Patched results for branch: master

[patched-codes]

This pull request from patched fixes 18 issues.

---

• File changed: src/main/java/io/shiftleft/tarpit/FileUploader.java
  Security fix to prevent path traversal attacks

  The code diff replaces the previous method of handling file uploads with a more secure method that prevents path traversal attacks. It imports necessary classes from java.nio.file package. The new code first extracts the file name from the submitted file, checks for path traversal attack attempts, and sends an error response if an attempt is detected. It then creates a target path and checks again for path traversal attack attempts. If no attack is detected, it copies the input file to the target path using the Files.copy method, replacing any existing file with the same name. The code no longer uses FileOutputStream to write the file, and thus no longer needs to flush and close the output stream. The file is then unzipped using the Unzipper.unzipFile method.

• File changed: src/main/java/io/shiftleft/tarpit/OrderStatus.java
  Security fix: Input sanitization and SQL injection prevention

  The diff introduces a new method sanitizeInput to sanitize user inputs and prevent potential security risks. This method is used to sanitize the 'orderId', 'userId', and 'password' parameters. The SQL query for retrieving orders has been modified to use a prepared statement, which helps prevent SQL injection attacks. Additionally, the 'HttpOnly' and 'Secure' attributes have been set to the cookie, enhancing the security of the cookie by limiting its accessibility to only HTTP(S) requests and preventing access via client-side scripts.

• File changed: src/main/java/io/shiftleft/tarpit/ServletTarPit.java
  Security improvements: Removed hardcoded sensitive data, fixed insecure cryptographic algorithm, SQL injection, and insecure cookie handling, and removed JavaScript code execution.

  The diff removes hardcoded sensitive data (AWS keys and database credentials), replaces the insecure DES cryptographic algorithm with AES, fixes SQL injection by using prepared statements, adds HttpOnly and Secure flags to cookies, and removes JavaScript code execution. It also suggests implementing methods to retrieve database credentials securely.