ByteDance/PatchEval huggingface dataset:
CVE-2022-4643 (Go)

A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_ocr.go. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is b19021ade3d0b71c89d35cb00eb9e589a121faa5. It is recommended to upgrade the affected component. VDB-216502 is the identifier assigned to this vulnerability.

Weakness:
CWE-94: name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-77: name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78: name: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Repository: https://github.com/sajari/docconv

Vulnerable code:
file_path: pdf_ocr.go
snippet: func PDFHasImage(path string) bool {
	cmd := "pdffonts -l 5 %s | tail -n +3 | cut -d' ' -f1 | sort | uniq"
	out, err := exec.Command("bash", "-c", fmt.Sprintf(cmd, path)).Output()
	if err != nil {
		log.Println(err)
		return false
	}
	if string(out) == "" {
		return true
	}
	return false
}

Fixed code:
file_path: pdf_ocr.go
snippet: func PDFHasImage(path string) bool {
	cmd := "pdffonts -l 5 %s | tail -n +3 | cut -d' ' -f1 | sort | uniq"
	out, err := exec.Command("bash", "-c", fmt.Sprintf(cmd, shellEscape(path))).CombinedOutput()

	if err != nil {
		log.Println(err)
		return false
	}
	if string(out) == "" {
		return true
	}
	return false
}

file_path: pdf_ocr.go
snippet: var shellEscapePattern *regexp.Regexp

file_path: pdf_ocr.go
snippet: func init() {
	shellEscapePattern = regexp.MustCompile(`[^\w@%+=:,./-]`)
}

file_path: pdf_ocr.go
snippet: func shellEscape(s string) string {
	if len(s) == 0 {
		return "''"
	}
	if shellEscapePattern.MatchString(s) {
		return "'" + strings.Replace(s, "'", "'\"'\"'", -1) + "'"
	}

	return s
}
CVE-2022-31130 (Go)

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.

Weakness:
CWE-522: name: Insufficiently Protected Credentials
description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Repository: https://github.com/grafana/grafana

Vulnerable code:
file_path: pkg/util/proxyutil/reverse_proxy.go
snippet: func wrapDirector(d func(*http.Request)) func(req *http.Request) {
	return func(req *http.Request) {
		d(req)
		PrepareProxyRequest(req)

		// Clear Origin and Referer to avoid CORS issues
		req.Header.Del("Origin")
		req.Header.Del("Referer")
	}
}

Fixed code:
file_path: pkg/util/proxyutil/reverse_proxy.go
snippet: func wrapDirector(d func(*http.Request)) func(req *http.Request) {
	return func(req *http.Request) {
		list := contexthandler.AuthHTTPHeaderListFromContext(req.Context())
		if list != nil {
			for _, name := range list.Items {
				req.Header.Del(name)
			}
		}

		d(req)
		PrepareProxyRequest(req)

		// Clear Origin and Referer to avoid CORS issues
		req.Header.Del("Origin")
		req.Header.Del("Referer")
	}
}
CVE-2018-3785 (JavaScript)

A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.

Weakness:
CWE-78: name: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Repository: https://github.com/stevemao/git-dummy-commit

Vulnerable code:
file_path: index.js
snippet: module.exports = function (msg, silent) {
	var arg = '';

	msg = makeDefault(msg);

	if (silent === undefined) {
		silent = true;
	}

	if (Array.isArray(msg)) {
		if (msg.length) {
			msg.forEach(function (m) {
				m = makeDefault(m);

				arg += '-m"' + m + '" ';
			});
		} else {
			arg = '-m"' + defaultMsg + '"';
		}
	} else {
		arg = '-m"' + msg + '"';
	}

	shell.exec('git commit ' + arg + ' --allow-empty --no-gpg-sign', {
		silent: silent
	});
};

Fixed code:
file_path: index.js
snippet: module.exports = function (msg, silent) {
	var args = [];

	msg = makeDefault(msg);

	if (silent === undefined) {
		silent = true;
	}

	if (Array.isArray(msg)) {
		if (msg.length) {
			msg.forEach(function (m) {
				m = makeDefault(m);

				args = [].concat(args, ['-m', m]);
			});
		} else {
			args = ['-m', defaultMsg];
		}
	} else {
		args = ['-m', msg];
	}

	execa.sync('git', ['commit', ...args, '--allow-empty', '--no-gpg-sign']);
};
CVE-2021-23387 (JavaScript)

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::createTrailing(), as the web server uses relative URLs instead of absolute URLs.

Weakness:
CWE-601: name: URL Redirection to Untrusted Site ('Open Redirect')
description: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Repository: https://github.com/fardog/trailing-slash

Vulnerable code:
file_path: index.js
snippet: function createTrailing (_options, _next) {
  var next = typeof _options === 'function' ? _options : _next
  var options = typeof _options === 'object' ? _options : {}
  var status = options.status || 302
  var slash = typeof options.slash === 'undefined' ? true : options.slash
  var middleware = !next

  return function trailingSlash () {
    var args = Array.prototype.slice.call(arguments)
    var done = middleware ? args.slice(-1)[0] : next

    var req = args[0]
    var res = args[1]
    var url = u.parse(req.url)
    var length = url.pathname.length
    var hasSlash = url.pathname.charAt(length - 1) === '/'

    if (hasSlash === slash) {
      if (middleware) {
        return done()
      }
      return next.apply(null, args)
    }

    if (slash) {
      url.pathname = url.pathname + '/'
    } else {
      url.pathname = url.pathname.slice(0, -1)
    }

    res.statusCode = status
    res.setHeader('Location', u.format(url))
    res.end()
  }
}

Fixed code:
file_path: index.js
snippet: function createTrailing (_options, _next) {
  var next = typeof _options === 'function' ? _options : _next
  var options = typeof _options === 'object' ? _options : {}
  var status = options.status || 302
  var slash = typeof options.slash === 'undefined' ? true : options.slash
  var middleware = !next

  return function trailingSlash () {
    var args = Array.prototype.slice.call(arguments)
    var done = middleware ? args.slice(-1)[0] : next

    var req = args[0]
    var res = args[1]
    var url = u.parse(req.url)
    var length = url.pathname.length
    var hasSlash = url.pathname.charAt(length - 1) === '/'

    if (hasSlash === slash) {
      if (middleware) {
        return done()
      }
      return next.apply(null, args)
    }

    if (slash) {
      url.pathname = url.pathname + '/'
    } else {
      url.pathname = url.pathname.slice(0, -1)
    }

    res.statusCode = status
    res.setHeader('Location', escapeLeadingSlashes(u.format(url)))
    res.end()
  }
}

file_path: index.js
snippet: function escapeLeadingSlashes (url) {
  if (url.slice(0, 2) === '//') {
    return '/%2F' + url.slice(2)
  }
  return url
}
CVE-2023-41891 (Go)

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.

Weakness:
CWE-89: name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Repository: https://github.com/flyteorg/flyteadmin

Vulnerable code:
file_path: pkg/common/sorting.go
snippet: func NewSortParameter(sort admin.Sort) (SortParameter, error) {
	var gormOrderExpression string
	switch sort.Direction {
	case admin.Sort_DESCENDING:
		gormOrderExpression = fmt.Sprintf(gormDescending, sort.Key)
	case admin.Sort_ASCENDING:
		gormOrderExpression = fmt.Sprintf(gormAscending, sort.Key)
	default:
		return nil, errors.NewFlyteAdminErrorf(codes.InvalidArgument, "invalid sort order specified: %v", sort)
	}
	return &sortParamImpl{
		gormOrderExpression: gormOrderExpression,
	}, nil
}

Fixed code:
file_path: pkg/common/sorting.go
snippet: func NewSortParameter(sort *admin.Sort, allowed sets.String) (SortParameter, error) {
	if sort == nil {
		return nil, nil
	}

	key := sort.Key
	if !allowed.Has(key) {
		return nil, errors.NewFlyteAdminErrorf(codes.InvalidArgument, "invalid sort key '%s'", key)
	}

	var gormOrderExpression string
	switch sort.Direction {
	case admin.Sort_DESCENDING:
		gormOrderExpression = fmt.Sprintf(gormDescending, key)
	case admin.Sort_ASCENDING:
		gormOrderExpression = fmt.Sprintf(gormAscending, key)
	default:
		return nil, errors.NewFlyteAdminErrorf(codes.InvalidArgument, "invalid sort order specified: %v", sort)
	}
	return &sortParamImpl{
		gormOrderExpression: gormOrderExpression,
	}, nil
}