTPS

  The code contained a plaintext HTTP URL. This commit upgrades the URL to HTTPS to improve security.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java
  Fix XSS vulnerability in response writer

  The code was vulnerable to XSS because it was writing user input directly to the response writer without any escaping. This commit fixes the vulnerability by escaping the user input before writing it to the response writer.
  Sanitize user input before setting session attribute

  The code now sanitizes the user input before setting the session attribute. This prevents attackers from injecting malicious code into the session.

• File changed: WebContent/static/security.htm
  Upgrade insecure HTTP link to HTTPS

  Replaced the insecure HTTP link with a secure HTTPS link.

• File changed: src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
  Fix: Use SecureRandom for generating random strings

  The code was using java.util.Random to generate random strings, which is not cryptographically secure. This commit replaces java.util.Random with java.security.SecureRandom to ensure that the generated strings are truly random and secure.

• File changed: WebContent/static/inside_about.htm
  Fix potential open redirect vulnerability in the link to Analyst Reviews

  The link to Analyst Reviews was pointing to an external URL without any validation. This could lead to an open redirect vulnerability if the URL was controlled by an attacker. This commit adds validation to the link ensuring that it points to a valid Altoro Mutual URL.

• File changed: WebContent/static/inside_community.htm
  Fix insecure HTTP URL

  Replaced insecure HTTP URL with HTTPS URL.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
  Sanitize user input before setting session attribute

  The code was vulnerable to a trust boundary violation, where user input could be directly set as a session attribute without proper sanitization. This commit sanitizes the user input before setting it as a session attribute, mitigating the risk of malicious code injection.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
  Fix: Secure cookies

  Added HttpOnly and Secure flags to cookies.