Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-24474: Insufficient Information (NVD-CWE-noinfo)
value: QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-20T18:15Z
Repository: https://github.com/qemu/qemu
Language: C
Files changed: hw/scsi/esp.c
Commit date: 2023-10-03 10:29:39 +0200
Commit message: esp: restrict non-DMA transfer length to that of available data

In the case where a SCSI layer transfer is incorrectly terminated, it is
possible for a TI command to cause a SCSI buffer overflow due to the
expected transfer data length being less than the available data in the
FIFO. When this occurs the unsigned async_len variable underflows and
becomes a large offset which writes past the end of the allocated SCSI
buffer.

Restrict the non-DMA transfer length to be the smallest of the expected
transfer length and the available FIFO data to ensure that it is no longer
possible for the SCSI buffer overflow to occur.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1810
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230913204410.65650-3-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Diff: diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 4218a6a96054..9b11d8c5738a 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -757,11 +757,12 @@ static void esp_do_nodma(ESPState *s)
         /* Defer until data is available.  */
         return;
     }
 
     if (to_device) {
-        len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
+        len = MIN(s->async_len, ESP_FIFO_SZ);
+        len = MIN(len, fifo8_num_used(&s->fifo));
         esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
         s->async_buf += len;
         s->async_len -= len;
         s->ti_size += len;
     } else {

Vulnerable code:         len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
Fixed code:         len = MIN(s->async_len, ESP_FIFO_SZ);
        len = MIN(len, fifo8_num_used(&s->fifo));
CVE-2023-26113: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. 
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 7.5
Published: 2023-03-18T05:15Z
Repository: https://github.com/kobezzza/Collection
Language: JavaScript
Files changed: src/iterators/extend.js
Commit date: 2023-03-10 17:06:32 +0300
Commit message: fix: fixed prototype pollution issue

Diff: diff --git a/src/iterators/extend.js b/src/iterators/extend.js
index a3433f9..cf9c380 100644
--- a/src/iterators/extend.js
+++ b/src/iterators/extend.js
@@ -216,10 +216,14 @@ Collection.prototype.extend = function (deepOrParams, args) {
 
 		const
 			isSimple = simpleType[getType(arg)];
 
 		promise = promise.then(() => $C(arg).forEach((el, key) => {
+			if (key === '__proto__') {
+				return;
+			}
+
 			if (dataIsSimple && isSimple && (withDescriptor || p.withAccessors && (el.get || el.set))) {
 				if (p.traits && key in data !== (p.traits === -1)) {
 					return;
 				}
 

Fixed code: 			if (key === '__proto__') {
				return;
			}
CVE-2018-14857: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server through 2.5 allows a privileged user to gain access to the server via a template file containing PHP code, because file extensions other than .html are permitted.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2018-08-06T21:29Z
Repository: https://github.com/OCSInventory-NG/OCSInventory-ocsreports
Language: Unknown
Commit date: 2018-08-02 15:58:38 +0200
Commit message: Merge pull request #525 from OCSInventory-NG/notification-improvement

Notification improvement
CVE-2020-14947: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2020-06-30T21:15Z
Repository: https://github.com/OCSInventory-NG/OCSInventory-ocsreports
Language: PHP
Files changed: require/commandLine/CommandLine.php
Commit date: 2020-07-08 08:52:09 +0000
Commit message: Fix CVE-2020-14947

Diff: diff --git a/require/commandLine/CommandLine.php b/require/commandLine/CommandLine.php
index 0124b3e1..57e4f9f4 100644
--- a/require/commandLine/CommandLine.php
+++ b/require/commandLine/CommandLine.php
@@ -30,11 +30,11 @@ class CommandLine
         $oids = [];
 
         $champs = array('SNMP_MIB_DIRECTORY' => 'SNMP_MIB_DIRECTORY');
         $values = look_config_default_values($champs);
         $cmd = "snmptranslate -Tz -m ".$values['tvalue']['SNMP_MIB_DIRECTORY']."/".$file;
-        $result_cmd = shell_exec($cmd);
+        $result_cmd = shell_exec(escapeshellcmd($cmd));
         $result_cmd = preg_split("/\r\n|\n|\r/", $result_cmd);
         $result_cmd = str_replace('"', "", $result_cmd);
 
         foreach ($result_cmd as $label => $oid) {
             $split = preg_split('/\t/', $oid, null, PREG_SPLIT_NO_EMPTY);

Vulnerable code:         $result_cmd = shell_exec($cmd);
Fixed code:         $result_cmd = shell_exec(escapeshellcmd($cmd));
CVE-2023-4655: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-08-31T01:15Z
Repository: https://github.com/instantsoft/icms2
Language: JavaScript
Files changed: templates/modern/js/files.js
Commit date: 2023-08-16 01:01:03 +0300
Commit message: Fix file field xss
Diff: diff --git a/templates/modern/js/files.js b/templates/modern/js/files.js
index a3aa6bb5a..3d8e921fb 100755
--- a/templates/modern/js/files.js
+++ b/templates/modern/js/files.js
@@ -4,11 +4,11 @@ icms.files = (function ($) {
 
     this.url_delete = '';
 
     this.onDocumentReady = function(){
         $('.custom-file-input').on('change',function(){
-            $(this).next('.custom-file-label').html($(this).val().replace('C:\\fakepath\\', ''));
+            $(this).next('.custom-file-label').text($(this).val().replace('C:\\fakepath\\', ''));
         });
     };
 
     this.remove = function(file_id){
 

Vulnerable code:             $(this).next('.custom-file-label').html($(this).val().replace('C:\\fakepath\\', ''));
Fixed code:             $(this).next('.custom-file-label').text($(this).val().replace('C:\\fakepath\\', ''));
CVE-2023-45813: Inefficient Regular Expression Complexity (CWE-1333)
value: Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-10-18T21:15Z
Repository: https://github.com/DedSecInside/TorBot
Language: Unknown
Commit date: 2023-10-09 12:40:42 -0400
Commit message: remove unused validators file

Diff: diff --git a/torbot/modules/validators.py b/torbot/modules/validators.py
deleted file mode 100644
index a8e78c3..0000000
--- a/torbot/modules/validators.py
+++ /dev/null
@@ -1,13 +0,0 @@
-import validators
-
-
-def validate_email(email):
-    if not isinstance(email, str):
-        return False
-    return validators.email(email)
-
-
-def validate_link(link):
-    if not isinstance(link, str):
-        return False
-    return validators.url(link)

Vulnerable code: import validators


def validate_email(email):
    if not isinstance(email, str):
        return False
    return validators.email(email)


def validate_link(link):
    if not isinstance(link, str):
        return False
    return validators.url(link)
CVE-2013-0342: Improper Input Validation (CWE-20)
value: The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 4.3
Published: 2019-12-09T21:15Z
Repository: https://github.com/pyradius/pyrad
Language: Other
Files changed: CHANGES.txt, pyrad/packet.py
Commit date: 2013-01-15 16:55:54 +0100
Commit message: Use a better random generator.

Diff: diff --git a/CHANGES.txt b/CHANGES.txt
index 17aaffe..6dd92ef 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,8 +1,15 @@
 Changelog
 =========
 
+2.1 - Unreleased
+------------------
+
+* Use a different random generator to improve the security of generated
+  packet ids and authenticators.
+
+
 2.0 - May 15, 2011
 ------------------
 
 * Start moving codebase to PEP8 compatible coding style.
 
diff --git a/pyrad/packet.py b/pyrad/packet.py
index e3682b2..2366140 100644
--- a/pyrad/packet.py
+++ b/pyrad/packet.py
@@ -31,12 +31,15 @@ DisconnectACK = 41
 DisconnectNAK = 42
 CoARequest = 43
 CoAACK = 44
 CoANAK = 45
 
+# Use cryptographic-safe random generator as provided by the OS.
+random_generator = random.SystemRandom()
+
 # Current ID
-CurrentID = random.randrange(1, 255)
+CurrentID = random_generator.randrange(1, 255)
 
 
 class PacketError(Exception):
     pass
 
@@ -206,11 +209,11 @@ class Packet(dict):
         :rtype: binary string
         """
 
         data = []
         for i in range(16):
-            data.append(random.randrange(0, 256))
+            data.append(random_generator.randrange(0, 256))
         if six.PY3:
             return bytes(data)
         else:
             return ''.join(chr(b) for b in data)
 
@@ -221,11 +224,11 @@ class Packet(dict):
 
         :return: ID number
         :rtype:  integer
 
         """
-        return random.randrange(0, 256)
+        return random_generator.randrange(0, 256)
 
     def ReplyPacket(self):
         """Create a ready-to-transmit authentication reply packet.
         Returns a RADIUS packet which can be directly transmitted
         to a RADIUS server. This differs with Packet() in how

Vulnerable code: CurrentID = random.randrange(1, 255)
            data.append(random.randrange(0, 256))
        return random.randrange(0, 256)
Fixed code: 2.1 - Unreleased
------------------

* Use a different random generator to improve the security of generated
  packet ids and authenticators.


# Use cryptographic-safe random generator as provided by the OS.
random_generator = random.SystemRandom()

CurrentID = random_generator.randrange(1, 255)
            data.append(random_generator.randrange(0, 256))
        return random_generator.randrange(0, 256)
CVE-2021-3945: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-11-13T09:15Z
Repository: https://github.com/django-helpdesk/django-helpdesk
Language: HTML
Files changed: helpdesk/templates/helpdesk/ticket_list.html
Commit date: 2021-11-11 17:32:09 +0700
Commit message: Add function `htmlEntities`

`htmlentities()` is a function which converts special characters. This allows you to show to display the string without the browser reading it as HTML.
Diff: diff --git a/helpdesk/templates/helpdesk/ticket_list.html b/helpdesk/templates/helpdesk/ticket_list.html
index c9a57d23..2894349b 100644
--- a/helpdesk/templates/helpdesk/ticket_list.html
+++ b/helpdesk/templates/helpdesk/ticket_list.html
@@ -328,11 +328,15 @@
     {% endif %}
     <script>
         function get_url(row) {
             return "{% url 'helpdesk:view' 1234 %}".replace(/1234/, row.id.toString());
         }
-
+        
+        function htmlEntities(str) {
+            return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+        }
+        
         $(document).ready(function () {
             // Ticket DataTable Initialization
             $('#ticketTable').DataTable({
                 language: {
                     "emptyTable": "{% trans 'No Tickets Match Your Selection' %}"
@@ -364,11 +368,11 @@
                         data: "ticket",
                         render: function (data, type, row, meta) {
                             if (type === 'display') {
                                 data = '<div class="tickettitle"><a href="' + get_url(row) + '" >' +
                                     row.id + '. ' +
-                                    row.title + '</a></div>';
+                                    htmlEntities(row.title) + '</a></div>';
                             }
                             return data
                         }
                     },
                     {

Vulnerable code: 
                                    row.title + '</a></div>';
Fixed code:         
        function htmlEntities(str) {
            return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
        }
        
                                    htmlEntities(row.title) + '</a></div>';
CVE-2021-3950: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-11-19T12:15Z
Repository: https://github.com/django-helpdesk/django-helpdesk
Language: Python
Files changed: helpdesk/lib.py
Commit date: 2021-11-18 10:42:02 +0700
Commit message: Add `att.full_clean()` before saving

Fix issue https://github.com/django-helpdesk/django-helpdesk/issues/983
Also, fix bug stored XSS disclosure: https://huntr.dev/bounties/4d7a5fdd-b2de-467a-ade0-3f2fb386638e/
Diff: diff --git a/helpdesk/lib.py b/helpdesk/lib.py
index 07d655c3..da853990 100644
--- a/helpdesk/lib.py
+++ b/helpdesk/lib.py
@@ -143,10 +143,11 @@ def process_attachments(followup, attached_files):
                 mime_type=attached.content_type or
                 mimetypes.guess_type(filename, strict=False)[0] or
                 'application/octet-stream',
                 size=attached.size,
             )
+            att.full_clean()
             att.save()
 
             if attached.size < max_email_attachment_size:
                 # Only files smaller than 512kb (or as defined in
                 # settings.HELPDESK_MAX_EMAIL_ATTACHMENT_SIZE) are sent via email.

Fixed code:             att.full_clean()
CVE-2021-3994: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.6
Published: 2021-12-01T11:15Z
Repository: https://github.com/django-helpdesk/django-helpdesk
Language: Python
Files changed: helpdesk/models.py
Commit date: 2021-11-19 23:11:33 +0700
Commit message: Update pattern

Diff: diff --git a/helpdesk/models.py b/helpdesk/models.py
index 31bed5df..f8ffb8b1 100644
--- a/helpdesk/models.py
+++ b/helpdesk/models.py
@@ -54,11 +54,11 @@ class EscapeHtml(Extension):
 
 def get_markdown(text):
     if not text:
         return ""
 
-    pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\[\s\S\]]*?)\)'
+    pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\s\S]*?)\)'
     # Regex check
     if re.match(pattern, text):
         # get get value of group regex
         scheme = re.search(pattern, text, re.IGNORECASE).group(2)
         # scheme check

Vulnerable code:     pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\[\s\S\]]*?)\)'
Fixed code:     pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\s\S]*?)\)'
CVE-2021-21289: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.3
Published: 2021-02-02T19:15Z
Repository: https://github.com/sparklemotion/mechanize
Language: Unknown
Commit date: 2021-02-01 12:59:47 -0500
Commit message: Merge pull request #548 from kyoshidajp/fix_command_injection

Prevent OS command injection
CVE-2022-31033: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2022-06-09T20:15Z
Repository: https://github.com/sparklemotion/mechanize
Language: Unknown
Commit date: 2022-06-09 18:24:18 +0100
Commit message: Merge pull request #600 from sparklemotion/flavorjones-redirect-headers

fix: clear credentials when redirecting to a different port
CVE-2018-16359: Insufficient Information (NVD-CWE-noinfo)
value: Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows attackers to rename files on the host OS.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.8
Published: 2018-09-02T22:29Z
Repository: https://github.com/google/gvisor
Language: Go
Files changed: runsc/boot/filter/config.go
Commit date: 2018-08-23 11:15:07 -0700
Commit message: Clean up syscall filters

Removed syscalls that are only used by whitelistfs
which has its own set of filters.

PiperOrigin-RevId: 209967259
Change-Id: Idb2e1b9d0201043d7cd25d96894f354729dbd089

Diff: diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go
index 0ce49b3..e45e599 100644
--- a/runsc/boot/filter/config.go
+++ b/runsc/boot/filter/config.go
@@ -36,11 +36,10 @@ var allowedSyscalls = seccomp.SyscallRules{
 	syscall.SYS_EPOLL_WAIT:    {},
 	syscall.SYS_EVENTFD2:      {},
 	syscall.SYS_EXIT:          {},
 	syscall.SYS_EXIT_GROUP:    {},
 	syscall.SYS_FALLOCATE:     {},
-	syscall.SYS_FCHMOD:        {},
 	syscall.SYS_FCNTL:         {},
 	syscall.SYS_FSTAT:         {},
 	syscall.SYS_FSYNC:         {},
 	syscall.SYS_FTRUNCATE:     {},
 	syscall.SYS_FUTEX:         {},
@@ -58,19 +57,16 @@ var allowedSyscalls = seccomp.SyscallRules{
 	syscall.SYS_MADVISE:         {},
 	syscall.SYS_MINCORE:         {},
 	syscall.SYS_MMAP:            {},
 	syscall.SYS_MPROTECT:        {},
 	syscall.SYS_MUNMAP:          {},
-	syscall.SYS_NEWFSTATAT:      {},
 	syscall.SYS_POLL:            {},
 	syscall.SYS_PREAD64:         {},
 	syscall.SYS_PWRITE64:        {},
 	syscall.SYS_READ:            {},
-	syscall.SYS_READLINKAT:      {},
 	syscall.SYS_READV:           {},
 	syscall.SYS_RECVMSG:         {},
-	syscall.SYS_RENAMEAT:        {},
 	syscall.SYS_RESTART_SYSCALL: {},
 	syscall.SYS_RT_SIGACTION:    {},
 	syscall.SYS_RT_SIGPROCMASK:  {},
 	syscall.SYS_RT_SIGRETURN:    {},
 	syscall.SYS_SCHED_YIELD:     {},
@@ -78,11 +74,10 @@ var allowedSyscalls = seccomp.SyscallRules{
 	syscall.SYS_SETITIMER:       {},
 	syscall.SYS_SHUTDOWN:        {},
 	syscall.SYS_SIGALTSTACK:     {},
 	syscall.SYS_SYNC_FILE_RANGE: {},
 	syscall.SYS_TGKILL:          {},
-	syscall.SYS_UTIMENSAT:       {},
 	syscall.SYS_WRITE:           {},
 	syscall.SYS_WRITEV:          {},
 }
 
 // TODO: Ioctl is needed in order to support tty consoles.

Vulnerable code: 	syscall.SYS_FCHMOD:        {},
	syscall.SYS_NEWFSTATAT:      {},
	syscall.SYS_READLINKAT:      {},
	syscall.SYS_RENAMEAT:        {},
	syscall.SYS_UTIMENSAT:       {},
CVE-2023-2138: Use of Hard-coded Credentials (CWE-798)
value: Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 9.8
Published: 2023-04-18T01:15Z
Repository: https://github.com/nuxtlabs/github-module
Language: TypeScript
Files changed: src/module.ts
Commit date: 2023-04-11 12:12:12 +0200
Commit message: fix: do not expose token in public runtime config (#41)

* fix: do not expose token in public runtime config

* fix: remove formatting change

* refactor: avoid setting token in first place
Diff: diff --git a/src/module.ts b/src/module.ts
index 0904660..f569f7e 100644
--- a/src/module.ts
+++ b/src/module.ts
@@ -67,21 +67,22 @@ export default defineNuxtModule<ModuleOptions>({
     const config = {
       api: options.api || process.env.GITHUB_OWNER,
       owner: options.owner || process.env.GITHUB_OWNER,
       branch: options.branch || process.env.GITHUB_BRANCH,
       repo: options.repo || process.env.GITHUB_REPO,
-      token: options.token || process.env.GITHUB_TOKEN,
       disableCache: options.disableCache,
       parseContents: options.parseContents,
       maxContributors: options.maxContributors
     }
 
     // Public runtime config
     // @ts-ignore
     nuxt.options.runtimeConfig.public.github = defu(nuxt.options.runtimeConfig.public.github, config)
     // @ts-ignore
-    nuxt.options.runtimeConfig.github = defu(nuxt.options.runtimeConfig.github, config)
+    nuxt.options.runtimeConfig.github = defu(nuxt.options.runtimeConfig.github, {
+      token: options.token || process.env.GITHUB_TOKEN
+    }, config)
 
     // Autolink issue/PR/commit links using `remark-github` plugin
     if (options.remarkPlugin) {
       // @ts-ignore
       nuxt.hook('content:context', (context) => {

Vulnerable code:       token: options.token || process.env.GITHUB_TOKEN,
    nuxt.options.runtimeConfig.github = defu(nuxt.options.runtimeConfig.github, config)
Fixed code:     nuxt.options.runtimeConfig.github = defu(nuxt.options.runtimeConfig.github, {
      token: options.token || process.env.GITHUB_TOKEN
    }, config)
CVE-2013-10015: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in fanzila WebFinance 0.5 and classified as critical. This vulnerability affects unknown code of the file htdocs/admin/save_Contract_Signer_Role.php. The manipulation of the argument n/v leads to sql injection. The patch is identified as abad81af614a9ceef3f29ab22ca6bae517619e06. It is recommended to apply a patch to fix this issue. VDB-220054 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-03T20:15Z
Repository: https://github.com/fanzila/WebFinance
Language: PHP
Files changed: htdocs/admin/save_Contract_Signer_Role.php
Commit date: 2013-09-18 15:51:50 +0200
Commit message: * htdocs/admin/save_Contract_Signer_Role.php: fixed SQL injection

Diff: diff --git a/htdocs/admin/save_Contract_Signer_Role.php b/htdocs/admin/save_Contract_Signer_Role.php
index 6371196..61f3260 100644
--- a/htdocs/admin/save_Contract_Signer_Role.php
+++ b/htdocs/admin/save_Contract_Signer_Role.php
@@ -32,12 +32,12 @@ foreach ($_POST['cat'] as $id=>$data) {
     if ($data['role'] != "") {
       $q = "INSERT INTO contract_signer_role ";
       $f = "(";
       $values = "VALUES(";
       foreach ($data as $n=>$v) {
-        $f .= sprintf("%s,", $n);
-        $values .= sprintf("'%s',", $v);
+        $f .= sprintf("%s,", mysql_real_escape_string($n));
+        $values .= sprintf("'%s',", mysql_real_escape_string($v));
       }
       $f = preg_replace("!,$!", ") ", $f);
       $values = preg_replace("!,$!", ") ", $values);
       $q .= $f.$values;
       $_SESSION['message'] = _('Added');

Vulnerable code:         $f .= sprintf("%s,", $n);
        $values .= sprintf("'%s',", $v);
Fixed code:         $f .= sprintf("%s,", mysql_real_escape_string($n));
        $values .= sprintf("'%s',", mysql_real_escape_string($v));
CVE-2013-10016: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in fanzila WebFinance 0.5 and classified as critical. This issue affects some unknown processing of the file htdocs/admin/save_taxes.php. The manipulation of the argument id leads to sql injection. The patch is named 306f170ca2a8203ae3d8f51fb219ba9e05b945e1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-220055.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-03T20:15Z
Repository: https://github.com/fanzila/WebFinance
Language: PHP
Files changed: htdocs/admin/save_taxes.php
Commit date: 2013-09-18 15:14:39 +0200
Commit message: * htdocs/admin/save_taxes.php: fixed another SQL injection

Diff: diff --git a/htdocs/admin/save_taxes.php b/htdocs/admin/save_taxes.php
index 41d9742..7251540 100644
--- a/htdocs/admin/save_taxes.php
+++ b/htdocs/admin/save_taxes.php
@@ -31,10 +31,11 @@
 
 require("../inc/main.php");
 must_login();
 
 if ($_GET['action'] == "delete") {
+  $_GET['id'] = mysql_real_escape_string($_GET['id']);
   mysql_query("DELETE FROM webfinance_pref WHERE id_pref=".$_GET['id']);
   $_SESSION['message'] = _('Tax deleted');
   header("Location: preferences.php?tab=Taxes");
   exit;
 }

Fixed code:   $_GET['id'] = mysql_real_escape_string($_GET['id']);
CVE-2013-10017: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in fanzila WebFinance 0.5. It has been classified as critical. Affected is an unknown function of the file htdocs/admin/save_roles.php. The manipulation of the argument id leads to sql injection. The name of the patch is 6cfeb2f6b35c1b3a7320add07cd0493e4f752af3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-220056.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-04T00:15Z
Repository: https://github.com/fanzila/WebFinance
Language: PHP
Files changed: htdocs/admin/save_roles.php
Commit date: 2013-09-18 15:13:13 +0200
Commit message: * htdocs/admin/save_roles.php: fixed SQL injection, yet again

Diff: diff --git a/htdocs/admin/save_roles.php b/htdocs/admin/save_roles.php
index 827912e..ac65978 100644
--- a/htdocs/admin/save_roles.php
+++ b/htdocs/admin/save_roles.php
@@ -31,10 +31,11 @@
 
 require("../inc/main.php");
 must_login();
 
 if ($_GET['action'] == "delete") {
+  $_GET['id'] = mysql_real_escape_string($_GET['id']);
   mysql_query("DELETE FROM webfinance_roles WHERE id_role=".$_GET['id']);
   $_SESSION['message'] = _('Role deleted');
   header("Location: preferences.php?tab=Role");
   exit;
 }

Fixed code:   $_GET['id'] = mysql_real_escape_string($_GET['id']);
CVE-2024-24755: Insufficient Information (NVD-CWE-noinfo)
value: discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom fields to remain secret.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2024-02-01T22:15Z
Repository: https://github.com/discourse/discourse-group-membership-ip-block
Language: Ruby
Files changed: plugin.rb
Commit date: 2024-02-01 14:44:57 -0600
Commit message: SECURITY: Don't expose custom fields from other plugins (#13)


Diff: diff --git a/plugin.rb b/plugin.rb
index cc0445c..9668452 100644
--- a/plugin.rb
+++ b/plugin.rb
@@ -9,11 +9,13 @@ enabled_site_setting :group_membership_ip_block_enabled
 register_asset "stylesheets/group-settings.scss"
 
 after_initialize do
   DiscoursePluginRegistry.register_editable_group_custom_field(:ip_blocks_list, self)
   register_group_custom_field_type("ip_blocks_list", :string, max_length: 1000)
-  add_to_serializer(:basic_group, :custom_fields) { object.custom_fields }
+  add_to_serializer(:basic_group, :custom_fields) do
+    { ip_blocks_list: object.custom_fields[:ip_blocks_list] }
+  end
 
   on(:user_logged_in) do |user|
     return unless SiteSetting.group_membership_ip_block_enabled
 
     GroupCustomField

Vulnerable code:   add_to_serializer(:basic_group, :custom_fields) { object.custom_fields }
Fixed code:   add_to_serializer(:basic_group, :custom_fields) do
    { ip_blocks_list: object.custom_fields[:ip_blocks_list] }
  end
CVE-2010-4802: Improper Input Validation (CWE-20)
value: Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2011-05-03T00:55Z
Repository: https://github.com/kraih/mojo
Language: Other
Files changed: Changes, lib/Mojo/Commands.pm
Commit date: 2010-08-17 15:40:29 +0200
Commit message: fixed CGI environment detection for broken web servers

Diff: diff --git a/Changes b/Changes
index 872b282a..ff57177d 100644
--- a/Changes
+++ b/Changes
@@ -1,8 +1,9 @@
 This file documents the revision history for Perl extension Mojolicious.
 
 0.999928 2010-08-15 00:00:00
+        - Fixed CGI environment detection for broken web servers.
         - Fixed redirect_to without content and render_static bug.
         - Fixed nested partial rendering bug. (yko)
         - Fixed multiple small Mojo::DOM bugs. (yko)
 
 0.999927 2010-08-15 00:00:00
diff --git a/lib/Mojo/Commands.pm b/lib/Mojo/Commands.pm
index 87abd4b6..e64ccdd6 100644
--- a/lib/Mojo/Commands.pm
+++ b/lib/Mojo/Commands.pm
@@ -143,22 +143,19 @@ sub _detect {
     my ($self, $name) = @_;
 
     # PSGI (Plack only for now)
     return 'psgi' if defined $ENV{PLACK_ENV};
 
-    # No further detection if we have a name
-    return $name if $name;
-
     # CGI
     return 'cgi'
       if defined $ENV{PATH_INFO} || defined $ENV{GATEWAY_INTERFACE};
 
     # FastCGI
     return 'fastcgi' unless defined $ENV{PATH};
 
     # Nothing
-    return;
+    return $name;
 }
 
 1;
 __END__
 

Vulnerable code:     # No further detection if we have a name
    return $name if $name;

    return;
Fixed code:         - Fixed CGI environment detection for broken web servers.
    return $name;
CVE-2010-4802: Improper Input Validation (CWE-20)
value: Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2011-05-03T00:55Z
Repository: https://github.com/kraih/mojo
Language: Perl
Files changed: lib/Mojo/Commands.pm
Commit date: 2010-08-17 15:56:41 +0200
Commit message: made detection a little less aggressive

Diff: diff --git a/lib/Mojo/Commands.pm b/lib/Mojo/Commands.pm
index e64ccdd6..697a4059 100644
--- a/lib/Mojo/Commands.pm
+++ b/lib/Mojo/Commands.pm
@@ -147,15 +147,18 @@ sub _detect {
 
     # CGI
     return 'cgi'
       if defined $ENV{PATH_INFO} || defined $ENV{GATEWAY_INTERFACE};
 
+    # No further detection if we have a name
+    return $name if $name;
+
     # FastCGI
     return 'fastcgi' unless defined $ENV{PATH};
 
     # Nothing
-    return $name;
+    return;
 }
 
 1;
 __END__
 

Vulnerable code:     return $name;
Fixed code:     # No further detection if we have a name
    return $name if $name;

    return;
CVE-2016-7168: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2017-01-05T02:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/includes/media.php, wp-includes/version.php
Commit date: 2016-09-07 13:55:36 +0000
Commit message: Media: Sanitize upload filename.

Built from https://develop.svn.wordpress.org/trunk@38538


git-svn-id: http://core.svn.wordpress.org/trunk@38481 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index 63807f71de..35aa7914c7 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -287,11 +287,11 @@ function media_handle_upload($file_id, $post_id, $post_data = array(), $override
 	$basename = pathinfo( $name, PATHINFO_BASENAME );
 
 	$url = $file['url'];
 	$type = $file['type'];
 	$file = $file['file'];
-	$title = $basename;
+	$title = sanitize_title( $basename );
 	$content = '';
 	$excerpt = '';
 
 	if ( preg_match( '#^audio#', $type ) ) {
 		$meta = wp_read_audio_metadata( $file );
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 0a96a6ba6c..ff2113eb5a 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.7-alpha-38536';
+$wp_version = '4.7-alpha-38538';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 	$title = $basename;
$wp_version = '4.7-alpha-38536';
Fixed code: 	$title = sanitize_title( $basename );
$wp_version = '4.7-alpha-38538';
CVE-2016-7169: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.3
Published: 2017-01-05T02:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/includes/class-file-upload-upgrader.php, wp-includes/version.php
Commit date: 2016-09-06 17:26:31 +0000
Commit message: Upgrade/Install: Sanitize file name in `File_Upload_Upgrader`.
Built from https://develop.svn.wordpress.org/trunk@38524


git-svn-id: http://core.svn.wordpress.org/trunk@38465 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/includes/class-file-upload-upgrader.php b/wp-admin/includes/class-file-upload-upgrader.php
index 35baa7faeb..eb4efe7121 100644
--- a/wp-admin/includes/class-file-upload-upgrader.php
+++ b/wp-admin/includes/class-file-upload-upgrader.php
@@ -98,12 +98,16 @@ class File_Upload_Upgrader {
 		} else {
 			// Else, It's set to something, Back compat for plugins using the old (pre-3.3) File_Uploader handler.
 			if ( ! ( ( $uploads = wp_upload_dir() ) && false === $uploads['error'] ) )
 				wp_die( $uploads['error'] );
 
-			$this->filename = $_GET[$urlholder];
+			$this->filename = sanitize_file_name( $_GET[ $urlholder ] );
 			$this->package = $uploads['basedir'] . '/' . $this->filename;
+
+			if ( 0 !== strpos( realpath( $this->package ), realpath( $uploads['basedir'] ) ) ) {
+				wp_die( __( 'Please select a file' ) );
+			}
 		}
 	}
 
 	/**
 	 * Delete the attachment/uploaded file.
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 9f39bc2c38..2265a47bd1 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.7-alpha-38523';
+$wp_version = '4.7-alpha-38524';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 			$this->filename = $_GET[$urlholder];
$wp_version = '4.7-alpha-38523';
Fixed code: 			$this->filename = sanitize_file_name( $_GET[ $urlholder ] );

			if ( 0 !== strpos( realpath( $this->package ), realpath( $uploads['basedir'] ) ) ) {
				wp_die( __( 'Please select a file' ) );
			}
$wp_version = '4.7-alpha-38524';
CVE-2017-17091: Use of Insufficiently Random Values (CWE-330)
value: wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.
CWE description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CVSS v3 base score: 8.8
Published: 2017-12-02T06:29Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/user-new.php, wp-includes/version.php
Commit date: 2017-11-29 15:52:50 +0000
Commit message: Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring.

Built from https://develop.svn.wordpress.org/trunk@42258


git-svn-id: http://core.svn.wordpress.org/trunk@42087 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/user-new.php b/wp-admin/user-new.php
index ebcd2a7dca6..641fd822fd3 100644
--- a/wp-admin/user-new.php
+++ b/wp-admin/user-new.php
@@ -73,11 +73,11 @@ if ( isset($_REQUEST['action']) && 'adduser' == $_REQUEST['action'] ) {
 				$redirect = add_query_arg( array( 'update' => 'addnoconfirmation', 'user_id' => $user_id ), 'user-new.php' );
 			} else {
 				$redirect = add_query_arg( array( 'update' => 'could_not_add' ), 'user-new.php' );
 			}
 		} else {
-			$newuser_key = substr( md5( $user_id ), 0, 5 );
+			$newuser_key = wp_generate_password( 20, false );
 			add_option( 'new_user_' . $newuser_key, array( 'user_id' => $user_id, 'email' => $user_details->user_email, 'role' => $_REQUEST[ 'role' ] ) );
 
 			$roles = get_editable_roles();
 			$role = $roles[ $_REQUEST['role'] ];
 
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 05180f59f49..f5f8415d416 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.0-alpha-42257';
+$wp_version = '5.0-alpha-42258';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 			$newuser_key = substr( md5( $user_id ), 0, 5 );
$wp_version = '5.0-alpha-42257';
Fixed code: 			$newuser_key = wp_generate_password( 20, false );
$wp_version = '5.0-alpha-42258';
CVE-2017-17092: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-12-02T06:29Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/functions.php, wp-includes/version.php
Commit date: 2017-11-29 16:00:48 +0000
Commit message: Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.

Built from https://develop.svn.wordpress.org/trunk@42261


git-svn-id: http://core.svn.wordpress.org/trunk@42090 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index 5a2d3c5d4ee..c5f6feb2f09 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -2563,12 +2563,13 @@ function get_allowed_mime_types( $user = null ) {
 
 	unset( $t['swf'], $t['exe'] );
 	if ( function_exists( 'current_user_can' ) )
 		$unfiltered = $user ? user_can( $user, 'unfiltered_html' ) : current_user_can( 'unfiltered_html' );
 
-	if ( empty( $unfiltered ) )
-		unset( $t['htm|html'] );
+	if ( empty( $unfiltered ) ) {
+		unset( $t['htm|html'], $t['js'] );
+	}
 
 	/**
 	 * Filters list of allowed mime types and file extensions.
 	 *
 	 * @since 2.0.0
diff --git a/wp-includes/version.php b/wp-includes/version.php
index cee0d424cda..279f795fed1 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.0-alpha-42260';
+$wp_version = '5.0-alpha-42261';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 	if ( empty( $unfiltered ) )
		unset( $t['htm|html'] );
$wp_version = '5.0-alpha-42260';
Fixed code: 	if ( empty( $unfiltered ) ) {
		unset( $t['htm|html'], $t['js'] );
	}
$wp_version = '5.0-alpha-42261';