SHP-183/resolve github security conflicts

[jshudbrd]

Resolves the current 36 security issues flagged by Bearer across the code base. The resolved changes by category are:

• Information exposure through an exception
• Leakage of information in logger message
• Observable timing discrepancy
• Unsanitized dynamic input in file path
• Leakage of sensitive data in cookie

Note:
A suppression comment has been applied to Leakage of sensitive data in cookie and Unsanitized dynamic input in file path as these are not genuine security threats. The cookie stores a signed JWT and the file path is hard coded in an internal developer only function.

[Bralc003]

I don't think this would fix the error this is just doing the same thing.

[jshudbrd]

I'm pretty sure it's just flagging the comparison operator, but I'll make the change.

[Bralc003]

I was looking at the password input field and I think it should be fine to change it back to === 0 and dismiss the alert for this one.

This is basically used for an input field to throw a required flag based on what the user has entered. This alert thinks it is based on a stored password but since it is an input we have not passed through yet it will be fine to dismiss the alert.

[jshudbrd]

I was looking at the password input field and I think it should be fine to change it back to === 0 and dismiss the alert for this one.

This is basically used for an input field to throw a required flag based on what the user has entered. This alert thinks it is based on a stored password but since it is an input we have not passed through yet it will be fine to dismiss the alert.

A lot of the issues being flagged are similar and aren't actually security vulnerabilities, just bearer flagging keywords near comparison operators.

[Bralc003]

Good Work! I think with the bearer security flagging key words we probably could have just dismissed them since they weren't actually a security threat

[jshudbrd]

Good Work! I think with the bearer security flagging key words we probably could have just dismissed them since they weren't actually a security threat

Dismissing would work, but I think it would just re-flag it every time the scan is run. Other solution is to just use the suppression comment, but in this instance its a small fix anyway.