PatchWork AutoFix

[CTY-git]

This pull request from patched fixes 21 issues.

---

• File changed: WebContent/swagger/lib/marked.js
  Fix RegExp vulnerability in replace function

  Replaced the dynamic regex creation with hardcoded regex to prevent Regular Expression Denial-of-Service (ReDoS) vulnerability in the replace function.
  Fix ReDoS vulnerability in RegExp usage

  Replaced RegExp constructor with hardcoded regex to prevent ReDoS vulnerability

• File changed: src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerabilities by using parameterized queries.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized queries.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized query.
  Fix SQL injection vulnerability using prepared statement

  Replaced the Statement with a PreparedStatement to prevent SQL injection by using parameters and setting them with setString methods.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection by using parameterized query.
  Fixed SQL injection vulnerability by using PreparedStatement

  Replaced the concatenated SQL query string with PreparedStatement to prevent SQL injection vulnerability.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized queries.
  Fix SQL injection vulnerability by using Prepared Statement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized queries.
  Fix SQL injection vulnerability by using Prepared Statement

  Replaced Statement with PreparedStatement to fix SQL injection vulnerability by using parameterized queries.
  Fix SQL injection vulnerability by using PreparedStatement

  Changed the SQL statement to use PreparedStatement to prevent SQL injection vulnerability.

• File changed: WebContent/high_yield_investments.htm
  Fix insecure plaintext HTTP URL

  Replaced insecure HTTP URL with secure HTTPS URL

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java
  Fix potential trust boundary violation by sanitizing user input before setting it in the session

  Sanitized user input before setting it in the session to prevent potential trust boundary violation.

• File changed: WebContent/static/security.htm
  Fix vulnerability by updating plaintext HTTP link to HTTPS

  Updated the HTTP link to HTTPS to prevent potential security risks.

• File changed: src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
  Fix vulnerability by replacing java.util.Random() with java.security.SecureRandom

  Replaced the usage of java.util.Random() with java.security.SecureRandom to generate cryptographically strong random strings in the makeRandomString() method.

• File changed: WebContent/static/inside_about.htm
  Fix vulnerability by updating insecure HTTP link to HTTPS

  Changed the HTTP link 'http://www.newspapersyndications.tv' to a secure HTTPS link.

• File changed: WebContent/static/inside_community.htm
  Fix vulnerability by changing HTTP URL to HTTPS

  Changed the HTTP URL to HTTPS for the Adobe Reader download link to fix a potential security vulnerability.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
  Fix vulnerability by sanitizing user input in AdminServlet

  Sanitized user input before passing it into setAttribute method to prevent potential malicious code injection.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
  Fix cookie vulnerabilities

  Added 'HttpOnly' flag and 'secure' flag to the cookies.