Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-4281: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It is recommended to apply a patch to fix this issue. VDB-216842 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-12-26T20:15Z
Repository: https://github.com/BraveUX/for-the-badge
Language: YAML
Files changed: .github/workflows/combine-prs.yml
Commit date: 2021-08-09 17:50:12 -0400
Commit message: Fix potential injection vulnerability

See https://github.com/hrvey/combine-prs-workflow/releases/tag/1.2.0
Diff: diff --git a/.github/workflows/combine-prs.yml b/.github/workflows/combine-prs.yml
index 0bfc142..abcff1b 100644
--- a/.github/workflows/combine-prs.yml
+++ b/.github/workflows/combine-prs.yml
@@ -104,11 +104,11 @@ jobs:
         env:
           BASE_BRANCH: ${{ steps.fetch-branch-names.outputs.base-branch }}
           BRANCHES_TO_COMBINE: ${{ steps.fetch-branch-names.outputs.result }}
           COMBINE_BRANCH_NAME: ${{ github.event.inputs.combineBranchName }}
         run: |
-          echo "${{steps.fetch-branch-names.outputs.result}}"
+          echo "$BRANCHES_TO_COMBINE"
           sourcebranches="${BRANCHES_TO_COMBINE%\"}"
           sourcebranches="${sourcebranches#\"}"
 
           basebranch="${BASE_BRANCH%\"}"
           basebranch="${basebranch#\"}"
@@ -122,14 +122,16 @@ jobs:
           git pull origin $sourcebranches --no-edit
           git push origin $COMBINE_BRANCH_NAME
       # Creates a PR with the new combined branch
       - uses: actions/github-script@v3
         name: Create Combined Pull Request
+        env:
+          PRS_STRING: ${{ steps.fetch-branch-names.outputs.prs-string }}
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |
-            const prString = `${{ steps.fetch-branch-names.outputs.prs-string }}`;
+            const prString = process.env.PRS_STRING;
             const body = 'This PR was created by the Combine PRs action by combining the following PRs:\n' + prString;
             await github.pulls.create({
               owner: context.repo.owner,
               repo: context.repo.repo,
               title: 'Combined PR',

Vulnerable code:           echo "${{steps.fetch-branch-names.outputs.result}}"
            const prString = `${{ steps.fetch-branch-names.outputs.prs-string }}`;
Fixed code:           echo "$BRANCHES_TO_COMBINE"
        env:
          PRS_STRING: ${{ steps.fetch-branch-names.outputs.prs-string }}
            const prString = process.env.PRS_STRING;
CVE-2024-36123: Insufficient Information (NVD-CWE-noinfo)
value: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-03T15:15Z
Repository: https://github.com/StarCitizenTools/mediawiki-skins-Citizen
Language: PHP
Files changed: includes/Components/CitizenComponentPageHeading.php
Commit date: 2024-06-01 14:50:46 -0400
Commit message: fix(components): 🐛 escape the contents of MediaWiki:Tagline

Co-authored-by: BlankEclair <blankeclair@waifu.club>

Diff: diff --git a/includes/Components/CitizenComponentPageHeading.php b/includes/Components/CitizenComponentPageHeading.php
index 9916099e..8e9126da 100644
--- a/includes/Components/CitizenComponentPageHeading.php
+++ b/includes/Components/CitizenComponentPageHeading.php
@@ -189,17 +189,17 @@ class CitizenComponentPageHeading implements CitizenComponent {
 							$tagline = $this->buildUserTagline( $title );
 						} elseif ( !$localizer->msg( 'citizen-tagline' )->isDisabled() ) {
 							$tagline = $localizer->msg( 'citizen-tagline' )->parse();
 						} else {
 							// Fallback to site tagline
-							$tagline = $localizer->msg( 'tagline' )->text();
+							$tagline = $localizer->msg( 'tagline' )->parse();
 						}
 					}
 				} elseif ( !$localizer->msg( 'citizen-tagline' )->isDisabled() ) {
 					$tagline = $localizer->msg( 'citizen-tagline' )->parse();
 				} else {
-					$tagline = $localizer->msg( 'tagline' )->text();
+					$tagline = $localizer->msg( 'tagline' )->parse();
 				}
 			}
 		}
 
 		// Apply language variant conversion

Vulnerable code: 							$tagline = $localizer->msg( 'tagline' )->text();
					$tagline = $localizer->msg( 'tagline' )->text();
Fixed code: 							$tagline = $localizer->msg( 'tagline' )->parse();
					$tagline = $localizer->msg( 'tagline' )->parse();
CVE-2021-41317: Improper Authentication (CWE-287)
value: XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2021-09-17T16:15Z
Repository: https://github.com/mandatoryprogrammer/xsshunter-express
Language: JavaScript
Files changed: api.js
Commit date: 2021-09-16 22:43:16 -0700
Commit message: Better path checking

Diff: diff --git a/api.js b/api.js
index cb48bf5..c2544ee 100644
--- a/api.js
+++ b/api.js
@@ -92,13 +92,21 @@ async function set_up_api_server(app) {
             constants.API_BASE_PATH + 'payloadfires',
             constants.API_BASE_PATH + 'collected_pages',
             constants.API_BASE_PATH + 'settings',
         ];
 
+        // Check if the path being accessed required authentication
+        var requires_authentication = false;
+        AUTHENTICATION_REQUIRED_ROUTES.map(authenticated_route => {
+            if(req.path.toLowerCase().startsWith(authenticated_route)) {
+                requires_authentication = true;
+            }
+        });
+
         // If the route is not one of the authentication required routes
         // then we can allow it through.
-        if(!AUTHENTICATION_REQUIRED_ROUTES.includes(req.path)) {
+        if(!requires_authentication) {
             next();
             return;
         }
 
     	// If the user is authenticated, let them pass

Vulnerable code:         if(!AUTHENTICATION_REQUIRED_ROUTES.includes(req.path)) {
Fixed code:         // Check if the path being accessed required authentication
        var requires_authentication = false;
        AUTHENTICATION_REQUIRED_ROUTES.map(authenticated_route => {
            if(req.path.toLowerCase().startsWith(authenticated_route)) {
                requires_authentication = true;
            }
        });

        if(!requires_authentication) {
CVE-2022-4609: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-19T12:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/resource.go
Commit date: 2022-12-19 18:26:50 +0800
Commit message: chore: restrict the html file (#749)

* restrict the html file

* replace spaces with table

* remove space
Diff: diff --git a/server/resource.go b/server/resource.go
index bbf009e..9021b04 100644
--- a/server/resource.go
+++ b/server/resource.go
@@ -5,10 +5,11 @@ import (
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/usememos/memos/api"
 	"github.com/usememos/memos/common"
 	metric "github.com/usememos/memos/plugin/metrics"
@@ -40,10 +41,14 @@ func (s *Server) registerResourceRoutes(g *echo.Group) {
 		if file == nil {
 			return echo.NewHTTPError(http.StatusBadRequest, "Upload file not found").SetInternal(err)
 		}
 
 		filename := file.Filename
+		if strings.HasSuffix(filename, ".html") {
+			return echo.NewHTTPError(http.StatusBadRequest, "html file is not allowed")
+		}
+
 		filetype := file.Header.Get("Content-Type")
 		size := file.Size
 		src, err := file.Open()
 		if err != nil {
 			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to open file").SetInternal(err)

Fixed code: 	"strings"
		if strings.HasSuffix(filename, ".html") {
			return echo.NewHTTPError(http.StatusBadRequest, "html file is not allowed")
		}
CVE-2022-4684: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 8.8
Published: 2022-12-23T12:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: api/memo.go, api/resource.go, api/shortcut.go, api/user.go
Commit date: 2022-12-23 18:38:24 +0800
Commit message: fix: disable decode patch id (#831)


Diff: diff --git a/api/memo.go b/api/memo.go
index 29d0ebe..01aa42f 100644
--- a/api/memo.go
+++ b/api/memo.go
@@ -55,11 +55,11 @@ type MemoCreate struct {
 	// Related fields
 	ResourceIDList []int `json:"resourceIdList"`
 }
 
 type MemoPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	CreatedTs *int64 `json:"createdTs"`
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
diff --git a/api/resource.go b/api/resource.go
index b833f91..90e47c7 100644
--- a/api/resource.go
+++ b/api/resource.go
@@ -39,11 +39,11 @@ type ResourceFind struct {
 	Filename *string `json:"filename"`
 	MemoID   *int
 }
 
 type ResourcePatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 
 	// Domain specific fields
diff --git a/api/shortcut.go b/api/shortcut.go
index b4aa803..5eaedd3 100644
--- a/api/shortcut.go
+++ b/api/shortcut.go
@@ -22,11 +22,11 @@ type ShortcutCreate struct {
 	Title   string `json:"title"`
 	Payload string `json:"payload"`
 }
 
 type ShortcutPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 
diff --git a/api/user.go b/api/user.go
index 4e6afec..529f3fc 100644
--- a/api/user.go
+++ b/api/user.go
@@ -67,11 +67,11 @@ func (create UserCreate) Validate() error {
 
 	return nil
 }
 
 type UserPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 

Vulnerable code: 	ID int
	ID int
	ID int
	ID int
Fixed code: 	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4686: Authorization Bypass Through User-Controlled Key (CWE-639)
value: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 9.8
Published: 2022-12-23T12:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: api/memo.go, api/resource.go, api/shortcut.go, api/user.go
Commit date: 2022-12-23 18:38:24 +0800
Commit message: fix: disable decode patch id (#831)


Diff: diff --git a/api/memo.go b/api/memo.go
index 29d0ebe..01aa42f 100644
--- a/api/memo.go
+++ b/api/memo.go
@@ -55,11 +55,11 @@ type MemoCreate struct {
 	// Related fields
 	ResourceIDList []int `json:"resourceIdList"`
 }
 
 type MemoPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	CreatedTs *int64 `json:"createdTs"`
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
diff --git a/api/resource.go b/api/resource.go
index b833f91..90e47c7 100644
--- a/api/resource.go
+++ b/api/resource.go
@@ -39,11 +39,11 @@ type ResourceFind struct {
 	Filename *string `json:"filename"`
 	MemoID   *int
 }
 
 type ResourcePatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 
 	// Domain specific fields
diff --git a/api/shortcut.go b/api/shortcut.go
index b4aa803..5eaedd3 100644
--- a/api/shortcut.go
+++ b/api/shortcut.go
@@ -22,11 +22,11 @@ type ShortcutCreate struct {
 	Title   string `json:"title"`
 	Payload string `json:"payload"`
 }
 
 type ShortcutPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 
diff --git a/api/user.go b/api/user.go
index 4e6afec..529f3fc 100644
--- a/api/user.go
+++ b/api/user.go
@@ -67,11 +67,11 @@ func (create UserCreate) Validate() error {
 
 	return nil
 }
 
 type UserPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 

Vulnerable code: 	ID int
	ID int
	ID int
	ID int
Fixed code: 	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4687: Improper Privilege Management (CWE-269)
value: Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 8.1
Published: 2022-12-23T12:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: api/memo.go, api/resource.go, api/shortcut.go, api/user.go
Commit date: 2022-12-23 18:38:24 +0800
Commit message: fix: disable decode patch id (#831)


Diff: diff --git a/api/memo.go b/api/memo.go
index 29d0ebe..01aa42f 100644
--- a/api/memo.go
+++ b/api/memo.go
@@ -55,11 +55,11 @@ type MemoCreate struct {
 	// Related fields
 	ResourceIDList []int `json:"resourceIdList"`
 }
 
 type MemoPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	CreatedTs *int64 `json:"createdTs"`
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
diff --git a/api/resource.go b/api/resource.go
index b833f91..90e47c7 100644
--- a/api/resource.go
+++ b/api/resource.go
@@ -39,11 +39,11 @@ type ResourceFind struct {
 	Filename *string `json:"filename"`
 	MemoID   *int
 }
 
 type ResourcePatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 
 	// Domain specific fields
diff --git a/api/shortcut.go b/api/shortcut.go
index b4aa803..5eaedd3 100644
--- a/api/shortcut.go
+++ b/api/shortcut.go
@@ -22,11 +22,11 @@ type ShortcutCreate struct {
 	Title   string `json:"title"`
 	Payload string `json:"payload"`
 }
 
 type ShortcutPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 
diff --git a/api/user.go b/api/user.go
index 4e6afec..529f3fc 100644
--- a/api/user.go
+++ b/api/user.go
@@ -67,11 +67,11 @@ func (create UserCreate) Validate() error {
 
 	return nil
 }
 
 type UserPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 

Vulnerable code: 	ID int
	ID int
	ID int
	ID int
Fixed code: 	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4688: Improper Authorization (CWE-285)
value: Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 8.8
Published: 2022-12-23T12:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: api/memo.go, api/resource.go, api/shortcut.go, api/user.go
Commit date: 2022-12-23 18:38:24 +0800
Commit message: fix: disable decode patch id (#831)


Diff: diff --git a/api/memo.go b/api/memo.go
index 29d0ebe..01aa42f 100644
--- a/api/memo.go
+++ b/api/memo.go
@@ -55,11 +55,11 @@ type MemoCreate struct {
 	// Related fields
 	ResourceIDList []int `json:"resourceIdList"`
 }
 
 type MemoPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	CreatedTs *int64 `json:"createdTs"`
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
diff --git a/api/resource.go b/api/resource.go
index b833f91..90e47c7 100644
--- a/api/resource.go
+++ b/api/resource.go
@@ -39,11 +39,11 @@ type ResourceFind struct {
 	Filename *string `json:"filename"`
 	MemoID   *int
 }
 
 type ResourcePatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 
 	// Domain specific fields
diff --git a/api/shortcut.go b/api/shortcut.go
index b4aa803..5eaedd3 100644
--- a/api/shortcut.go
+++ b/api/shortcut.go
@@ -22,11 +22,11 @@ type ShortcutCreate struct {
 	Title   string `json:"title"`
 	Payload string `json:"payload"`
 }
 
 type ShortcutPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 
diff --git a/api/user.go b/api/user.go
index 4e6afec..529f3fc 100644
--- a/api/user.go
+++ b/api/user.go
@@ -67,11 +67,11 @@ func (create UserCreate) Validate() error {
 
 	return nil
 }
 
 type UserPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 

Vulnerable code: 	ID int
	ID int
	ID int
	ID int
Fixed code: 	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4689: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 8.8
Published: 2022-12-23T12:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: api/memo.go, api/resource.go, api/shortcut.go, api/user.go
Commit date: 2022-12-23 18:38:24 +0800
Commit message: fix: disable decode patch id (#831)


Diff: diff --git a/api/memo.go b/api/memo.go
index 29d0ebe..01aa42f 100644
--- a/api/memo.go
+++ b/api/memo.go
@@ -55,11 +55,11 @@ type MemoCreate struct {
 	// Related fields
 	ResourceIDList []int `json:"resourceIdList"`
 }
 
 type MemoPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	CreatedTs *int64 `json:"createdTs"`
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
diff --git a/api/resource.go b/api/resource.go
index b833f91..90e47c7 100644
--- a/api/resource.go
+++ b/api/resource.go
@@ -39,11 +39,11 @@ type ResourceFind struct {
 	Filename *string `json:"filename"`
 	MemoID   *int
 }
 
 type ResourcePatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 
 	// Domain specific fields
diff --git a/api/shortcut.go b/api/shortcut.go
index b4aa803..5eaedd3 100644
--- a/api/shortcut.go
+++ b/api/shortcut.go
@@ -22,11 +22,11 @@ type ShortcutCreate struct {
 	Title   string `json:"title"`
 	Payload string `json:"payload"`
 }
 
 type ShortcutPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 
diff --git a/api/user.go b/api/user.go
index 4e6afec..529f3fc 100644
--- a/api/user.go
+++ b/api/user.go
@@ -67,11 +67,11 @@ func (create UserCreate) Validate() error {
 
 	return nil
 }
 
 type UserPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64
 	RowStatus *RowStatus `json:"rowStatus"`
 

Vulnerable code: 	ID int
	ID int
	ID int
	ID int
Fixed code: 	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4690: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-23T12:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/resource.go, server/server.go
Commit date: 2022-12-23 18:58:55 +0800
Commit message: feat: add secure middleware (#832)


Diff: diff --git a/server/resource.go b/server/resource.go
index 589561a..714e9a4 100644
--- a/server/resource.go
+++ b/server/resource.go
@@ -5,11 +5,10 @@ import (
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"strconv"
-	"strings"
 	"time"
 
 	"github.com/usememos/memos/api"
 	"github.com/usememos/memos/common"
 	metric "github.com/usememos/memos/plugin/metrics"
@@ -261,15 +260,11 @@ func (s *Server) registerResourcePublicRoutes(g *echo.Group) {
 		resource, err := s.Store.FindResource(ctx, resourceFind)
 		if err != nil {
 			return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to fetch resource ID: %v", resourceID)).SetInternal(err)
 		}
 
-		if strings.HasPrefix(resource.Type, echo.MIMETextHTML) {
-			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
-		} else {
-			c.Response().Writer.Header().Set("Content-Type", resource.Type)
-		}
+		c.Response().Writer.Header().Set("Content-Type", resource.Type)
 		c.Response().Writer.WriteHeader(http.StatusOK)
 		c.Response().Writer.Header().Set(echo.HeaderCacheControl, "max-age=31536000, immutable")
 		if _, err := c.Response().Writer.Write(resource.Blob); err != nil {
 			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to write response").SetInternal(err)
 		}
diff --git a/server/server.go b/server/server.go
index 243f26a..5f43e7f 100644
--- a/server/server.go
+++ b/server/server.go
@@ -42,10 +42,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",
 		Timeout:      30 * time.Second,
 	}))
 
+	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
+		ContentSecurityPolicy: "default-src 'self'",
+	}))
+
 	embedFrontend(e)
 
 	// In dev mode, set the const secret key to make signin session persistence.
 	secret := []byte("usememos")
 	if profile.Mode == "prod" {

Vulnerable code: 	"strings"
		if strings.HasPrefix(resource.Type, echo.MIMETextHTML) {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}
Fixed code: 		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		ContentSecurityPolicy: "default-src 'self'",
	}))
CVE-2022-4691: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-27T15:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/resource.go, server/server.go
Commit date: 2022-12-23 18:58:55 +0800
Commit message: feat: add secure middleware (#832)


Diff: diff --git a/server/resource.go b/server/resource.go
index 589561a..714e9a4 100644
--- a/server/resource.go
+++ b/server/resource.go
@@ -5,11 +5,10 @@ import (
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"strconv"
-	"strings"
 	"time"
 
 	"github.com/usememos/memos/api"
 	"github.com/usememos/memos/common"
 	metric "github.com/usememos/memos/plugin/metrics"
@@ -261,15 +260,11 @@ func (s *Server) registerResourcePublicRoutes(g *echo.Group) {
 		resource, err := s.Store.FindResource(ctx, resourceFind)
 		if err != nil {
 			return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to fetch resource ID: %v", resourceID)).SetInternal(err)
 		}
 
-		if strings.HasPrefix(resource.Type, echo.MIMETextHTML) {
-			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
-		} else {
-			c.Response().Writer.Header().Set("Content-Type", resource.Type)
-		}
+		c.Response().Writer.Header().Set("Content-Type", resource.Type)
 		c.Response().Writer.WriteHeader(http.StatusOK)
 		c.Response().Writer.Header().Set(echo.HeaderCacheControl, "max-age=31536000, immutable")
 		if _, err := c.Response().Writer.Write(resource.Blob); err != nil {
 			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to write response").SetInternal(err)
 		}
diff --git a/server/server.go b/server/server.go
index 243f26a..5f43e7f 100644
--- a/server/server.go
+++ b/server/server.go
@@ -42,10 +42,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",
 		Timeout:      30 * time.Second,
 	}))
 
+	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
+		ContentSecurityPolicy: "default-src 'self'",
+	}))
+
 	embedFrontend(e)
 
 	// In dev mode, set the const secret key to make signin session persistence.
 	secret := []byte("usememos")
 	if profile.Mode == "prod" {

Vulnerable code: 	"strings"
		if strings.HasPrefix(resource.Type, echo.MIMETextHTML) {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}
Fixed code: 		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		ContentSecurityPolicy: "default-src 'self'",
	}))
CVE-2022-4692: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-23T20:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/resource.go, server/server.go
Commit date: 2022-12-23 18:58:55 +0800
Commit message: feat: add secure middleware (#832)


Diff: diff --git a/server/resource.go b/server/resource.go
index 589561a..714e9a4 100644
--- a/server/resource.go
+++ b/server/resource.go
@@ -5,11 +5,10 @@ import (
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"strconv"
-	"strings"
 	"time"
 
 	"github.com/usememos/memos/api"
 	"github.com/usememos/memos/common"
 	metric "github.com/usememos/memos/plugin/metrics"
@@ -261,15 +260,11 @@ func (s *Server) registerResourcePublicRoutes(g *echo.Group) {
 		resource, err := s.Store.FindResource(ctx, resourceFind)
 		if err != nil {
 			return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to fetch resource ID: %v", resourceID)).SetInternal(err)
 		}
 
-		if strings.HasPrefix(resource.Type, echo.MIMETextHTML) {
-			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
-		} else {
-			c.Response().Writer.Header().Set("Content-Type", resource.Type)
-		}
+		c.Response().Writer.Header().Set("Content-Type", resource.Type)
 		c.Response().Writer.WriteHeader(http.StatusOK)
 		c.Response().Writer.Header().Set(echo.HeaderCacheControl, "max-age=31536000, immutable")
 		if _, err := c.Response().Writer.Write(resource.Blob); err != nil {
 			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to write response").SetInternal(err)
 		}
diff --git a/server/server.go b/server/server.go
index 243f26a..5f43e7f 100644
--- a/server/server.go
+++ b/server/server.go
@@ -42,10 +42,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",
 		Timeout:      30 * time.Second,
 	}))
 
+	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
+		ContentSecurityPolicy: "default-src 'self'",
+	}))
+
 	embedFrontend(e)
 
 	// In dev mode, set the const secret key to make signin session persistence.
 	secret := []byte("usememos")
 	if profile.Mode == "prod" {

Vulnerable code: 	"strings"
		if strings.HasPrefix(resource.Type, echo.MIMETextHTML) {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}
Fixed code: 		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		ContentSecurityPolicy: "default-src 'self'",
	}))
CVE-2022-4734: Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)
value: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.


CWE description: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
CVSS v3 base score: 4.3
Published: 2022-12-27T15:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/system.go
Commit date: 2022-12-25 10:28:51 +0800
Commit message: chore: hide host user email (#856)


Diff: diff --git a/server/system.go b/server/system.go
index e4e510d..90d522a 100644
--- a/server/system.go
+++ b/server/system.go
@@ -35,10 +35,11 @@ func (s *Server) registerSystemRoutes(g *echo.Group) {
 		}
 
 		if hostUser != nil {
 			// data desensitize
 			hostUser.OpenID = ""
+			hostUser.Email = ""
 		}
 
 		systemStatus := api.SystemStatus{
 			Host:             hostUser,
 			Profile:          *s.Profile,

Fixed code: 			hostUser.Email = ""
CVE-2022-4844: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2022-12-29T18:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/acl.go, server/server.go
Commit date: 2022-12-30 00:17:19 +0800
Commit message: chore: fix CSRF (#876)


Diff: diff --git a/server/acl.go b/server/acl.go
index ccb67e8..87e5bad 100644
--- a/server/acl.go
+++ b/server/acl.go
@@ -25,10 +25,11 @@ func setUserSession(ctx echo.Context, user *api.User) error {
 	sess, _ := session.Get("memos_session", ctx)
 	sess.Options = &sessions.Options{
 		Path:     "/",
 		MaxAge:   3600 * 24 * 30,
 		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
 	}
 	sess.Values[userIDContextKey] = user.ID
 	err := sess.Save(ctx.Request(), ctx.Response())
 	if err != nil {
 		return fmt.Errorf("failed to set session, err: %w", err)
diff --git a/server/server.go b/server/server.go
index 243f26a..5e57ea8 100644
--- a/server/server.go
+++ b/server/server.go
@@ -34,10 +34,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Format: `{"time":"${time_rfc3339}",` +
 			`"method":"${method}","uri":"${uri}",` +
 			`"status":${status},"error":"${error}"}` + "\n",
 	}))
 
+	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+		TokenLookup: "cookie:_csrf",
+	}))
+
 	e.Use(middleware.CORS())
 
 	e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",

Fixed code: 		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4845: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2022-12-29T18:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/acl.go, server/server.go
Commit date: 2022-12-30 00:17:19 +0800
Commit message: chore: fix CSRF (#876)


Diff: diff --git a/server/acl.go b/server/acl.go
index ccb67e8..87e5bad 100644
--- a/server/acl.go
+++ b/server/acl.go
@@ -25,10 +25,11 @@ func setUserSession(ctx echo.Context, user *api.User) error {
 	sess, _ := session.Get("memos_session", ctx)
 	sess.Options = &sessions.Options{
 		Path:     "/",
 		MaxAge:   3600 * 24 * 30,
 		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
 	}
 	sess.Values[userIDContextKey] = user.ID
 	err := sess.Save(ctx.Request(), ctx.Response())
 	if err != nil {
 		return fmt.Errorf("failed to set session, err: %w", err)
diff --git a/server/server.go b/server/server.go
index 243f26a..5e57ea8 100644
--- a/server/server.go
+++ b/server/server.go
@@ -34,10 +34,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Format: `{"time":"${time_rfc3339}",` +
 			`"method":"${method}","uri":"${uri}",` +
 			`"status":${status},"error":"${error}"}` + "\n",
 	}))
 
+	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+		TokenLookup: "cookie:_csrf",
+	}))
+
 	e.Use(middleware.CORS())
 
 	e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",

Fixed code: 		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4846: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2022-12-29T18:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/acl.go, server/server.go
Commit date: 2022-12-30 00:17:19 +0800
Commit message: chore: fix CSRF (#876)


Diff: diff --git a/server/acl.go b/server/acl.go
index ccb67e8..87e5bad 100644
--- a/server/acl.go
+++ b/server/acl.go
@@ -25,10 +25,11 @@ func setUserSession(ctx echo.Context, user *api.User) error {
 	sess, _ := session.Get("memos_session", ctx)
 	sess.Options = &sessions.Options{
 		Path:     "/",
 		MaxAge:   3600 * 24 * 30,
 		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
 	}
 	sess.Values[userIDContextKey] = user.ID
 	err := sess.Save(ctx.Request(), ctx.Response())
 	if err != nil {
 		return fmt.Errorf("failed to set session, err: %w", err)
diff --git a/server/server.go b/server/server.go
index 243f26a..5e57ea8 100644
--- a/server/server.go
+++ b/server/server.go
@@ -34,10 +34,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Format: `{"time":"${time_rfc3339}",` +
 			`"method":"${method}","uri":"${uri}",` +
 			`"status":${status},"error":"${error}"}` + "\n",
 	}))
 
+	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+		TokenLookup: "cookie:_csrf",
+	}))
+
 	e.Use(middleware.CORS())
 
 	e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",

Fixed code: 		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4847: Incorrectly Specified Destination in a Communication Channel (CWE-941)
value: Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CWE description: The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
CVSS v3 base score: 6.5
Published: 2022-12-29T18:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/acl.go, server/server.go
Commit date: 2022-12-30 00:17:19 +0800
Commit message: chore: fix CSRF (#876)


Diff: diff --git a/server/acl.go b/server/acl.go
index ccb67e8..87e5bad 100644
--- a/server/acl.go
+++ b/server/acl.go
@@ -25,10 +25,11 @@ func setUserSession(ctx echo.Context, user *api.User) error {
 	sess, _ := session.Get("memos_session", ctx)
 	sess.Options = &sessions.Options{
 		Path:     "/",
 		MaxAge:   3600 * 24 * 30,
 		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
 	}
 	sess.Values[userIDContextKey] = user.ID
 	err := sess.Save(ctx.Request(), ctx.Response())
 	if err != nil {
 		return fmt.Errorf("failed to set session, err: %w", err)
diff --git a/server/server.go b/server/server.go
index 243f26a..5e57ea8 100644
--- a/server/server.go
+++ b/server/server.go
@@ -34,10 +34,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Format: `{"time":"${time_rfc3339}",` +
 			`"method":"${method}","uri":"${uri}",` +
 			`"status":${status},"error":"${error}"}` + "\n",
 	}))
 
+	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+		TokenLookup: "cookie:_csrf",
+	}))
+
 	e.Use(middleware.CORS())
 
 	e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",

Fixed code: 		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4848: Improper Verification of Source of a Communication Channel (CWE-940)
value: Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CWE description: The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
CVSS v3 base score: 5.7
Published: 2022-12-29T18:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/acl.go, server/server.go
Commit date: 2022-12-30 00:17:19 +0800
Commit message: chore: fix CSRF (#876)


Diff: diff --git a/server/acl.go b/server/acl.go
index ccb67e8..87e5bad 100644
--- a/server/acl.go
+++ b/server/acl.go
@@ -25,10 +25,11 @@ func setUserSession(ctx echo.Context, user *api.User) error {
 	sess, _ := session.Get("memos_session", ctx)
 	sess.Options = &sessions.Options{
 		Path:     "/",
 		MaxAge:   3600 * 24 * 30,
 		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
 	}
 	sess.Values[userIDContextKey] = user.ID
 	err := sess.Save(ctx.Request(), ctx.Response())
 	if err != nil {
 		return fmt.Errorf("failed to set session, err: %w", err)
diff --git a/server/server.go b/server/server.go
index 243f26a..5e57ea8 100644
--- a/server/server.go
+++ b/server/server.go
@@ -34,10 +34,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Format: `{"time":"${time_rfc3339}",` +
 			`"method":"${method}","uri":"${uri}",` +
 			`"status":${status},"error":"${error}"}` + "\n",
 	}))
 
+	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+		TokenLookup: "cookie:_csrf",
+	}))
+
 	e.Use(middleware.CORS())
 
 	e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",

Fixed code: 		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4849: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2022-12-29T18:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/acl.go, server/server.go
Commit date: 2022-12-30 00:17:19 +0800
Commit message: chore: fix CSRF (#876)


Diff: diff --git a/server/acl.go b/server/acl.go
index ccb67e8..87e5bad 100644
--- a/server/acl.go
+++ b/server/acl.go
@@ -25,10 +25,11 @@ func setUserSession(ctx echo.Context, user *api.User) error {
 	sess, _ := session.Get("memos_session", ctx)
 	sess.Options = &sessions.Options{
 		Path:     "/",
 		MaxAge:   3600 * 24 * 30,
 		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
 	}
 	sess.Values[userIDContextKey] = user.ID
 	err := sess.Save(ctx.Request(), ctx.Response())
 	if err != nil {
 		return fmt.Errorf("failed to set session, err: %w", err)
diff --git a/server/server.go b/server/server.go
index 243f26a..5e57ea8 100644
--- a/server/server.go
+++ b/server/server.go
@@ -34,10 +34,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Format: `{"time":"${time_rfc3339}",` +
 			`"method":"${method}","uri":"${uri}",` +
 			`"status":${status},"error":"${error}"}` + "\n",
 	}))
 
+	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+		TokenLookup: "cookie:_csrf",
+	}))
+
 	e.Use(middleware.CORS())
 
 	e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",

Fixed code: 		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4850: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2022-12-29T18:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/acl.go, server/server.go
Commit date: 2022-12-30 00:17:19 +0800
Commit message: chore: fix CSRF (#876)


Diff: diff --git a/server/acl.go b/server/acl.go
index ccb67e8..87e5bad 100644
--- a/server/acl.go
+++ b/server/acl.go
@@ -25,10 +25,11 @@ func setUserSession(ctx echo.Context, user *api.User) error {
 	sess, _ := session.Get("memos_session", ctx)
 	sess.Options = &sessions.Options{
 		Path:     "/",
 		MaxAge:   3600 * 24 * 30,
 		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
 	}
 	sess.Values[userIDContextKey] = user.ID
 	err := sess.Save(ctx.Request(), ctx.Response())
 	if err != nil {
 		return fmt.Errorf("failed to set session, err: %w", err)
diff --git a/server/server.go b/server/server.go
index 243f26a..5e57ea8 100644
--- a/server/server.go
+++ b/server/server.go
@@ -34,10 +34,14 @@ func NewServer(profile *profile.Profile) *Server {
 		Format: `{"time":"${time_rfc3339}",` +
 			`"method":"${method}","uri":"${uri}",` +
 			`"status":${status},"error":"${error}"}` + "\n",
 	}))
 
+	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+		TokenLookup: "cookie:_csrf",
+	}))
+
 	e.Use(middleware.CORS())
 
 	e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
 		Skipper:      middleware.DefaultSkipper,
 		ErrorMessage: "Request timeout",

Fixed code: 		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2023-4696: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 9.8
Published: 2023-09-01T01:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/jwt.go
Commit date: 2023-06-30 14:59:52 +0000
Commit message: fix: validate access token (#1867)

* fix/to_valid_token

* eslint

* revert

* Update server/jwt.go

---------

Co-authored-by: boojack <stevenlgtm@gmail.com>
Diff: diff --git a/server/jwt.go b/server/jwt.go
index 4f6a31aa..2cb9af44 100644
--- a/server/jwt.go
+++ b/server/jwt.go
@@ -109,10 +109,15 @@ func JWTMiddleware(server *Server, next echo.HandlerFunc, secret string) echo.Ha
 					return []byte(secret), nil
 				}
 			}
 			return nil, errors.Errorf("unexpected access token kid=%v", t.Header["kid"])
 		})
+
+		if !accessToken.Valid {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Invalid access token.")
+		}
+
 		if !audienceContains(claims.Audience, auth.AccessTokenAudienceName) {
 			return echo.NewHTTPError(http.StatusUnauthorized, fmt.Sprintf("Invalid access token, audience mismatch, got %q, expected %q.", claims.Audience, auth.AccessTokenAudienceName))
 		}
 		generateToken := time.Until(claims.ExpiresAt.Time) < auth.RefreshThresholdDuration
 		if err != nil {

Fixed code: 
		if !accessToken.Valid {
			return echo.NewHTTPError(http.StatusUnauthorized, "Invalid access token.")
		}
CVE-2023-4697: Improper Privilege Management (CWE-269)
value: Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 8.8
Published: 2023-09-01T01:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/jwt.go
Commit date: 2023-06-30 14:59:52 +0000
Commit message: fix: validate access token (#1867)

* fix/to_valid_token

* eslint

* revert

* Update server/jwt.go

---------

Co-authored-by: boojack <stevenlgtm@gmail.com>
Diff: diff --git a/server/jwt.go b/server/jwt.go
index 4f6a31aa..2cb9af44 100644
--- a/server/jwt.go
+++ b/server/jwt.go
@@ -109,10 +109,15 @@ func JWTMiddleware(server *Server, next echo.HandlerFunc, secret string) echo.Ha
 					return []byte(secret), nil
 				}
 			}
 			return nil, errors.Errorf("unexpected access token kid=%v", t.Header["kid"])
 		})
+
+		if !accessToken.Valid {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Invalid access token.")
+		}
+
 		if !audienceContains(claims.Audience, auth.AccessTokenAudienceName) {
 			return echo.NewHTTPError(http.StatusUnauthorized, fmt.Sprintf("Invalid access token, audience mismatch, got %q, expected %q.", claims.Audience, auth.AccessTokenAudienceName))
 		}
 		generateToken := time.Until(claims.ExpiresAt.Time) < auth.RefreshThresholdDuration
 		if err != nil {

Fixed code: 
		if !accessToken.Valid {
			return echo.NewHTTPError(http.StatusUnauthorized, "Invalid access token.")
		}
CVE-2023-4698: Improper Input Validation (CWE-20)
value: Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2023-09-01T01:15Z
Repository: https://github.com/usememos/memos
Language: Go
Files changed: server/jwt.go
Commit date: 2023-06-30 14:59:52 +0000
Commit message: fix: validate access token (#1867)

* fix/to_valid_token

* eslint

* revert

* Update server/jwt.go

---------

Co-authored-by: boojack <stevenlgtm@gmail.com>
Diff: diff --git a/server/jwt.go b/server/jwt.go
index 4f6a31aa..2cb9af44 100644
--- a/server/jwt.go
+++ b/server/jwt.go
@@ -109,10 +109,15 @@ func JWTMiddleware(server *Server, next echo.HandlerFunc, secret string) echo.Ha
 					return []byte(secret), nil
 				}
 			}
 			return nil, errors.Errorf("unexpected access token kid=%v", t.Header["kid"])
 		})
+
+		if !accessToken.Valid {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Invalid access token.")
+		}
+
 		if !audienceContains(claims.Audience, auth.AccessTokenAudienceName) {
 			return echo.NewHTTPError(http.StatusUnauthorized, fmt.Sprintf("Invalid access token, audience mismatch, got %q, expected %q.", claims.Audience, auth.AccessTokenAudienceName))
 		}
 		generateToken := time.Until(claims.ExpiresAt.Time) < auth.RefreshThresholdDuration
 		if err != nil {

Fixed code: 
		if !accessToken.Valid {
			return echo.NewHTTPError(http.StatusUnauthorized, "Invalid access token.")
		}