PatchWork AutoFix

[CTY-git]

This pull request from patched fixes 8 issues.

---

• File changed: WebContent/swagger/lib/marked.js
  Fix: Use hardcoded regexes to avoid ReDoS

  - Updated the replace function to take a hardcoded regex instead of dynamic one.
  Fix: Hardcode regex to prevent potential ReDoS

  This commit hardcodes the regex to prevent a potential ReDoS attack.

• File changed: WebContent/high_yield_investments.htm
  Fix vulnerability by replacing plaintext HTTP URL with HTTPS URL

  The plaintext HTTP URL in the anchor link has been replaced with an encrypted HTTPS URL.

• File changed: WebContent/static/security.htm
  Change HTTP to HTTPS Link

  Changed the http:// url to a secure https:// url

• File changed: WebContent/static/inside_about.htm
  Fix: Prefer encrypted HTTPS URL over plaintext HTTP URL

  Replaces the plaintext HTTP URL in the href attribute of the Analyst Reviews link with an encrypted HTTPS URL.

• File changed: WebContent/static/inside_community.htm
  Fix: Change url to https and remove alt text from the image.

  - Changed the URL from plaintext HTTP to encrypted HTTPS.

  • Removed alt text from the image.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
  Fix Missing parameter validation when a user attempts to change their password

  Added a null check for all parameters passed into the changePassword method in the AdminServlet class.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
  Fixed cookie security attributes

  - Set the 'HttpOnly' flag on the cookie to prevent client-side scripts from reading the cookie.

  • Set the 'secure' flag on the cookie to prevent the client from transmitting the cookie over insecure channels such as HTTP.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud