CVE-2023-4876: Insufficient Information (NVD-CWE-noinfo)
value: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-09-10T01:15Z
Repository: https://github.com/hamza417/inure
Language: Kotlin
Files changed: app/src/main/assets/html/changelogs.html, app/src/main/java/app/simple/inure/adapters/ui/AdapterTags.kt
Commit date: 2023-08-30 00:31:11 +0530
Commit message: Build92

  - Fixed tags crashing

Diff: diff --git a/app/src/main/assets/html/changelogs.html b/app/src/main/assets/html/changelogs.html
index 204f4da0e..29d5044d4 100644
--- a/app/src/main/assets/html/changelogs.html
+++ b/app/src/main/assets/html/changelogs.html
@@ -15,66 +15,89 @@
 <sub>(Current Version)</sub>
 <h2>Build91</h2>
 
 <!-- Write change logs here -->
 
-<h4>User Interface</h4>
+<h4>Bug Fixes</h4>
 
 <ul>
-    <li>Added Open Source logo on the apps that are FOSS in nature or was FOSS somewhere in the
-        past.
-        <br>
-        <small>This will use F-Droid and IzzyOnDroid repo data to identify and validate in runtime
-               if the app is FOSS or not. Any other repo isn't supported and likely won't be
-               supported in the future.</small>
-    </li>
-    <li>Added self app updater for auto downloading latest update builds.
-        <br>
-        <small>For GitHub releases only, Play releases are Play Store dependent and Play API is not
-               open source.</small>
-    </li>
-    <li>Updated <b>Home</b> panel UI to make it consistent with the app's design language.</li>
-    <li>Added <b>Tags</b> to assign indefinite tags to any app and create a personalized app groups.
-    </li>
-    <li>Added <i>Tags</i> filter in <b>Search</b> panel.
-        <br>
-        <small>Use <b>#</b> before any keyword to enable tag search mode.</small>
-    </li>
-    <li>Added <i>Tags</i> strip in <b>Search</b> panel.</li>
+    <li>Fixed <b>Tags</b> crashing on opening after a tag is deleted.</li>
 </ul>
 
-<h4>Bug Fixes</h4>
+<br>
+<br>
+<div class="wrap-collapsible">
+    <input class="toggle" id="build_91" type="checkbox">
+    <label class="lbl-toggle" for="build_91">Build91</label>
+    <div class="collapsible-content">
+        <div class="content-inner">
+            <h4>User Interface</h4>
 
-<ul>
-    <li>Fixed an issue that's crashing the app info loader for non-installed apps.</li>
-    <li>Fixed a few random crashes.</li>
-    <li>Fixed no data issue in <b>Uses Features</b> panel.</li>
-</ul>
+            <ul>
+                <li>Added Open Source logo on the apps that are FOSS in nature or was FOSS somewhere
+                    in the
+                    past.
+                    <br>
+                    <small>This will use F-Droid and IzzyOnDroid repo data to identify and validate
+                           in runtime
+                           if the app is FOSS or not. Any other repo isn't supported and likely
+                           won't be
+                           supported in the future.</small>
+                </li>
+                <li>Added self app updater for auto downloading latest update builds.
+                    <br>
+                    <small>For GitHub releases only, Play releases are Play Store dependent and Play
+                           API is not
+                           open source.</small>
+                </li>
+                <li>Updated <b>Home</b> panel UI to make it consistent with the app's design
+                    language.
+                </li>
+                <li>Added <b>Tags</b> to assign indefinite tags to any app and create a personalized
+                    app groups.
+                </li>
+                <li>Added <i>Tags</i> filter in <b>Search</b> panel.
+                    <br>
+                    <small>Use <b>#</b> before any keyword to enable tag search mode.</small>
+                </li>
+                <li>Added <i>Tags</i> strip in <b>Search</b> panel.</li>
+            </ul>
 
-<h4>Improvement</h4>
+            <h4>Bug Fixes</h4>
 
-<ul>
-    <li>Improved layouts and animations for Arabic locale.</li>
-    <li>Updated <b>Shortcuts</b> panel interface.</li>
-    <li>Some improvements in animations framework.</li>
-    <li>Further improvements in communication between bottom menu and fast scroller.</li>
-</ul>
+            <ul>
+                <li>Fixed an issue that's crashing the app info loader for non-installed apps.</li>
+                <li>Fixed a few random crashes.</li>
+                <li>Fixed no data issue in <b>Uses Features</b> panel.</li>
+            </ul>
 
-<h4>Removed</h4>
+            <h4>Improvement</h4>
 
-<ul>
-    <li>Removed <b>Dex Classes</b> for non-installed apps.</li>
-</ul>
+            <ul>
+                <li>Improved layouts and animations for Arabic locale.</li>
+                <li>Updated <b>Shortcuts</b> panel interface.</li>
+                <li>Some improvements in animations framework.</li>
+                <li>Further improvements in communication between bottom menu and fast scroller.
+                </li>
+            </ul>
 
-<h4>Changes</h4>
+            <h4>Removed</h4>
 
-<ul>
-    <li>Put a limit on search for up to 3 characters to prevent unnecessary search triggers.</li>
-</ul>
+            <ul>
+                <li>Removed <b>Dex Classes</b> for non-installed apps.</li>
+            </ul>
 
-<br>
-<br>
+            <h4>Changes</h4>
+
+            <ul>
+                <li>Put a limit on search for up to 3 characters to prevent unnecessary search
+                    triggers.
+                </li>
+            </ul>
+        </div>
+    </div>
+</div>
 <br>
 <p>
     Build90 was skipped.
 </p>
 <br>
diff --git a/app/src/main/java/app/simple/inure/adapters/ui/AdapterTags.kt b/app/src/main/java/app/simple/inure/adapters/ui/AdapterTags.kt
index 128002605..13aab330f 100644
--- a/app/src/main/java/app/simple/inure/adapters/ui/AdapterTags.kt
+++ b/app/src/main/java/app/simple/inure/adapters/ui/AdapterTags.kt
@@ -40,20 +40,20 @@ class AdapterTags(val tags: ArrayList<Tag>, private val tagsCallback: TagsCallba
         when (holder) {
             is Header -> {
                 holder.total.text = holder.itemView.context.getString(R.string.total_tags, tags.size)
             }
             is Holder -> {
-                holder.tag.text = tags[position - 1].tag
-                holder.recyclerView.adapter = AdapterTaggedIcons(tags[position - 1].packages.split(","))
-                holder.date.text = tags[position - 1].dateAdded.toDate()
+                holder.tag.text = tags[holder.bindingAdapterPosition.minus(1)].tag
+                holder.recyclerView.adapter = AdapterTaggedIcons(tags[holder.bindingAdapterPosition.minus(1)].packages.split(","))
+                holder.date.text = tags[holder.bindingAdapterPosition.minus(1)].dateAdded.toDate()
 
                 holder.container.setOnClickListener {
-                    tagsCallback.onTagClicked(tags[position - 1])
+                    tagsCallback.onTagClicked(tags[holder.bindingAdapterPosition.minus(1)])
                 }
 
                 holder.container.setOnLongClickListener {
-                    tagsCallback.onTagLongClicked(tags[position - 1])
+                    tagsCallback.onTagLongClicked(tags[holder.bindingAdapterPosition.minus(1)])
                     true
                 }
             }
         }
     }

Vulnerable code: <h4>User Interface</h4>
    <li>Added Open Source logo on the apps that are FOSS in nature or was FOSS somewhere in the
        past.
        <br>
        <small>This will use F-Droid and IzzyOnDroid repo data to identify and validate in runtime
               if the app is FOSS or not. Any other repo isn't supported and likely won't be
               supported in the future.</small>
    </li>
    <li>Added self app updater for auto downloading latest update builds.
        <br>
        <small>For GitHub releases only, Play releases are Play Store dependent and Play API is not
               open source.</small>
    </li>
    <li>Updated <b>Home</b> panel UI to make it consistent with the app's design language.</li>
    <li>Added <b>Tags</b> to assign indefinite tags to any app and create a personalized app groups.
    </li>
    <li>Added <i>Tags</i> filter in <b>Search</b> panel.
        <br>
        <small>Use <b>#</b> before any keyword to enable tag search mode.</small>
    </li>
    <li>Added <i>Tags</i> strip in <b>Search</b> panel.</li>
<h4>Bug Fixes</h4>
<ul>
    <li>Fixed an issue that's crashing the app info loader for non-installed apps.</li>
    <li>Fixed a few random crashes.</li>
    <li>Fixed no data issue in <b>Uses Features</b> panel.</li>
</ul>
<h4>Improvement</h4>
<ul>
    <li>Improved layouts and animations for Arabic locale.</li>
    <li>Updated <b>Shortcuts</b> panel interface.</li>
    <li>Some improvements in animations framework.</li>
    <li>Further improvements in communication between bottom menu and fast scroller.</li>
</ul>
<h4>Removed</h4>
<ul>
    <li>Removed <b>Dex Classes</b> for non-installed apps.</li>
</ul>
<h4>Changes</h4>
<ul>
    <li>Put a limit on search for up to 3 characters to prevent unnecessary search triggers.</li>
</ul>
<br>
<br>
                holder.tag.text = tags[position - 1].tag
                holder.recyclerView.adapter = AdapterTaggedIcons(tags[position - 1].packages.split(","))
                holder.date.text = tags[position - 1].dateAdded.toDate()
                    tagsCallback.onTagClicked(tags[position - 1])
                    tagsCallback.onTagLongClicked(tags[position - 1])
Fixed code: <h4>Bug Fixes</h4>
    <li>Fixed <b>Tags</b> crashing on opening after a tag is deleted.</li>
<br>
<br>
<div class="wrap-collapsible">
    <input class="toggle" id="build_91" type="checkbox">
    <label class="lbl-toggle" for="build_91">Build91</label>
    <div class="collapsible-content">
        <div class="content-inner">
            <h4>User Interface</h4>
            <ul>
                <li>Added Open Source logo on the apps that are FOSS in nature or was FOSS somewhere
                    in the
                    past.
                    <br>
                    <small>This will use F-Droid and IzzyOnDroid repo data to identify and validate
                           in runtime
                           if the app is FOSS or not. Any other repo isn't supported and likely
                           won't be
                           supported in the future.</small>
                </li>
                <li>Added self app updater for auto downloading latest update builds.
                    <br>
                    <small>For GitHub releases only, Play releases are Play Store dependent and Play
                           API is not
                           open source.</small>
                </li>
                <li>Updated <b>Home</b> panel UI to make it consistent with the app's design
                    language.
                </li>
                <li>Added <b>Tags</b> to assign indefinite tags to any app and create a personalized
                    app groups.
                </li>
                <li>Added <i>Tags</i> filter in <b>Search</b> panel.
                    <br>
                    <small>Use <b>#</b> before any keyword to enable tag search mode.</small>
                </li>
                <li>Added <i>Tags</i> strip in <b>Search</b> panel.</li>
            </ul>
            <h4>Bug Fixes</h4>
            <ul>
                <li>Fixed an issue that's crashing the app info loader for non-installed apps.</li>
                <li>Fixed a few random crashes.</li>
                <li>Fixed no data issue in <b>Uses Features</b> panel.</li>
            </ul>
            <h4>Improvement</h4>
            <ul>
                <li>Improved layouts and animations for Arabic locale.</li>
                <li>Updated <b>Shortcuts</b> panel interface.</li>
                <li>Some improvements in animations framework.</li>
                <li>Further improvements in communication between bottom menu and fast scroller.
                </li>
            </ul>
            <h4>Removed</h4>
            <ul>
                <li>Removed <b>Dex Classes</b> for non-installed apps.</li>
            </ul>
            <h4>Changes</h4>

            <ul>
                <li>Put a limit on search for up to 3 characters to prevent unnecessary search
                    triggers.
                </li>
            </ul>
        </div>
    </div>
</div>
                holder.tag.text = tags[holder.bindingAdapterPosition.minus(1)].tag
                holder.recyclerView.adapter = AdapterTaggedIcons(tags[holder.bindingAdapterPosition.minus(1)].packages.split(","))
                holder.date.text = tags[holder.bindingAdapterPosition.minus(1)].dateAdded.toDate()
                    tagsCallback.onTagClicked(tags[holder.bindingAdapterPosition.minus(1)])
                    tagsCallback.onTagLongClicked(tags[holder.bindingAdapterPosition.minus(1)])