OTWO-7696 remediate high severity SAST findings in openHub ui codebase

app/assets/javascripts/account_edit.js

@@ -31,7 +31,7 @@ var EditMap = {
         if (json.success) {
           marker = EditMap.jumpMeTo(json.latitude, json.longitude);
           $('#account_country_code').val(json.country);
-          $('#account_location_mirror').html(json.location);
+          $('#account_location_mirror').text(json.location);
           $('#account_location').val(json.location);
           $('#account_latitude').val(json.latitude);
           $('#account_longitude').val(json.longitude);
@@ -61,7 +61,7 @@ var EditMap = {
       marker = EditMap.jumpMeTo(loc.lat(), loc.lng());
 
       $('#account_country_code').val(countryCode);
-      $('#account_location_mirror').html(address);
+      $('#account_location_mirror').text(address);
       $('#account_location').val(address);
       $('#account_latitude').val(loc.lat());
       $('#account_longitude').val(loc.lng());

app/assets/javascripts/jquery.rest_in_place.js

@@ -101,7 +101,7 @@ jQuery.fn.rest_in_place = function(url, objectName, attributeName) {
               dataType: "json",
               "beforeSend" : function(xhr) { xhr.setRequestHeader("Accept", "application/json"); },
               "success" : function(jsondata, status){
-                e.html(jsondata[attributeName]);
+                e.text(jsondata[attributeName]);
                 tearDown(e);
                 return false;
               }

app/assets/javascripts/ohloh_suggests.js

@@ -228,7 +228,7 @@ StackShow = {
         // we're going to slide up the new recommendations
         list.css('height', list.height()); // make height fixed, the larger div is overflow:hidde
         list.find("li").wrapAll("<div id='delete_me'></div>");
-        list.children("ul").append(result.recommendations);
+        list.children("ul").append($.parseHTML(result.recommendations));
         list.find("#delete_me").slideUp(1000, function() {
           $(this).remove();
           list.css('height', 'auto');
@@ -243,7 +243,7 @@ StackShow = {
 
   update_count: function(json) {
     if (json.updated_count) {
-      $(".listing_result").html(json.updated_count);
+      $(".listing_result").text(json.updated_count);
       if (json.updated_count == 0) {
         $("#empty_stack_text").fadeIn("slow");
       } else {

app/assets/javascripts/org_infographic.js

@@ -13,8 +13,8 @@ OrganizationPictogram = {
       $.ajax({
         url: $(this).attr('url'),
         success: function(response) {
-          $('#org_infographic').replaceWith(response.pictogram_html);
-          $(update).html(response.subview_html);
+          $('#org_infographic').replaceWith($.parseHTML(response.pictogram_html));
+          $(update).html($.parseHTML(response.subview_html));
           OrganizationPictogram.init();
           Expander.init();
           $.unblockUI();

app/assets/javascripts/orgs.js

@@ -112,7 +112,8 @@ var OrgClaimProject = {
         type: "GET",
         url: url,
         success: function(data){
-          $('#'+link_id).replaceWith(data);
+          var sanitized = $('<div>').append($.parseHTML(data)).html();
+          $('#'+link_id).replaceWith(sanitized);
         }
       });
       return false;

app/controllers/api_keys_controller.rb

@@ -93,7 +93,8 @@ def find_models
   end
 
   def parse_sort_term
-    ApiKey.respond_to?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_newest'
+    allowed = %w[by_account_name by_newest by_oldest by_most_requests_today by_most_requests by_most_recent_request]
+    allowed.include?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_newest'
   end
 
   def default_or_csv_limit

app/controllers/concerns/enlistment_filters.rb

@@ -24,7 +24,8 @@ def enlistment_params
   end
 
   def parse_sort_term
-    Enlistment.respond_to?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_url'
+    allowed = %w[by_url by_project by_type by_module_name by_last_update by_update_status]
+    allowed.include?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_url'
   end
 
   def find_enlistment

app/controllers/languages_controller.rb

@@ -49,6 +49,7 @@ def find_languages
   end
 
   def parse_sort_term
-    Language.respond_to?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_nice_name'
+    allowed = %w[by_name by_nice_name by_total by_code by_comment_ratio by_projects by_contributors by_commits]
+    allowed.include?("by_#{params[:sort]}") ? "by_#{params[:sort]}" : 'by_nice_name'
   end
 end

app/controllers/people_controller.rb

@@ -44,6 +44,7 @@ def find_rankings_people
   end
 
   def parse_sort_term
-    Person.respond_to?("sort_by_#{params[:sort]}") ? "sort_by_#{params[:sort]}" : 'sort_by_kudo_position'
+    allowed = %w[sort_by_kudo_position sort_by_effective_name]
+    allowed.include?("sort_by_#{params[:sort]}") ? "sort_by_#{params[:sort]}" : 'sort_by_kudo_position'
   end
 end

docker-compose-utility.yml

@@ -5,6 +5,8 @@ services:
     container_name: "${DOCKER_HOST_NAME}"
     command: '/start_utility.sh'
     hostname: "${DOCKER_HOST_NAME}"
+    cap_drop:
+      - NET_RAW
     ports:
       - '6379:6379'
       - '8086:8086'

docker-compose.yml

@@ -5,6 +5,8 @@ services:
     container_name: "${DOCKER_HOST_NAME}"
     command: '/start.sh'
     hostname: "${DOCKER_HOST_NAME}"
+    cap_drop:
+      - NET_RAW
     ports:
       - "443:443"
     volumes: