PatchWork AutoFix

WebContent/high_yield_investments.htm

@@ -124,7 +124,8 @@ <h1>High Yield Investments</h1>
         if any, to third party products and/or websites are purely coincidental. This site is
         provided "as is" without warranty of any kind, either express or implied. Watchfire does
         not assume any risk in relation to your use of this website. For additional Terms of Use,
-        please go to <a id="_ctl0__ctl0_HyperLink7" href="http://www.watchfire.com/statements/terms.aspx">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />
+        please go to <a id="_ctl0__ctl0_HyperLink7" href="https://www.watchfire.com/statements/terms.aspx">https://www.watchfire.com/statements/terms.aspx</a>.<br /><br />
+
 
         Copyright &copy; 2006, Watchfire Corporation, All rights reserved.
     </div>

WebContent/static/inside_community.htm

@@ -12,6 +12,6 @@ <h2>Summer 2006</h2>
 <p>The 2006 community efforts of Altoro Mutual and our employees is quite impressive including charitable contributions, volunteerism, diversity initiatives, and other support.  <a href="pr/communityannualreport.pdf">View</a> the summary report (PDF, 800KB).</p>
 
 <p><img src="images/adobe.gif" border=0 alt="Adobe Reader"><br />
-<a href="http://www.adobe.com/products/acrobat/readstep2.html">Download free Adobe Reader</a>.</p>
+<a href="https://www.adobe.com/products/acrobat/readstep2.html">Download free Adobe Reader</a>.</p>
 
-</div>
+</div>

WebContent/static/security.htm

@@ -56,7 +56,8 @@ <h2>Keep Your System Up to Date</h2>
 <h2>Backups</h2>
 <p>It is a good practice to back up important files and folders on your computer. To back up files, you can make copies onto media that you can safely store elsewhere, such as CDs or floppy discs. </p>
 
-<p>For more information on home computer security, visit <a href="http://www.cert.org/">http://www.cert.org/</a>.</p>
+<p>For more information on home computer security, visit <a href="https://www.cert.org/">https://www.cert.org/</a>.</p>
+
 <p><a href="#top"><img alt="Back to Top" src="images/icon_top.gif" border="0" /></a>
 
 </div>

WebContent/swagger/lib/marked.js

@@ -308,7 +308,8 @@ Lexer.prototype.token = function(src, top, bq) {
         if (~item.indexOf('\n ')) {
           space -= item.length;
           item = !this.options.pedantic
-            ? item.replace(new RegExp('^ {1,' + space + '}', 'gm'), '')
+            ? item.replace(/^ {1, + space + }/gm, '')
+
             : item.replace(/^ {1,4}/gm, '');
         }
 

src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java

@@ -24,6 +24,8 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.owasp.esapi.ESAPI;
+
 import com.ibm.security.appscan.altoromutual.util.DBUtil;
 
 /**
@@ -41,8 +43,8 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
 
 		//add account
 		if (request.getRequestURL().toString().endsWith("addAccount")){
-			String username = request.getParameter("username");
-			String acctType = request.getParameter("accttypes");
+			String username = ESAPI.encoder().canonicalize(request.getParameter("username"));
+			String acctType = ESAPI.encoder().canonicalize(request.getParameter("accttypes"));
 			if (username == null || acctType == null || username.trim().length() == 0 || acctType.trim().length() == 0)
 				message = "An error has occurred. Please try again later.";
 			else {
@@ -54,11 +56,11 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
 
 		//add user
 		else if (request.getRequestURL().toString().endsWith("addUser")){
-			String firstname = request.getParameter("firstname");
-			String lastname = request.getParameter("lastname");
-			String username = request.getParameter("username");
-			String password1 = request.getParameter("password1");
-			String password2 = request.getParameter("password2");
+			String firstname = ESAPI.encoder().canonicalize(request.getParameter("firstname"));
+			String lastname = ESAPI.encoder().canonicalize(request.getParameter("lastname"));
+			String username = ESAPI.encoder().canonicalize(request.getParameter("username"));
+			String password1 = ESAPI.encoder().canonicalize(request.getParameter("password1"));
+			String password2 = ESAPI.encoder().canonicalize(request.getParameter("password2"));
 			if (username == null || username.trim().length() == 0
 				|| password1 == null || password1.trim().length() == 0
 				|| password2 == null || password2.trim().length() == 0)
@@ -87,9 +89,9 @@ else if (request.getRequestURL().toString().endsWith("addUser")){
 
 		//change password
 		else if (request.getRequestURL().toString().endsWith("changePassword")){
-			String username = request.getParameter("username");
-			String password1 = request.getParameter("password1");
-			String password2 = request.getParameter("password2");
+			String username = ESAPI.encoder().canonicalize(request.getParameter("username"));
+			String password1 = ESAPI.encoder().canonicalize(request.getParameter("password1"));
+			String password2 = ESAPI.encoder().canonicalize(request.getParameter("password2"));
 			if (username == null || username.trim().length() == 0
 					|| password1 == null || password1.trim().length() == 0
 					|| password2 == null || password2.trim().length() == 0)
@@ -121,3 +123,4 @@ else if (request.getRequestURL().toString().endsWith("changePassword")){
 	}
 
 }
+

src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java

@@ -92,6 +92,8 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
 		//Handle the cookie using ServletUtil.establishSession(String)
 		try{
 			Cookie accountCookie = ServletUtil.establishSession(username,session);
+			accountCookie.setHttpOnly(true);
+			accountCookie.setSecure(true);
 			response.addCookie(accountCookie);
 			response.sendRedirect(request.getContextPath()+"/bank/main.jsp");
 			}
@@ -105,3 +107,4 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
 	}
 
 }
+

src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java

@@ -95,10 +95,14 @@ else if (step.equals("done")){
 			content = "<h1>Request Out of Order</h1>"+
 			"<div width=\"99%\"><p>It appears that you attempted to skip or repeat some areas of this survey.  Please <a href=\"survey_questions.jsp\">return to the start page</a> to begin again.</p></div>";
 		} else {		
-			request.getSession().setAttribute("surveyStep", step);
+			String safeStep = StringEscapeUtils.escapeHtml4(step);
+			request.getSession().setAttribute("surveyStep", safeStep);
+
 		}
 		response.setContentType("text/html");
-		response.getWriter().write(content);
+		import org.apache.commons.text.StringEscapeUtils;
+				response.getWriter().write(StringEscapeUtils.escapeHtml4(content));
+
 		response.getWriter().flush();
 
 	}

src/com/ibm/security/appscan/altoromutual/util/DBUtil.java

@@ -214,9 +214,10 @@ public static boolean isValidUser(String user, String password) throws SQLExcept
 			return false; 
 
 		Connection connection = getConnection();
-		Statement statement = connection.createStatement();
-
-		ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
+		PreparedStatement preparedStatement = connection.prepareStatement("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = ? AND PASSWORD= ?");
+		preparedStatement.setString(1, user);
+		preparedStatement.setString(2, password);
+		ResultSet resultSet =preparedStatement.executeQuery();
 
 		if (resultSet.next()){
 
@@ -272,8 +273,9 @@ public static Account[] getAccounts(String username) throws SQLException{
 			return null; 
 
 		Connection connection = getConnection();
-		Statement statement = connection.createStatement();
-		ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
+		PreparedStatement preparedStatement = connection.prepareStatement("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = ?");
+		preparedStatement.setString(1, username);
+		ResultSet resultSet = preparedStatement.executeQuery();
 
 		ArrayList<Account> accounts = new ArrayList<Account>(3);
 		while (resultSet.next()){
@@ -302,8 +304,7 @@ public static String transferFunds(String username, long creditActId, long debit
 			User user = getUserInfo(username);
 
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-
+
 			Account debitAccount = Account.getAccount(debitActId);
 			Account creditAccount = Account.getAccount(creditActId);
 
@@ -332,8 +333,16 @@ public static String transferFunds(String username, long creditActId, long debit
 				debitAmount = -debitAmount;
 
 			//create transaction record
-			statement.execute("INSERT INTO TRANSACTIONS (ACCOUNTID, DATE, TYPE, AMOUNT) VALUES ("+debitAccount.getAccountId()+",'"+date+"',"+((debitAccount.getAccountId() == userCC)?"'Cash Advance'":"'Withdrawal'")+","+debitAmount+")," +
-					  "("+creditAccount.getAccountId()+",'"+date+"',"+((creditAccount.getAccountId() == userCC)?"'Payment'":"'Deposit'")+","+creditAmount+")"); 	
+			PreparedStatement prep = connection.prepareStatement("INSERT INTO TRANSACTIONS (ACCOUNTID, DATE, TYPE, AMOUNT) VALUES (?, ?, ?, ?), (?, ?, ?, ?)");
+			prep.setLong(1, debitAccount.getAccountId());
+			prep.setTimestamp(2, date);
+			prep.setString(3, (debitAccount.getAccountId() == userCC) ? "Cash Advance" : "Withdrawal");
+			prep.setDouble(4, debitAmount);
+			prep.setLong(5, creditAccount.getAccountId());
+			prep.setTimestamp(6, date);
+			prep.setString(7, (creditAccount.getAccountId() == userCC) ? "Payment" : "Deposit");
+			prep.setDouble(8, creditAmount);
+			prep.execute();
 
 			Log4AltoroJ.getInstance().logTransaction(debitAccount.getAccountId()+" - "+ debitAccount.getAccountName(), creditAccount.getAccountId()+" - "+ creditAccount.getAccountName(), amount);
 
@@ -342,14 +351,26 @@ public static String transferFunds(String username, long creditActId, long debit
 
 			//add cash advance fee since the money transfer was made from the credit card 
 			if (debitAccount.getAccountId() == userCC){
-				statement.execute("INSERT INTO TRANSACTIONS (ACCOUNTID, DATE, TYPE, AMOUNT) VALUES ("+debitAccount.getAccountId()+",'"+date+"','Cash Advance Fee',"+CASH_ADVANCE_FEE+")");
+				PreparedStatement feeStmt = connection.prepareStatement("INSERT INTO TRANSACTIONS (ACCOUNTID, DATE, TYPE, AMOUNT) VALUES (?, ?, ?, ?)");
+				feeStmt.setLong(1, debitAccount.getAccountId());
+				feeStmt.setTimestamp(2, date);
+				feeStmt.setString(3, "Cash Advance Fee");
+				feeStmt.setDouble(4, CASH_ADVANCE_FEE);
+				feeStmt.execute();
 				debitAmount += CASH_ADVANCE_FEE;
 				Log4AltoroJ.getInstance().logTransaction(String.valueOf(userCC), "N/A", CASH_ADVANCE_FEE);
 			}
 
 			//update account balances
-			statement.execute("UPDATE ACCOUNTS SET BALANCE = " + (debitAccount.getBalance()+debitAmount) + " WHERE ACCOUNT_ID = " + debitAccount.getAccountId());
-			statement.execute("UPDATE ACCOUNTS SET BALANCE = " + (creditAccount.getBalance()+creditAmount) + " WHERE ACCOUNT_ID = " + creditAccount.getAccountId());
+			PreparedStatement updateDebit = connection.prepareStatement("UPDATE ACCOUNTS SET BALANCE = ? WHERE ACCOUNT_ID = ?");
+			updateDebit.setDouble(1, debitAccount.getBalance() + debitAmount);
+			updateDebit.setLong(2, debitAccount.getAccountId());
+			updateDebit.execute();
+
+			PreparedStatement updateCredit = connection.prepareStatement("UPDATE ACCOUNTS SET BALANCE = ? WHERE ACCOUNT_ID = ?");
+			updateCredit.setDouble(1, creditAccount.getBalance() + creditAmount);
+			updateCredit.setLong(2, creditAccount.getAccountId());
+			updateCredit.execute();
 
 			return null;
 
@@ -359,6 +380,7 @@ public static String transferFunds(String username, long creditActId, long debit
 	}
 
 
+
 	/**
 	 * Get transaction information for the specified accounts in the date range (non-inclusive of the dates)
 	 * @param startDate
@@ -375,32 +397,45 @@ public static Transaction[] getTransactions(String startDate, String endDate, Ac
 			Connection connection = getConnection();
 
 
-			Statement statement = connection.createStatement();
 
-			if (rowCount > 0)
-				statement.setMaxRows(rowCount);
-
+
 			StringBuffer acctIds = new StringBuffer();
-			acctIds.append("ACCOUNTID = " + accounts[0].getAccountId());
+			acctIds.append("ACCOUNTID = ?");
 			for (int i=1; i<accounts.length; i++){
-				acctIds.append(" OR ACCOUNTID = "+accounts[i].getAccountId());	
+				acctIds.append(" OR ACCOUNTID = ?");	
 			}
 
 			String dateString = null;
 
 			if (startDate != null && startDate.length()>0 && endDate != null && endDate.length()>0){
-				dateString = "DATE BETWEEN '" + startDate + " 00:00:00' AND '" + endDate + " 23:59:59'";
+				dateString = "DATE BETWEEN ? AND ?";
 			} else if (startDate != null && startDate.length()>0){
-				dateString = "DATE > '" + startDate +" 00:00:00'";
+				dateString = "DATE > ?";
 			} else if (endDate != null && endDate.length()>0){
-				dateString = "DATE < '" + endDate + " 23:59:59'";
+				dateString = "DATE < ?";
 			}
 
 			String query = "SELECT * FROM TRANSACTIONS WHERE (" + acctIds.toString() + ") " + ((dateString==null)?"": "AND (" + dateString + ") ") + "ORDER BY DATE DESC" ;
+			PreparedStatement preparedStatement = connection.prepareStatement(query);
+			int parameterIndex = 1;
+			for (Account account : accounts) {
+				preparedStatement.setLong(parameterIndex++, account.getAccountId());
+			}
+			if (startDate != null && startDate.length() > 0 && endDate != null && endDate.length() > 0) {
+				preparedStatement.setString(parameterIndex++, startDate + " 00:00:00");
+				preparedStatement.setString(parameterIndex++, endDate + " 23:59:59");
+			} else if (startDate != null && startDate.length() > 0) {
+				preparedStatement.setString(parameterIndex++, startDate + " 00:00:00");
+			} else if (endDate != null && endDate.length() > 0) {
+				preparedStatement.setString(parameterIndex++, endDate + " 23:59:59");
+			}
+			if (rowCount > 0)
+				preparedStatement.setMaxRows(rowCount);
+
 			ResultSet resultSet = null;
 
 			try {
-				resultSet = statement.executeQuery(query);
+				resultSet = preparedStatement.executeQuery();
 			} catch (SQLException e){
 				int errorCode = e.getErrorCode();
 				if (errorCode == 30000)
@@ -421,6 +456,7 @@ public static Transaction[] getTransactions(String startDate, String endDate, Ac
 			return transactions.toArray(new Transaction[transactions.size()]); 
 	}
 
+
 	public static String[] getBankUsernames() {
 
 		try {
@@ -447,8 +483,9 @@ public static String[] getBankUsernames() {
 	public static Account getAccount(long accountNo) throws SQLException {
 
 		Connection connection = getConnection();
-		Statement statement = connection.createStatement();
-		ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
+		PreparedStatement preparedStatement = connection.prepareStatement("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = ? ");
+		preparedStatement.setLong(1, accountNo);
+		ResultSet resultSet = preparedStatement.executeQuery();
 
 		ArrayList<Account> accounts = new ArrayList<Account>(3);
 		while (resultSet.next()){
@@ -467,8 +504,10 @@ public static Account getAccount(long accountNo) throws SQLException {
 	public static String addAccount(String username, String acctType) {
 		try {
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("INSERT INTO ACCOUNTS (USERID,ACCOUNT_NAME,BALANCE) VALUES ('"+username+"','"+acctType+"', 0)");
+			PreparedStatement preparedStatement = connection.prepareStatement("INSERT INTO ACCOUNTS (USERID,ACCOUNT_NAME,BALANCE) VALUES (?, ?, 0)");
+			preparedStatement.setString(1, username);
+			preparedStatement.setString(2, acctType);
+			preparedStatement.execute();
 			return null;
 		} catch (SQLException e){
 			return e.toString();
@@ -478,20 +517,31 @@ public static String addAccount(String username, String acctType) {
 	public static String addSpecialUser(String username, String password, String firstname, String lastname) {
 		try {
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("INSERT INTO SPECIAL_CUSTOMERS (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
+			PreparedStatement preparedStatement = connection.prepareStatement("INSERT INTO SPECIAL_CUSTOMERS (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES (?,?,?,?,?)");
+			preparedStatement.setString(1, username);
+			preparedStatement.setString(2, password);
+			preparedStatement.setString(3, firstname);
+			preparedStatement.setString(4, lastname);
+			preparedStatement.setString(5, "user");
+			preparedStatement.execute();
 			return null;
 		} catch (SQLException e){
 			return e.toString();
 
 		}
 	}
+
 
 	public static String addUser(String username, String password, String firstname, String lastname) {
 		try {
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
+			PreparedStatement preparedStatement = connection.prepareStatement("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES (?,?,?,?,?)");
+			preparedStatement.setString(1, username);
+			preparedStatement.setString(2, password);
+			preparedStatement.setString(3, firstname);
+			preparedStatement.setString(4, lastname);
+			preparedStatement.setString(5, "user");
+			preparedStatement.execute();
 			return null;
 		} catch (SQLException e){
 			return e.toString();
@@ -502,8 +552,10 @@ public static String addUser(String username, String password, String firstname,
 	public static String changePassword(String username, String password) {
 		try {
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("UPDATE PEOPLE SET PASSWORD = '"+ password +"' WHERE USER_ID = '"+username+"'");
+			PreparedStatement preparedStatement = connection.prepareStatement("UPDATE PEOPLE SET PASSWORD = ? WHERE USER_ID = ?");
+			preparedStatement.setString(1, password);
+			preparedStatement.setString(2, username);
+			preparedStatement.execute();
 			return null;
 		} catch (SQLException e){
 			return e.toString();
@@ -515,9 +567,13 @@ public static String changePassword(String username, String password) {
 	public static long storeFeedback(String name, String email, String subject, String comments) {
 		try{ 
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("INSERT INTO FEEDBACK (NAME,EMAIL,SUBJECT,COMMENTS) VALUES ('"+name+"', '"+email+"', '"+subject+"', '"+comments+"')", Statement.RETURN_GENERATED_KEYS);
-			ResultSet rs= statement.getGeneratedKeys();
+			PreparedStatement preparedStatement = connection.prepareStatement("INSERT INTO FEEDBACK (NAME,EMAIL,SUBJECT,COMMENTS) VALUES (?, ?, ?, ?)", Statement.RETURN_GENERATED_KEYS);
+			preparedStatement.setString(1, name);
+			preparedStatement.setString(2, email);
+			preparedStatement.setString(3, subject);
+			preparedStatement.setString(4, comments);
+			preparedStatement.execute();
+			ResultSet rs= preparedStatement.getGeneratedKeys();
 			long id = -1;
 			if (rs.next()){
 				id = rs.getLong(1);
@@ -528,4 +584,5 @@ public static long storeFeedback(String name, String email, String subject, Stri
 			return -1;
 		}
 	}
+
 }