OTWO-7696 remediate high severity SAST findings in openHub ui codebase

[Niharika1117]

No description provided.

[Copilot]

Pull request overview

Remediates high-severity SAST findings across the OpenHub UI by tightening server-side sort parameter handling, reducing unsafe DOM insertion patterns in legacy JavaScript, and hardening container runtime capabilities.

Changes:

• Whitelist allowable sort scopes/methods in multiple controllers to prevent sort-term injection.
• Replace several .html() DOM sinks with safer alternatives (.text() / $.parseHTML(...)) and adjust AJAX HTML insertion flows.
• Drop the NET_RAW Linux capability from docker-compose services to reduce container privileges.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/helpers/edits_helper_test.rb	Fixes a datetime formatting assertion to compare against a string year.
public/timeline/scripts/sources.js	Alters AJAX description rendering to parse/insert returned HTML.
docker-compose.yml	Drops NET_RAW capability for the main service.
docker-compose-utility.yml	Drops NET_RAW capability for the utility service.
app/controllers/people_controller.rb	Restricts sort method selection to an allowlist.
app/controllers/languages_controller.rb	Restricts sort scope selection to an allowlist.
app/controllers/concerns/enlistment_filters.rb	Restricts sort scope selection to an allowlist.
app/controllers/api_keys_controller.rb	Restricts sort scope selection to an allowlist.
app/assets/javascripts/orgs.js	Changes Org claim AJAX replace flow to use parsed HTML.
app/assets/javascripts/org_infographic.js	Changes infographic subview updates to use parsed HTML.
app/assets/javascripts/ohloh_suggests.js	Adjusts recommendations insertion and uses .text() for counts.
app/assets/javascripts/jquery.rest_in_place.js	Uses .text() instead of .html() for inline-edit results.
app/assets/javascripts/account_edit.js	Uses .text() instead of .html() for mirrored location output.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.