PatchWork AutoFix

[CTY-git]

This pull request from patched fixes 20 issues.

---

• File changed: src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized queries.
  Fix SQL injection vulnerability by using PreparedStatement

  Used PreparedStatement to fix SQL injection vulnerability by replacing Statement with PreparedStatement in the SQL update query.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized queries.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized queries.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized query.
  Remove debug code from getBankUsernames method

  Removed e.printStackTrace() which prints the stack trace to the standard error stream, used for debugging.
  Fix SQL injection vulnerability by using prepared statement

  Replaced the concatenated SQL query with a PreparedStatement to prevent SQL injection vulnerability.
  Fix SQL injection vulnerability using prepared statements

  Replaced the SQL statements with prepared statements to prevent SQL injection vulnerabilities.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized query with placeholders.
  Fix SQL injection vulnerability by using PreparedStatement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using parameterized query to safely pass the username.
  Fix SQL injection vulnerability by using prepared statement

  Replaced Statement with PreparedStatement to prevent SQL injection vulnerability by using prepared statement.
  Remove debug code from data source lookup

  Removed the debug print statement and logging of the exception message during data source lookup.

• File changed: src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
  Remove debug print statement in isLoggedin method

  Removed the debug print statement (e.printStackTrace()) in the catch block of the isLoggedin method.
  Fix session middleware settings vulnerability

  Set the secure flag of the session cookie to true to ensure it is only sent over HTTPS.

• File changed: src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
  Fix vulnerability by replacing java.util.Random() with java.security.SecureRandom

  Replaced the usage of java.util.Random() with java.security.SecureRandom in the makeRandomString() method to fix the vulnerability.

• File changed: WebContent/static/inside_about.htm
  Fix insecure link in the code

  Changed the HTTP link "http://www.newspapersyndications.tv" to HTTPS link "https://www.newspapersyndications.tv"

• File changed: WebContent/static/inside_community.htm
  Fix insecure link to Adobe Reader download page

  Replaced the insecure link "http://www.adobe.com/products/acrobat/readstep2.html" with a secure link "https://www.adobe.com/products/acrobat/readstep2.html" to Adobe Reader download page.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
  Fixed input validation vulnerability in AdminServlet

  Sanitized user input before processing to prevent injection attacks in AdminServlet.

• File changed: src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
  Fix cookie vulnerabilities by setting 'HttpOnly' and 'secure' flags

  Added setting 'HttpOnly' flag for cookies by calling setHttpOnly(true) method and setting 'secure' flag for cookies by calling setSecure(true) method.