PatchWork AutoFix

[CTY-git]

This pull request from patched fixes 18 issues.

---

• File changed: WebContent/swagger/lib/marked.js
  Fixed ReDoS vulnerability by removing dynamic RegEx construction

  Replaced dynamic RegEx construction with hardcoded RegEx patterns to prevent ReDoS attacks
  Fixed ReDoS vulnerability in item string manipulation

  Replaced the Regular Expression in item.replace() with a safer alternative to prevent potential Denial-of-Service (ReDoS)

• File changed: src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
  Fixed SQL injection vulnerability in the storeFeedback method

  Replaced the SQL statement with a prepared statement to prevent SQL injection
  Fixed SQL injection vulnerability by using prepared statements

  Replaced the formatted string in the SQL statement with a prepared statement to prevent SQL injection
  Fixed SQL injection vulnerability in addUser method

  Replaced formatted string in SQL statement with Prepared Statement to prevent SQL injection
  (src/com/ibm/security/appscan/altoromutual/util/DBUtil.java:478:488)[https://github.com/PatchWork AutoFix #15/files#diff-762055fc26b181976c5a317e9d704e92bfc4021dec396423d64f13b520ab7013L478-L488]

  Fixed SQL injection vulnerability by using a prepared statement instead of directly concatenating user input into the SQL query.
  Fixed SQL injection vulnerability by using a prepared statement

  Replaced the user input directly in the SQL query with a prepared statement to prevent SQL injection
  Fixed SQL injection vulnerability in getTransactions method

  Replaced formatted string in SQL query with a parameterized query using PreparedStatement to prevent SQL injection.
  Fixed SQL injection vulnerability in transferFunds method

  Replaced the vulnerable SQL statement with a prepared statement to prevent SQL injection.
  Fixed SQL injection vulnerability by using prepared statements.

  Replaced the vulnerable SQL query with a prepared statement to fix the SQL injection vulnerability.
  Fix SQL injection vulnerability

  Updated the getUserInfo method to use a PreparedStatement to prevent SQL injection.
  Fix SQL Injection vulnerability in isValidUser method

  Replace vulnerable SQL query with a prepared statement to prevent SQL injection attacks

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java
  Fixed potential XSS vulnerability by using output encoding

  Replaced raw data output with output encoded using UTF-8

• File changed: src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
  Fixed insecure random number generation using SecureRandom

  Replaced usage of Math.random() with SecureRandom to generate random numbers, ensuring cryptographic strength.

• File changed: WebContent/static/inside_about.htm

• File changed: WebContent/static/inside_community.htm
  Fixed URL redirection vulnerability by fixing href URL format

  Fixed the URL redirection vulnerability by replacing relative URLs with full URLs

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
  Fix: Validate input before setting session attribute to prevent potential malicious code execution.

  This commit fixes a vulnerability where unvalidated user input could be executed as JavaScript code within a session command. The fix sanitizes the input to prevent code execution.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
  Fixed cookie vulnerabilities in LoginServlet

  Set the 'HttpOnly' flag for cookies in doPost method to prevent client-side scripts from reading the cookies and set the 'secure' flag to prevent transmission over insecure channels.