PatchWork AutoFix

[CTY-git]

This pull request from patched fixes 22 issues.

---

• File changed: WebContent/swagger/lib/marked.js
  Fix potential ReDoS vulnerability by hardcoding regex patterns.

  Replaced the dynamic RegExp calls with hardcoded regex patterns to mitigate the potential Regular Expression Denial-of-Service (ReDoS) vulnerability.
  Replace dynamic RegExp with hardcoded regex to prevent ReDoS vulnerability

  Replaced the dynamically generated regex with a hardcoded regex that removes leading spaces up to a certain limit, thereby preventing potential Regular Expression Denial-of-Service (ReDoS) attacks.

• File changed: src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
  Fix SQL Injection vulnerability by using PreparedStatement for storing feedback

  Replaced the use of Statement with PreparedStatement to prevent SQL injection by binding variables securely.
  Fix potential SQL injection vulnerability in changePassword method by using PreparedStatement

  Replaced the Statement with PreparedStatement to prevent SQL injection by properly parameterizing the SQL query.
  Secure user registration by using PreparedStatement to prevent SQL injection

  Replaced the vulnerable Statement object with PreparedStatement to prevent SQL injection by properly sanitizing input variables.
  Use PreparedStatement to prevent SQL injection in addSpecialUser method

  Replaced the vulnerable Statement with a PreparedStatement to safely insert user data into the SPECIAL_CUSTOMERS table, preventing SQL injection attacks.
  Fix SQL injection vulnerability by using prepared statements

  Replaced the vulnerable string concatenation in the SQL statement with a prepared statement to prevent SQL injection.
  Use PreparedStatement to prevent SQL injection.

  Replaced the Statement with a PreparedStatement to securely handle user input and prevent SQL injection.
  Fix SQL injection vulnerability by using PreparedStatement.

  Replaced the creation and execution of an SQL Statement with a PreparedStatement to prevent SQL injection vulnerabilities. The PreparedStatement prevents the possibility of SQL injection by safely binding the variables into the query.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection for both transaction insertion and account balance update operations.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced vulnerable Statement with PreparedStatement to prevent SQL injection by safely handling user input.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to safely handle user input and prevent SQL injection attacks.
  Switch to prepared statements to prevent SQL injection vulnerability

  Replaced the statement with a prepared statement to prevent SQL injection by properly sanitizing user inputs.

• File changed: src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
  Set secure attribute for session cookie to true

  The setSecure attribute of the session cookie is enabled to ensure that the cookie is sent only over HTTPS, preventing cross-site scripting attacks.

• File changed: WebContent/high_yield_investments.htm
  Changed HTTP URL to HTTPS to ensure secure connection.

  Updated plain HTTP URL to HTTPS for secure communication.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java
  Escape HTML content before writing to response to prevent XSS.

  Added a step to escape HTML content using a utility method before writing it to the response Writer object to prevent XSS vulnerabilities.
  Sanitize user input before setting session attribute

  Sanitize the step parameter to ensure it does not contain malicious content before setting it as a session attribute.

• File changed: src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
  Replace java.util.Random with java.security.SecureRandom for stronger RNG

  Replaced the usage of java.util.Random with java.security.SecureRandom in the makeRandomString method to ensure cryptographic strength of the random number generation.

• File changed: WebContent/static/inside_about.htm
  Update Analyst Reviews link to use HTTPS

  Changed the URL for the "Analyst Reviews" link from an insecure HTTP connection to a secure HTTPS connection.

• File changed: WebContent/static/inside_community.htm
  Updated plaintext HTTP URLs to HTTPS for increased security.

  Replaced plaintext HTTP URLs with HTTPS URLs to ensure encrypted and secure connections when accessing external resources.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
  Sanitized user inputs before setting session attributes

  Sanitized user inputs to prevent trust boundary violations before setting them as session attributes.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
  Set HttpOnly and Secure flags for cookies

  Added the 'HttpOnly' and 'Secure' flags to the 'accountCookie' to improve security by preventing client-side scripts from accessing the cookies and ensuring cookies are only sent over secure channels.