Address a few codeql reports

Unidata · Jan 16, 2025 · 2e4fdc0 · 2e4fdc0
1 parent 8c5bcc1
commit 2e4fdc0
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 5 deletions.
diff --git a/tds/src/main/java/thredds/server/catalogservice/RemoteCatalogServiceController.java b/tds/src/main/java/thredds/server/catalogservice/RemoteCatalogServiceController.java
@@ -81,7 +81,7 @@ protected ModelAndView handleRequest(HttpServletRequest request, HttpServletResp
       Formatter f = new Formatter();
       f.format("Error reading catalog '%s' err=%s%n", uri, builder.getErrorMessage());
       if (!uri.toString().toLowerCase(Locale.ROOT).endsWith(".xml")) {
-        f.format("Expected catalog uri = '" + uri + "' to end with '.xml'");
+        f.format("Expected catalog uri = '%s' to end with '.xml'", uri);
       }
       log.debug(f.toString());
       response.sendError(HttpServletResponse.SC_BAD_REQUEST, f.toString());

diff --git a/tds/src/main/webapp/WEB-INF/templates/gridFragments.html b/tds/src/main/webapp/WEB-INF/templates/gridFragments.html
@@ -18,10 +18,14 @@
   <link rel="stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/openlayers/4.6.5/ol.css">
 
   <!-- "script" elements must have explicit closing tags. See https://stackoverflow.com/questions/69913 -->
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/openlayers/4.6.5/ol.js"></script>
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/openlayers/4.6.5/ol.js"
+          integrity="sha512-O7kHS9ooekX8EveiC94z9xSvD/4xt10Qigl6uEKvspYykdux3Ci5QNu5fwi4ca0ZkZI/oCgx5ja8RklWUEqzxQ=="
+          crossorigin="anonymous"></script>
   <!-- As of 2018-02-08, Safari and Edge do not natively support the "FormData.entries()" method, which we utilize in
        buildAccessUrl(). This provides a replacement implementation. See https://github.com/jimmywarting/FormData. -->
-  <script src="https://cdn.rawgit.com/jimmywarting/FormData/3.0.9/FormData.js"></script>
+  <script src="https://cdn.jsdelivr.net/npm/[email protected]/FormData.js"
+          integrity="sha512-eD45qyxOI5rIMbPhYEo/VgzoYP37DTaWTjYPqfgCOCd/SWiFtuYJVoElCxhGkHMaBwJpM55679FP1KVMfdvl1A=="
+          crossorigin="anonymous"></script>
   <script type="text/javascript" src="../../js/ncss/ncssApp.js" th:src="@{/js/ncss/ncssApp.js}"></script>
   <script type="text/javascript" th:inline="javascript">
       var horizExtentWKT = /*[[${horizExtentWKT}]]*/ 'POLYGON((-90 45, 90 45, 90 -45, -90 -45, -90 45))';

diff --git a/tds/src/main/webapp/WEB-INF/templates/pointFragments.html b/tds/src/main/webapp/WEB-INF/templates/pointFragments.html
@@ -18,10 +18,14 @@
   <link rel="stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/openlayers/4.6.5/ol.css">
 
   <!-- "script" elements must have explicit closing tags. See https://stackoverflow.com/questions/69913 -->
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/openlayers/4.6.5/ol.js"></script>
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/openlayers/4.6.5/ol.js"
+          integrity="sha512-O7kHS9ooekX8EveiC94z9xSvD/4xt10Qigl6uEKvspYykdux3Ci5QNu5fwi4ca0ZkZI/oCgx5ja8RklWUEqzxQ=="
+          crossorigin="anonymous"></script>
   <!-- As of 2018-02-08, Safari and Edge do not natively support the "FormData.entries()" method, which we utilize in
        buildAccessUrl(). This provides a replacement implementation. See https://github.com/jimmywarting/FormData. -->
-  <script src="https://cdn.rawgit.com/jimmywarting/FormData/3.0.9/FormData.js"></script>
+  <script src="https://cdn.jsdelivr.net/npm/[email protected]/FormData.js"
+          integrity="sha512-eD45qyxOI5rIMbPhYEo/VgzoYP37DTaWTjYPqfgCOCd/SWiFtuYJVoElCxhGkHMaBwJpM55679FP1KVMfdvl1A=="
+          crossorigin="anonymous"></script>
   <script type="text/javascript" src="../../js/ncss/ncssApp.js" th:src="@{/js/ncss/ncssApp.js}"></script>
 
   <script type="text/javascript" th:inline="javascript">