PatchWork AutoFix

[CTY-git]

This pull request from patched fixes 8 issues.

---

• File changed: sqli/static/js/materialize.js
  Fixed potential XSS vulnerability

  Replaced innerHTML with textContent to securely encode user-controlled data and prevent potential XSS attacks.
  Fix unsafe console.log string concatenation vulnerability

  Replace dynamic string concatenation in console.log with a template string to prevent potential log forging.
  Fixed potential log forgery through non-literal variable in console.log function

  Changed the console log which was vulnerable to forgery due to usage of non-literal variable. Now, the JSON object intended to be logged is stringified and passed as a constant value.
  Prevent potential misuse of console.log by hardcoding the log message format.

  The change includes the removal of the variable string (produced by JSON.stringify) directly passed into console.log which makes the code susceptible to string formatting exploits. Instead, a template literal indicating the purpose of the string has been specified as a constant string and %o is inserted to represent the stringified object l.
  Fixed potential ReDoS vulnerability in RegExp variable constructor

  Changed dynamically generated RegExp pattern into a hardcoded, safer regexp pattern to avoid potential Regular Expression Denial-of-Service (ReDoS) vulnerability.

• File changed: docker-compose.yml
  Address security vulnerabilities in the 'redis' service configuration

  Enhanced the 'redis' service configuration by setting 'no-new-privileges' to true in 'security_opt' and 'read_only' to true. These changes prevent privilege escalation and do not allow root filesystem to be writable.

• File changed: sqli/dao/student.py
  Fix potential SQL injection vulnerability

  Changed the SQL query format in the create method to use parameterized queries instead of formatted string, to prevent potential SQL injection attacks.

• File changed: sqli/dao/user.py
  Replace insecure md5 hashing with secure scrypt password hashing

  Replaced the hashlib.md5 function with the hashlib.scrypt function in the 'check_password' method of the User class.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud