Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-3963: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fm_id leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.5.8.2.1 is able to address this issue. The name of the patch is ba062ca5b62809106d5a2f7df942ffcb44ecb5a9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213540.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-11-12T22:15Z
Repository: https://github.com/gnuboard/gnuboard5
Language: PHP
Files changed: bbs/faq.php
Commit date: 2022-09-01 16:08:08 +0900
Commit message: [KVE-2022-0981] 그누보드 Reflected XSS 취약점

Diff: diff --git a/bbs/faq.php b/bbs/faq.php
index d34da00f2..39774f07d 100644
--- a/bbs/faq.php
+++ b/bbs/faq.php
@@ -16,10 +16,11 @@ while ($row=sql_fetch_array($result))
     if (!isset($fm_id)) $fm_id = $key;
     $faq_master_list[$key] = $row;
 }
 
 if (isset($fm_id) && $fm_id){
+    $fm_id = (int) $fm_id;
     $qstr .= '&amp;fm_id=' . $fm_id; // 마스터faq key_id
 }
 
 $fm = $faq_master_list[$fm_id];
 if (!$fm['fm_id'])

Fixed code:     $fm_id = (int) $fm_id;
CVE-2021-43805: Inefficient Regular Expression Complexity (CWE-1333)
value: Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like `a.a.` Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression. The maintainers added a check for email addresses that are no longer valid that will print information about any affected orders that exist. If a prompt upgrade is not an option, a workaround is available. It is possible to edit the file `config/application.rb` manually (with code provided by the maintainers in the GitHub Security Advisory) to check email validity.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2021-12-07T18:15Z
Repository: https://github.com/solidusio/solidus
Language: Unknown
Commit date: 2021-12-07 10:40:00 +0100
Commit message: Merge pull request from GHSA-qxmr-qxh6-2cc9

Fix ReDos vulnerability on Spree::EmailValidator::EMAIL_REGEXP
CVE-2021-43846: Cross-Site Request Forgery (CSRF) (CWE-352)
value: `solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2021-12-20T22:15Z
Repository: https://github.com/solidusio/solidus
Language: Unknown
Commit date: 2021-12-20 09:25:33 +0100
Commit message: Merge pull request from GHSA-h3fg-h5v3-vf8m

Protect `Spree::OrdersController#populate` against CSRF attacks
CVE-2022-31000: Cross-Site Request Forgery (CSRF) (CWE-352)
value: solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2022-06-01T18:15Z
Repository: https://github.com/solidusio/solidus
Language: Unknown
Commit date: 2022-06-01 11:14:05 +0200
Commit message: Merge pull request from GHSA-8639-qx56-r428

Fix CSRF vulnerability that allowed (un)finalizing adjustments
CVE-2020-15164: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 10
Published: 2020-08-28T17:15Z
Repository: https://github.com/InternationalScratchWiki/mediawiki-scratch-login
Language: PHP
Files changed: ScratchLogin.common.php
Commit date: 2020-08-29 00:04:19 +0800
Commit message: Disallow MW-invalid usernames from being picked
Diff: diff --git a/ScratchLogin.common.php b/ScratchLogin.common.php
index 67d3c15..b746039 100644
--- a/ScratchLogin.common.php
+++ b/ScratchLogin.common.php
@@ -35,10 +35,11 @@ function verifComments() {
 
 function topVerifCommenter($req_comment) {
 	$comments = verifComments();
 
 	$matching_comments = array_filter($comments, function(&$comment) use($req_comment) {
+		if (preg_match('/^_+|_+$|__+/', $comment['author']['username'])) return false;
 		return stristr($comment['content'], $req_comment);
 	});
 	if (empty($matching_comments)) {
 		return null;
 	}
@@ -142,6 +143,6 @@ class ScratchSpecialPage extends SpecialPage {
 	// reset the code associated with the current user's session
 	function doCodeReset($out, $request, $returnto) {
 		generateNewCodeForSession($request->getSession());
 		$out->addWikiMsg('scratchlogin-code-reset', $returnto);
 	}
-}
\ No newline at end of file
+}

Vulnerable code: }
Fixed code: 		if (preg_match('/^_+|_+$|__+/', $comment['author']['username'])) return false;
}
CVE-2020-36647: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh. Affected is an unknown function of the file conf/nginx.conf. The manipulation leads to path traversal. The patch is identified as f136dfd44eda128129e5fd2d850a3a3c600e6a4a. It is recommended to apply a patch to fix this issue. VDB-217638 is the identifier assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2023-01-08T10:15Z
Repository: https://github.com/YunoHost-Apps/transmission_ynh
Language: Other
Files changed: conf/nginx.conf
Commit date: 2020-10-25 11:49:27 +0100
Commit message: Update nginx.conf to protect against path traversal issue
Diff: diff --git a/conf/nginx.conf b/conf/nginx.conf
index caacf71..da17188 100644
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -10,11 +10,11 @@ location __PATH__/transmission {
 
 location __PATH__/ {
     proxy_pass http://127.0.0.1:__PORT__/;
 }
 
-location __PATH__/downloads {
+location __PATH__/downloads/ {
     alias /home/yunohost.transmission/completed/;
     autoindex on;
     autoindex_exact_size off;
 
     # Include SSOWAT user panel.

Vulnerable code: location __PATH__/downloads {
Fixed code: location __PATH__/downloads/ {
CVE-2014-4734: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-07-21T14:55Z
Repository: https://github.com/e107inc/e107
Language: PHP
Files changed: e107_admin/db.php
Commit date: 2014-06-27 20:54:47 +0300
Commit message: Sanitize some request variables

Diff: diff --git a/e107_admin/db.php b/e107_admin/db.php
index f3440b9b..1c76ef17 100644
--- a/e107_admin/db.php
+++ b/e107_admin/db.php
@@ -33,10 +33,20 @@ include_lan(e_LANGUAGEDIR.e_LANGUAGE.'/admin/lan_'.e_PAGE);
 $e_sub_cat = 'database';
 
 $frm = e107::getForm();
 $mes = e107::getMessage();
 
+if(isset($_GET['mode']))
+{
+    $_GET['mode'] = preg_match('/[^\w-]/', '', $_GET['mode']);
+}
+
+if(isset($_GET['type']))
+{
+    $_GET['type'] = preg_replace('/[^\w-]/', '', $_GET['type']);
+}
+
 /*
  * Execute trigger
  */
 if(isset($_POST['db_execute']))
 {

Fixed code: if(isset($_GET['mode']))
{
    $_GET['mode'] = preg_match('/[^\w-]/', '', $_GET['mode']);
}

if(isset($_GET['type']))
{
    $_GET['type'] = preg_replace('/[^\w-]/', '', $_GET['type']);
}
CVE-2018-16388: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.2
Published: 2018-09-12T16:29Z
Repository: https://github.com/e107inc/e107
Language: PHP
Files changed: e107_web/js/plupload/upload.php
Commit date: 2018-08-10 14:25:08 -0700
Commit message: plupload fix.

Diff: diff --git a/e107_web/js/plupload/upload.php b/e107_web/js/plupload/upload.php
index 3802fdfb18..12c33646a5 100644
--- a/e107_web/js/plupload/upload.php
+++ b/e107_web/js/plupload/upload.php
@@ -44,17 +44,13 @@
 // Get parameters
 	$chunk = isset($_REQUEST["chunk"]) ? intval($_REQUEST["chunk"]) : 0;
 	$chunks = isset($_REQUEST["chunks"]) ? intval($_REQUEST["chunks"]) : 0;
 	$fileName = isset($_REQUEST["name"]) ? $_REQUEST["name"] : '';
 
-
-
 // Clean the fileName for security reasons
 	$fileName = preg_replace('/[^\w\._]+/', '_', $fileName);
 
-	$fileName= 'hello.jpg';
-
 	if(!empty($_FILES['file']['name'])) // dropzone support v2.1.9
 	{
 		$fileName = $_FILES['file']['name'];
 	}
 
@@ -193,10 +189,18 @@
 		rename("{$filePath}.part", $filePath);
 	}
 
 	$filePath = str_replace('//','/',$filePath); // cleanup .
 
+
+	if(e107::getFile()->isClean($filePath) !== true)
+	{
+		@unlink($filePath);
+		die('{"jsonrpc" : "2.0", "error" : {"code": 103, "message": "Bad File Detected."}, "id" : "id"}');
+	}
+
+
 	$convertToJpeg = e107::getPref('convert_to_jpeg', 0);
 	$fileSize = filesize($filePath);
 
 	if(varset($_GET['for']) !== '_icon' && !empty($convertToJpeg))
 	{
@@ -207,10 +211,13 @@
 			$fileSize = filesize($jpegFile);
 		}
 
 	}
 
+
+
+
 	if($_GET['for'] != '') // leave in upload directory if no category given.
 	{
 		$uploadPath = varset($_GET['path'],null);
 		$result = e107::getMedia()->importFile($fileName, $_GET['for'], array('path'=>$uploadPath));
 	}

Vulnerable code: 

	$fileName= 'hello.jpg';

Fixed code: 
	if(e107::getFile()->isClean($filePath) !== true)
	{
		@unlink($filePath);
		die('{"jsonrpc" : "2.0", "error" : {"code": 103, "message": "Bad File Detected."}, "id" : "id"}');
	}
CVE-2021-41556: Out-of-bounds Read (CWE-125)
value: sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 10
Published: 2022-07-28T21:15Z
Repository: https://github.com/albertodemichelis/squirrel
Language: C++
Files changed: squirrel/sqclass.cpp, squirrel/sqclass.h
Commit date: 2021-09-16 22:36:53 +0800
Commit message: check max member count in class

Diff: diff --git a/squirrel/sqclass.cpp b/squirrel/sqclass.cpp
index fc61961..53a2976 100644
--- a/squirrel/sqclass.cpp
+++ b/squirrel/sqclass.cpp
@@ -59,10 +59,13 @@ bool SQClass::NewSlot(SQSharedState *ss,const SQObjectPtr &key,const SQObjectPtr
     if(_members->Get(key,temp) && _isfield(temp)) //overrides the default value
     {
         _defaultvalues[_member_idx(temp)].val = val;
         return true;
     }
+	if (_members->CountUsed() >= MEMBER_MAX_COUNT) {
+		return false;
+	}
     if(belongs_to_static_table) {
         SQInteger mmidx;
         if((sq_type(val) == OT_CLOSURE || sq_type(val) == OT_NATIVECLOSURE) &&
             (mmidx = ss->GetMetaMethodIdxByName(key)) != -1) {
             _metamethods[mmidx] = val;
diff --git a/squirrel/sqclass.h b/squirrel/sqclass.h
index 7d40217..60d3d21 100644
--- a/squirrel/sqclass.h
+++ b/squirrel/sqclass.h
@@ -15,10 +15,11 @@ struct SQClassMember {
 
 typedef sqvector<SQClassMember> SQClassMemberVec;
 
 #define MEMBER_TYPE_METHOD 0x01000000
 #define MEMBER_TYPE_FIELD 0x02000000
+#define MEMBER_MAX_COUNT 0x00FFFFFF
 
 #define _ismethod(o) (_integer(o)&MEMBER_TYPE_METHOD)
 #define _isfield(o) (_integer(o)&MEMBER_TYPE_FIELD)
 #define _make_method_idx(i) ((SQInteger)(MEMBER_TYPE_METHOD|i))
 #define _make_field_idx(i) ((SQInteger)(MEMBER_TYPE_FIELD|i))

Fixed code: 	if (_members->CountUsed() >= MEMBER_MAX_COUNT) {
		return false;
	}
#define MEMBER_MAX_COUNT 0x00FFFFFF
CVE-2022-30292: Out-of-bounds Write (CWE-787)
value: Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 10
Published: 2022-05-04T23:15Z
Repository: https://github.com/albertodemichelis/squirrel
Language: C++
Files changed: squirrel/sqbaselib.cpp
Commit date: 2022-05-02 12:04:58 +0200
Commit message: fix in thread.call

Diff: diff --git a/squirrel/sqbaselib.cpp b/squirrel/sqbaselib.cpp
index 8eff97c..5055f18 100644
--- a/squirrel/sqbaselib.cpp
+++ b/squirrel/sqbaselib.cpp
@@ -1147,10 +1147,11 @@ const SQRegFunction SQSharedState::_generator_default_delegate_funcz[]={
 static SQInteger thread_call(HSQUIRRELVM v)
 {
     SQObjectPtr o = stack_get(v,1);
     if(sq_type(o) == OT_THREAD) {
         SQInteger nparams = sq_gettop(v);
+        sq_reservestack(_thread(o), nparams + 3);
         _thread(o)->Push(_thread(o)->_roottable);
         for(SQInteger i = 2; i<(nparams+1); i++)
             sq_move(_thread(o),v,i);
         if(SQ_SUCCEEDED(sq_call(_thread(o),nparams,SQTrue,SQTrue))) {
             sq_move(v,_thread(o),-1);

Fixed code:         sq_reservestack(_thread(o), nparams + 3);
CVE-2022-23472: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)
value: Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CVSS v3 base score: 7.5
Published: 2022-12-06T18:15Z
Repository: https://github.com/ArjunSharda/Passeo
Language: Unknown
Commit date: 2022-12-06 10:31:19 -0600
Commit message: Merge pull request #4 from ArjunSharda/randomlibcriticalpatch

Security patch + quickgen command
CVE-2021-29621: Observable Discrepancy (CWE-203)
value: Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.3
Published: 2021-06-07T19:15Z
Repository: https://github.com/dpgaspar/Flask-AppBuilder
Language: Python
Files changed: flask_appbuilder/security/manager.py
Commit date: 2021-05-10 09:37:55 +0100
Commit message: fix: auth balance (#1634)


Diff: diff --git a/flask_appbuilder/security/manager.py b/flask_appbuilder/security/manager.py
index f837e5c4..7154dc50 100644
--- a/flask_appbuilder/security/manager.py
+++ b/flask_appbuilder/security/manager.py
@@ -831,10 +831,16 @@ class BaseSecurityManager(AbstractSecurityManager):
             return None
         user = self.find_user(username=username)
         if user is None:
             user = self.find_user(email=username)
         if user is None or (not user.is_active):
+            # Balance failure and success
+            check_password_hash(
+                "pbkdf2:sha256:150000$Z3t6fmj2$22da622d94a1f8118"
+                "c0976a03d2f18f680bfff877c9a965db9eedc51bc0be87c",
+                "password",
+            )
             log.info(LOGMSG_WAR_SEC_LOGIN_FAILED.format(username))
             return None
         elif check_password_hash(user.password, password):
             self.update_user_auth_stat(user, True)
             return user

Fixed code:             # Balance failure and success
            check_password_hash(
                "pbkdf2:sha256:150000$Z3t6fmj2$22da622d94a1f8118"
                "c0976a03d2f18f680bfff877c9a965db9eedc51bc0be87c",
                "password",
            )
CVE-2024-27083: Insufficient Information (NVD-CWE-noinfo)
value: Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-29T01:44Z
Repository: https://github.com/dpgaspar/Flask-AppBuilder
Language: HTML
Files changed: flask_appbuilder/templates/appbuilder/general/security/login_oauth.html
Commit date: 2023-02-01 09:48:29 +0000
Commit message: fix: Make sure user input is not treated as safe in the oauth view (#1978)

Co-authored-by: Glenn Schuurman <glenn.schuurman@rabobank.nl>
Co-authored-by: Daniel Vaz Gaspar <danielvazgaspar@gmail.com>
Diff: diff --git a/flask_appbuilder/templates/appbuilder/general/security/login_oauth.html b/flask_appbuilder/templates/appbuilder/general/security/login_oauth.html
index 50adf0a3a..14501ddde 100644
--- a/flask_appbuilder/templates/appbuilder/general/security/login_oauth.html
+++ b/flask_appbuilder/templates/appbuilder/general/security/login_oauth.html
@@ -4,11 +4,11 @@
 {% block content %}
 
 <script type="text/javascript">
     var baseLoginUrl = "{{appbuilder.get_url_for_login}}";
     var baseRegisterUrl = "{{appbuilder.get_url_for_login}}";
-    var next = "?next=" + encodeURIComponent("{{request.args.get('next', '') | safe}}");
+    var next = "?next=" + encodeURIComponent("{{request.args.get('next', '')}}");
 
     function signin(provider) {
         window.location.href = baseLoginUrl + provider + next;
     }
 </script>

Vulnerable code:     var next = "?next=" + encodeURIComponent("{{request.args.get('next', '') | safe}}");
Fixed code:     var next = "?next=" + encodeURIComponent("{{request.args.get('next', '')}}");
CVE-2021-41166: Incorrect Default Permissions (CWE-276)
value: The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 5.3
Published: 2022-01-26T23:15Z
Repository: https://github.com/nextcloud/android
Language: Unknown
Commit date: 2021-10-20 10:00:03 +0200
Commit message: Merge pull request from GHSA-wff9-w6wc-h67g

Fix GHSL-2021-1008 by using permission instead of readPermission
CVE-2021-41166: Incorrect Default Permissions (CWE-276)
value: The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 5.3
Published: 2022-01-26T23:15Z
Repository: https://github.com/nextcloud/android
Language: XML
Files changed: src/main/AndroidManifest.xml
Commit date: 2021-10-20 09:56:18 +0200
Commit message: Fix GHSL-2021-1008 by using permission instead of readPermission

Signed-off-by: tobiasKaminsky <tobias@kaminsky.me>

Diff: diff --git a/src/main/AndroidManifest.xml b/src/main/AndroidManifest.xml
index 32697dea4..fdf673f44 100644
--- a/src/main/AndroidManifest.xml
+++ b/src/main/AndroidManifest.xml
@@ -304,13 +304,14 @@
         </provider>
 
         <provider
             android:name=".providers.DiskLruImageCacheFileProvider"
             android:authorities="@string/image_cache_provider_authority"
-            android:exported="true"
             android:grantUriPermissions="true"
-            android:readPermission="android.permission.MANAGE_DOCUMENTS" />
+            android:permission="android.permission.MANAGE_DOCUMENTS"
+            android:exported="true">
+        </provider>
 
         <!-- Disable WorkManager initialization. Whoever designed this, should pay closer attention -->
         <!-- to "best before" dates in his fridge. -->
         <provider
             android:name="androidx.work.impl.WorkManagerInitializer"

Vulnerable code:             android:exported="true"
            android:readPermission="android.permission.MANAGE_DOCUMENTS" />
Fixed code:             android:permission="android.permission.MANAGE_DOCUMENTS"
            android:exported="true">
        </provider>
CVE-2017-20152: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability, which was classified as problematic, was found in aerouk imageserve. Affected is an unknown function of the file public/viewer.php of the component File Handler. The manipulation of the argument filelocation leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is bd23c784f0e5cb12f66d15c100248449f87d72e2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217056.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-12-30T12:15Z
Repository: https://github.com/aerouk/imageserve
Language: PHP
Files changed: public/viewer.php
Commit date: 2017-03-01 03:26:57 +0100
Commit message: Fix path traversal exploit

Using path travel and viewer.php you can get files like the config file.
[url]/viewer.php?type=png&file=../png/../png/../png/jAfQv
Diff: diff --git a/public/viewer.php b/public/viewer.php
index c697dd7..d4e9625 100644
--- a/public/viewer.php
+++ b/public/viewer.php
@@ -19,11 +19,11 @@ if ($index) {
 $type = $_GET['type'];
 $file = $_GET['file'];
 
 $filelocation = __DIR__ . "/images/$type/$file.$type";
 
-if ( ! file_exists($filelocation)) {
+if ( ! file_exists(realpath($filelocation)) || ! array_key_exists($type, $types) ) {
     header('HTTP/1.0 404 Not Found');
     include_once __DIR__ . '/protected/templates/error.phtml';
     die();
 }
 

Vulnerable code: if ( ! file_exists($filelocation)) {
Fixed code: if ( ! file_exists(realpath($filelocation)) || ! array_key_exists($type, $types) ) {
CVE-2017-20153: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in aerouk imageserve and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument REQUEST_URI leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2ac3cd4f90b4df66874fab171376ca26868604c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217057 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-30T12:15Z
Repository: https://github.com/aerouk/imageserve
Language: Other
Files changed: public/protected/templates/viewer.phtml
Commit date: 2017-03-01 03:19:53 +0100
Commit message: Fixed XSS

REQUEST_URI is not parsed by PHP - only by new browsers.
Can be used for XSS with curl or for example file get contents.
[url]?x="><h1>Hi</h1>
Diff: diff --git a/public/protected/templates/viewer.phtml b/public/protected/templates/viewer.phtml
index 9378c8d..fc541c4 100644
--- a/public/protected/templates/viewer.phtml
+++ b/public/protected/templates/viewer.phtml
@@ -11,11 +11,11 @@
 <?php if (TWITTER_CARDS) { ?>
         <meta name="twitter:card" content="photo" />
         <meta name="twitter:site" content="<?php echo TWITTER_HANDLE; ?>" />
         <meta name="twitter:title" content="<?php echo $file . '.' . $type; ?>" />
         <meta name="twitter:image" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . $imgurl; ?>" />
-        <meta name="twitter:url" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']; ?>" />
+        <meta name="twitter:url" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . htmlspecialchars($_SERVER['REQUEST_URI']); ?>" />
 <?php } ?>
     </head>
 
     <body>
         <h1>

Vulnerable code:         <meta name="twitter:url" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']; ?>" />
Fixed code:         <meta name="twitter:url" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . htmlspecialchars($_SERVER['REQUEST_URI']); ?>" />
CVE-2024-34359: Insufficient Information (NVD-CWE-noinfo)
value: llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several parameters to configure the loading and running of the model. Other than `NUMA, LoRa settings`, `loading tokenizers,` and `hardware settings`, `__init__` also loads the `chat template` from targeted `.gguf` 's Metadata and furtherly parses it to `llama_chat_format.Jinja2ChatFormatter.to_chat_handler()` to construct the `self.chat_handler` for this model. Nevertheless, `Jinja2ChatFormatter` parse the `chat template` within the Metadate with sandbox-less `jinja2.Environment`, which is furthermore rendered in `__call__` to construct the `prompt` of interaction. This allows `jinja2` Server Side Template Injection which leads to remote code execution by a carefully constructed payload.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:38Z
Repository: https://github.com/abetlen/llama-cpp-python
Language: Python
Files changed: llama_cpp/llama_chat_format.py
Commit date: 2024-05-10 00:47:56 -0400
Commit message: Merge pull request from GHSA-56xg-wfcc-g829

Co-authored-by: Andrei <abetlen@gmail.com>
Diff: diff --git a/llama_cpp/llama_chat_format.py b/llama_cpp/llama_chat_format.py
index 84de989..e0c59c9 100644
--- a/llama_cpp/llama_chat_format.py
+++ b/llama_cpp/llama_chat_format.py
@@ -9,10 +9,11 @@ import string
 
 from contextlib import ExitStack
 from typing import Any, Dict, Iterator, List, Literal, Optional, Tuple, Union, Protocol, cast
 
 import jinja2
+from jinja2.sandbox import ImmutableSandboxedEnvironment
 
 import numpy as np
 import numpy.typing as npt
 
 import llama_cpp.llama as llama
@@ -189,11 +190,11 @@ class Jinja2ChatFormatter(ChatFormatter):
         self.eos_token = eos_token
         self.bos_token = bos_token
         self.add_generation_prompt = add_generation_prompt
         self.stop_token_ids = set(stop_token_ids) if stop_token_ids is not None else None
 
-        self._environment = jinja2.Environment(
+        self._environment = ImmutableSandboxedEnvironment(
             loader=jinja2.BaseLoader(),
             trim_blocks=True,
             lstrip_blocks=True,
         ).from_string(self.template)
 

Vulnerable code:         self._environment = jinja2.Environment(
Fixed code: from jinja2.sandbox import ImmutableSandboxedEnvironment
        self._environment = ImmutableSandboxedEnvironment(
CVE-2014-8122: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
value: Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.
CWE description: The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Published: 2015-02-13T15:59Z
Repository: https://github.com/weld/core
Language: Java
Files changed: impl/src/main/java/org/jboss/weld/context/cache/RequestScopedCache.java
Commit date: 2014-12-04 11:17:00 +0100
Commit message: WELD-1802 RequestScopedCache - Make sure each request is ended before a new one is started

Diff: diff --git a/impl/src/main/java/org/jboss/weld/context/cache/RequestScopedCache.java b/impl/src/main/java/org/jboss/weld/context/cache/RequestScopedCache.java
index 27d6664f2..3eae118ab 100644
--- a/impl/src/main/java/org/jboss/weld/context/cache/RequestScopedCache.java
+++ b/impl/src/main/java/org/jboss/weld/context/cache/RequestScopedCache.java
@@ -69,21 +69,23 @@ public class RequestScopedCache {
         }
         return false;
     }
 
     public static void beginRequest() {
+        // if the previous request was not ended properly for some reason, make sure it is ended now
+        endRequest();
         CACHE.set(new LinkedList<RequestScopedItem>());
     }
 
     /**
      * ends the request and clears the cache. This can be called before the request is over,
      * in which case the cache will be unavailable for the rest of the request.
      */
     public static void endRequest() {
         final List<RequestScopedItem> result = CACHE.get();
-        CACHE.remove();
         if (result != null) {
+            CACHE.remove();
             for (final RequestScopedItem item : result) {
                 item.invalidate();
             }
         }
     }

Vulnerable code:         CACHE.remove();
Fixed code:         // if the previous request was not ended properly for some reason, make sure it is ended now
        endRequest();
            CACHE.remove();
CVE-2022-40299: Use of Insufficiently Random Values (CWE-330)
value: In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have predictable /tmp pathnames; this CVE Record is not about the lack of a safe temporary-file creation capability in the Singular language.
CWE description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CVSS v3 base score: 7.8
Published: 2022-09-09T01:15Z
Repository: https://github.com/Singular/Singular
Language: C++
Files changed: Singular/sdb.cc
Commit date: 2022-05-24 11:02:32 +0200
Commit message: use mkstemp for sdb

Diff: diff --git a/Singular/sdb.cc b/Singular/sdb.cc
index 1f7199e89..cb2f61102 100644
--- a/Singular/sdb.cc
+++ b/Singular/sdb.cc
@@ -106,24 +106,23 @@ BOOLEAN sdb_set_breakpoint(const char *pp, int given_lineno)
   }
 }
 
 void sdb_edit(procinfo *pi)
 {
-  char * filename = omStrDup("/tmp/sd000000");
-  sprintf(filename+7,"%d",getpid());
-  FILE *fp=fopen(filename,"w");
-  if (fp==NULL)
+  char * filename = omStrDup("/tmp/sdXXXXXX");
+  int f=mkstemp(filename);
+  if (f==-1)
   {
     Print("cannot open %s\n",filename);
     omFree(filename);
     return;
   }
   if (pi->language!= LANG_SINGULAR)
   {
     Print("cannot edit type %d\n",pi->language);
-    fclose(fp);
-    fp=NULL;
+    close(f);
+    f=NULL;
   }
   else
   {
     const char *editor=getenv("EDITOR");
     if (editor==NULL)
@@ -136,19 +135,19 @@ void sdb_edit(procinfo *pi)
     {
       iiGetLibProcBuffer(pi);
       if (pi->data.s.body==NULL)
       {
         PrintS("cannot get the procedure body\n");
-        fclose(fp);
+        close(f);
         si_unlink(filename);
         omFree(filename);
         return;
       }
     }
 
-    fwrite(pi->data.s.body,1,strlen(pi->data.s.body),fp);
-    fclose(fp);
+    write(f,pi->data.s.body,strlen(pi->data.s.body));
+    close(f);
 
     int pid=fork();
     if (pid!=0)
     {
       si_wait(&pid);
@@ -171,11 +170,11 @@ void sdb_edit(procinfo *pi)
     else
     {
       PrintS("cannot fork\n");
     }
 
-    fp=fopen(filename,"r");
+    FILE* fp=fopen(filename,"r");
     if (fp==NULL)
     {
       Print("cannot read from %s\n",filename);
     }
     else

Vulnerable code:   char * filename = omStrDup("/tmp/sd000000");
  sprintf(filename+7,"%d",getpid());
  FILE *fp=fopen(filename,"w");
  if (fp==NULL)
    fclose(fp);
    fp=NULL;
        fclose(fp);
    fwrite(pi->data.s.body,1,strlen(pi->data.s.body),fp);
    fclose(fp);
    fp=fopen(filename,"r");
Fixed code:   char * filename = omStrDup("/tmp/sdXXXXXX");
  int f=mkstemp(filename);
  if (f==-1)
    close(f);
    f=NULL;
        close(f);
    write(f,pi->data.s.body,strlen(pi->data.s.body));
    close(f);
    FILE* fp=fopen(filename,"r");
CVE-2016-7115: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the handle_packet function in mactelnet.c in the client in MAC-Telnet 0.4.3 and earlier allows remote TELNET servers to execute arbitrary code via a long string in an MT_CPTYPE_PASSSALT control packet.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2016-08-30T17:59Z
Repository: https://github.com/haakonnessjoen/MAC-Telnet
Language: Unknown
Commit date: 2016-08-30 11:27:39 +0200
Commit message: Merge pull request #20 from eyalitki/master

2nd round security fixes from eyalitki
CVE-2015-10129: Incorrect Comparison (CWE-697)
value: A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 6ad38c58a45642eb8c7844e2f272ef199f59550d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-252716.
CWE description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CVSS v3 base score: 5.9
Published: 2024-02-04T05:15Z
Repository: https://github.com/samwilson/planet-freo
Language: PHP
Files changed: admin/inc/auth.inc.php
Commit date: 2015-08-03 18:51:51 +0200
Commit message: Avoid type juggling vulnerability.

Password comparison should not be done with the `==` operator, but
`===`, due to type juggling.

References:

* http://phpsadness.com/sad/47
*
turbochaos.blogspot.fr/2013/08/exploiting-exotic-bugs-php-type-juggling.
html

### Test case

* Create an administrator with the password "240610708".
* Try to login to the dashboard with the password "QNKCDZO" :-)

Diff: diff --git a/admin/inc/auth.inc.php b/admin/inc/auth.inc.php
index d21467b..8704737 100644
--- a/admin/inc/auth.inc.php
+++ b/admin/inc/auth.inc.php
@@ -1,11 +1,11 @@
 <?php
 include (dirname(__FILE__).'/pwd.inc.php');
 
-if ( isset($_COOKIE['auth']) && $_COOKIE['auth'] == $password ) {
+if ( isset($_COOKIE['auth']) && $_COOKIE['auth'] === $password ) {
     //ok, cool
 } else {
     setcookie('auth','', time()-3600);
     header('Location: login.php');
     die;
 }
-?>
\ No newline at end of file
+?>

Vulnerable code: if ( isset($_COOKIE['auth']) && $_COOKIE['auth'] == $password ) {
?>
Fixed code: if ( isset($_COOKIE['auth']) && $_COOKIE['auth'] === $password ) {
?>
CVE-2020-12607: Improper Verification of Cryptographic Signature (CWE-347)
value: An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 7.5
Published: 2020-06-02T21:15Z
Repository: https://github.com/AntonKueltz/fastecdsa
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2020-04-14 02:52:44 -0700
Commit message: Update CHANGELOG.md
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index c464656..78e5997 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,10 @@
 # Changelog
 
 ## [2.1.2]
 ### Fixed
-- Point at infinity handling in C extensions
+- Point at infinity handling in C extensions (issue #52)
 - DER signature decoding that assumed length was always encoded in one byte
 
 ## [2.1.1]
 ### Fixed
 - RFC6979 nonce generation for signatures on pre-hashed messages (issue #46)
@@ -26,6 +26,6 @@
 - Support for python2.x
 - Support for python3.4 and older
 - Various unused imports
 
 ### Fixed
-- Issue with benchmark script when C extensions weren't built in place (issue #44)
\ No newline at end of file
+- Issue with benchmark script when C extensions weren't built in place (issue #44)

Vulnerable code: - Point at infinity handling in C extensions
- Issue with benchmark script when C extensions weren't built in place (issue #44)
Fixed code: - Point at infinity handling in C extensions (issue #52)
- Issue with benchmark script when C extensions weren't built in place (issue #44)
CVE-2020-12607: Improper Verification of Cryptographic Signature (CWE-347)
value: An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 7.5
Published: 2020-06-02T21:15Z
Repository: https://github.com/AntonKueltz/fastecdsa
Language: Python
Files changed: docs/conf.py
Commit date: 2020-04-14 02:45:48 -0700
Commit message: Update docs to v2.1.2

Diff: diff --git a/docs/conf.py b/docs/conf.py
index c0ed824..7f9a0cf 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -62,11 +62,11 @@ author = 'Anton Kueltz'
 # built documents.
 #
 # The short X.Y version.
 version = '2.1'
 # The full version, including alpha/beta/rc tags.
-release = '2.1.1'
+release = '2.1.2'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
 #
 # This is also used if you do content translation via gettext catalogs.

Vulnerable code: release = '2.1.1'
Fixed code: release = '2.1.2'
CVE-2024-21502: Insufficient Information (NVD-CWE-noinfo)
value: Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-24T05:15Z
Repository: https://github.com/AntonKueltz/fastecdsa
Language: Other
Files changed: pyproject.toml, src/curveMath.c
Commit date: 2024-02-22 11:26:28 -0800
Commit message: fix memory corruption issue

see https://gist.github.com/keltecc/49da037072276f21b005a8337c15db26
for details on the issue

verified by running proof of concept against fix -
> python poc.py
3.11.0 (main, Nov 24 2022, 13:13:19) [Clang 13.1.6 (clang-1316.0.21.2.5)]
X: 0x0
Y: 0x0
(On curve <MyCurve>)
<POINT AT INFINITY>

Diff: diff --git a/pyproject.toml b/pyproject.toml
index f664bff..2a6a391 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,10 +17,11 @@ classifiers = [
     "Programming Language :: Python :: 3.7",
     "Programming Language :: Python :: 3.8",
     "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
     "Operating System :: MacOS :: MacOS X",
     "Operating System :: POSIX :: Linux"
 ]
 
 [project.urls]
diff --git a/src/curveMath.c b/src/curveMath.c
index 33608a6..65f4ff2 100644
--- a/src/curveMath.c
+++ b/src/curveMath.c
@@ -213,10 +213,11 @@ static PyObject * curvemath_mul(PyObject *self, PyObject *args) {
     if (!PyArg_ParseTuple(args, "sssssssss", &x, &y, &d, &p, &a, &b, &q, &gx, &gy)) {
         return NULL;
     }
 
     PointZZ_p result;
+    mpz_inits(result.x, result.y, NULL);
     mpz_t scalar;
     mpz_init_set_str(scalar, d, 10);
     CurveZZ_p * curve = buildCurveZZ_p(p, a, b, q, gx, gy, 10);;
 
     PointZZ_p * point = buildPointZZ_p(x, y, 10);

Fixed code:     "Programming Language :: Python :: 3.12",
    mpz_inits(result.x, result.y, NULL);
CVE-2021-39197: Cross-Site Request Forgery (CSRF) (CWE-352)
value: better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks. As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent). Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3". There are no known workarounds to mitigate the risk of using older releases of better_errors.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2021-09-07T18:15Z
Repository: https://github.com/BetterErrors/better_errors
Language: Unknown
Commit date: 2020-09-15 13:18:15 -0400
Commit message: Merge pull request #474 from BetterErrors/feature/add-csrf-to-requests

Add CSRF protection to internal requests