Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-39165: Improper Authentication (CWE-287)
value: Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 6.5
Published: 2021-08-26T21:15Z
Repository: https://github.com/fiveai/Cachet
Language: PHP
Files changed: app/Models/Traits/SearchableTrait.php
Commit date: 2021-01-15 14:17:35 +0000
Commit message: Ensure only allowed searchable columns are used in DB Query

Diff: diff --git a/app/Models/Traits/SearchableTrait.php b/app/Models/Traits/SearchableTrait.php
index 8038b47a..8db2300e 100644
--- a/app/Models/Traits/SearchableTrait.php
+++ b/app/Models/Traits/SearchableTrait.php
@@ -32,12 +32,13 @@ trait SearchableTrait
     {
         if (empty($search)) {
             return $query;
         }
 
-        if (!array_intersect(array_keys($search), $this->searchable)) {
+        $allowed_search = array_intersect_key($search, array_flip($this->searchable));
+        if (! $allowed_search) {
             return $query;
         }
 
-        return $query->where($search);
+        return $query->where($allowed_search);
     }
 }

Vulnerable code:         if (!array_intersect(array_keys($search), $this->searchable)) {
        return $query->where($search);
Fixed code:         $allowed_search = array_intersect_key($search, array_flip($this->searchable));
        if (! $allowed_search) {
        return $query->where($allowed_search);
CVE-2021-39165: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 6.5
Published: 2021-08-26T21:15Z
Repository: https://github.com/fiveai/Cachet
Language: PHP
Files changed: app/Models/Traits/SearchableTrait.php
Commit date: 2021-01-15 14:17:35 +0000
Commit message: Ensure only allowed searchable columns are used in DB Query

Diff: diff --git a/app/Models/Traits/SearchableTrait.php b/app/Models/Traits/SearchableTrait.php
index 8038b47a..8db2300e 100644
--- a/app/Models/Traits/SearchableTrait.php
+++ b/app/Models/Traits/SearchableTrait.php
@@ -32,12 +32,13 @@ trait SearchableTrait
     {
         if (empty($search)) {
             return $query;
         }
 
-        if (!array_intersect(array_keys($search), $this->searchable)) {
+        $allowed_search = array_intersect_key($search, array_flip($this->searchable));
+        if (! $allowed_search) {
             return $query;
         }
 
-        return $query->where($search);
+        return $query->where($allowed_search);
     }
 }

Vulnerable code:         if (!array_intersect(array_keys($search), $this->searchable)) {
        return $query->where($search);
Fixed code:         $allowed_search = array_intersect_key($search, array_flip($this->searchable));
        if (! $allowed_search) {
        return $query->where($allowed_search);
CVE-2023-5897: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-11-01T01:15Z
Repository: https://github.com/pkp/customLocale
Language: PHP
Files changed: controllers/grid/CustomLocaleGridHandler.php, templates/localeFile.tpl
Commit date: 2023-10-03 12:35:44 -0700
Commit message: https://github.com/pkp/customLocale/issues/27 Add CSRF checking

Diff: diff --git a/controllers/grid/CustomLocaleGridHandler.php b/controllers/grid/CustomLocaleGridHandler.php
index f456476..ed7bb95 100644
--- a/controllers/grid/CustomLocaleGridHandler.php
+++ b/controllers/grid/CustomLocaleGridHandler.php
@@ -72,10 +72,12 @@ class CustomLocaleGridHandler extends GridHandler
      */
     public function updateLocale(array $args, PKPRequest $request): JSONMessage
     {
         ['locale' => $locale, 'changes' => $changes] = $args;
 
+	if (!$request->checkCSRF()) return new JSONMessage(false);
+
         if (!count($changes)) {
             $this->setupTemplate($request);
             // Create and present the edit form
             $localeFileForm = new LocaleFileForm(self::$plugin, $locale);
             $localeFileForm->initData();
diff --git a/templates/localeFile.tpl b/templates/localeFile.tpl
index b6f7ab2..36cb9f8 100644
--- a/templates/localeFile.tpl
+++ b/templates/localeFile.tpl
@@ -5,10 +5,11 @@
  * Distributed under the GNU GPL v3. For full terms see the file docs/COPYING.
  *
  *}
 
 <form class="pkp_form" id="localeFilesForm" method="post" action="{url router=$smarty.const.ROUTE_COMPONENT component="plugins.generic.customLocale.controllers.grid.CustomLocaleGridHandler" op="updateLocale" locale=$locale key=$name anchor="localeContents"}">
+	{csrf}
 	<link rel="stylesheet" href="{$baseUrl}/plugins/generic/customLocale/css/customLocale.css" type="text/css" />
 	<div id="customLocales">
 		{* TABLE *}
 		<table class="pkpTable">
 			{* TABLE HEADER *}
@@ -183,6 +184,6 @@
 			customLocalesApp.data.edited = {ldelim}{rdelim};
 		{/if}
 		customLocalesApp.data.localeKeysMaster = {$referenceLocaleContents|json_encode};
 		new pkp.Vue(customLocalesApp);
 	</script>
-</form>
\ No newline at end of file
+</form>

Vulnerable code: </form>
Fixed code: 	if (!$request->checkCSRF()) return new JSONMessage(false);

	{csrf}
</form>
CVE-2021-32640: Uncontrolled Resource Consumption (CWE-400)
value: ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.3
Published: 2021-05-25T19:15Z
Repository: https://github.com/websockets/ws
Language: JavaScript
Files changed: lib/websocket-server.js
Commit date: 2021-05-25 18:09:51 +0200
Commit message: [security] Fix ReDoS vulnerability

A specially crafted value of the `Sec-Websocket-Protocol` header could
be used to significantly slow down a ws server.

PoC and fix were sent privately by Robert McLaughlin from University of
California, Santa Barbara.

Diff: diff --git a/lib/websocket-server.js b/lib/websocket-server.js
index b99ad05..3c3bbe0 100644
--- a/lib/websocket-server.js
+++ b/lib/websocket-server.js
@@ -284,11 +284,11 @@ class WebSocketServer extends EventEmitter {
 
     const ws = new WebSocket(null);
     let protocol = req.headers['sec-websocket-protocol'];
 
     if (protocol) {
-      protocol = protocol.trim().split(/ *, */);
+      protocol = protocol.split(',').map(trim);
 
       //
       // Optionally call external protocol selection handler.
       //
       if (this.options.handleProtocols) {
@@ -402,5 +402,17 @@ function abortHandshake(socket, code, message, headers) {
   }
 
   socket.removeListener('error', socketOnError);
   socket.destroy();
 }
+
+/**
+ * Remove whitespace characters from both ends of a string.
+ *
+ * @param {String} str The string
+ * @return {String} A new string representing `str` stripped of whitespace
+ *     characters from both its beginning and end
+ * @private
+ */
+function trim(str) {
+  return str.trim();
+}

Vulnerable code:       protocol = protocol.trim().split(/ *, */);
Fixed code:       protocol = protocol.split(',').map(trim);

/**
 * Remove whitespace characters from both ends of a string.
 *
 * @param {String} str The string
 * @return {String} A new string representing `str` stripped of whitespace
 *     characters from both its beginning and end
 * @private
 */
function trim(str) {
  return str.trim();
}
CVE-2024-32879: Insufficient Information (NVD-CWE-noinfo)
value: Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-24T20:15Z
Repository: https://github.com/python-social-auth/social-app-django
Language: Python
Files changed: social_django/models.py
Commit date: 2024-04-24 10:38:41 +0200
Commit message: models: make sure uid is compared case-sensitive

The database collation might vary, so use safer comparing in Python.

Diff: diff --git a/social_django/models.py b/social_django/models.py
index ab50185..a5314cb 100644
--- a/social_django/models.py
+++ b/social_django/models.py
@@ -52,15 +52,19 @@ class AbstractUserSocialAuth(models.Model, DjangoUserMixin):
     class Meta:
         app_label = "social_django"
         abstract = True
 
     @classmethod
-    def get_social_auth(cls, provider, uid):
-        try:
-            return cls.objects.select_related("user").get(provider=provider, uid=uid)
-        except cls.DoesNotExist:
-            return None
+    def get_social_auth(cls, provider: str, uid: str):
+        for social in cls.objects.select_related("user").filter(
+            provider=provider, uid=uid
+        ):
+            # We need to compare to filter out case-insensitive lookups in
+            # some databases (MySQL/MariaDB)
+            if social.uid == uid:
+                return social
+        return None
 
     @classmethod
     def username_max_length(cls):
         username_field = cls.username_field()
         field = cls.user_model()._meta.get_field(username_field)

Vulnerable code:     def get_social_auth(cls, provider, uid):
        try:
            return cls.objects.select_related("user").get(provider=provider, uid=uid)
        except cls.DoesNotExist:
            return None
Fixed code:     def get_social_auth(cls, provider: str, uid: str):
        for social in cls.objects.select_related("user").filter(
            provider=provider, uid=uid
        ):
            # We need to compare to filter out case-insensitive lookups in
            # some databases (MySQL/MariaDB)
            if social.uid == uid:
                return social
        return None
CVE-2021-37794: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-08-31T18:15Z
Repository: https://github.com/filebrowser/filebrowser
Language: Go
Files changed: http/http.go
Commit date: 2021-07-26 11:08:39 +0200
Commit message: chore: add Content-Security-Policy header

Diff: diff --git a/http/http.go b/http/http.go
index bc798561..88acea75 100644
--- a/http/http.go
+++ b/http/http.go
@@ -23,10 +23,16 @@ func NewHandler(
 	assetsFs fs.FS,
 ) (http.Handler, error) {
 	server.Clean()
 
 	r := mux.NewRouter()
+	r.Use(func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Security-Policy", `default-src 'self'`)
+			next.ServeHTTP(w, r)
+		})
+	})
 	index, static := getStaticHandlers(store, server, assetsFs)
 
 	// NOTE: This fixes the issue where it would redirect if people did not put a
 	// trailing slash in the end. I hate this decision since this allows some awful
 	// URLs https://www.gorillatoolkit.org/pkg/mux#Router.SkipClean

Fixed code: 	r.Use(func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Content-Security-Policy", `default-src 'self'`)
			next.ServeHTTP(w, r)
		})
	})
CVE-2021-46398: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2022-02-04T16:15Z
Repository: https://github.com/filebrowser/filebrowser
Language: Go
Files changed: http/commands.go
Commit date: 2021-10-31 17:13:16 +0100
Commit message: fix: security issue in command runner (closes #1621)

Diff: diff --git a/http/commands.go b/http/commands.go
index 173e57a9..48c7f297 100644
--- a/http/commands.go
+++ b/http/commands.go
@@ -57,23 +57,23 @@ var commandsHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *d
 		if raw != "" {
 			break
 		}
 	}
 
-	if !d.server.EnableExec || !d.user.CanExecute(strings.Split(raw, " ")[0]) {
-		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet
+	command, err := runner.ParseCommand(d.settings, raw)
+	if err != nil {
+		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet
 			wsErr(conn, r, http.StatusInternalServerError, err)
 		}
-
 		return 0, nil
 	}
 
-	command, err := runner.ParseCommand(d.settings, raw)
-	if err != nil {
-		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet
+	if !d.server.EnableExec || !d.user.CanExecute(command[0]) {
+		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet
 			wsErr(conn, r, http.StatusInternalServerError, err)
 		}
+
 		return 0, nil
 	}
 
 	cmd := exec.Command(command[0], command[1:]...) //nolint:gosec
 	cmd.Dir = d.user.FullPath(r.URL.Path)

Vulnerable code: 	if !d.server.EnableExec || !d.user.CanExecute(strings.Split(raw, " ")[0]) {
		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet

	command, err := runner.ParseCommand(d.settings, raw)
	if err != nil {
		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet
Fixed code: 	command, err := runner.ParseCommand(d.settings, raw)
	if err != nil {
		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet
	if !d.server.EnableExec || !d.user.CanExecute(command[0]) {
		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet
CVE-2023-39612: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2023-09-16T01:15Z
Repository: https://github.com/filebrowser/filebrowser
Language: Go
Files changed: http/raw.go
Commit date: 2023-07-27 11:42:27 +0200
Commit message: fix: xss vulnerability in /api/raw (#2570) (#2572)


Diff: diff --git a/http/raw.go b/http/raw.go
index 1312510b..9bf982e9 100644
--- a/http/raw.go
+++ b/http/raw.go
@@ -205,10 +205,10 @@ func rawFileHandler(w http.ResponseWriter, r *http.Request, file *files.FileInfo
 		return http.StatusInternalServerError, err
 	}
 	defer fd.Close()
 
 	setContentDisposition(w, r, file)
-
+	w.Header().Add("Content-Security-Policy", `script-src 'none';`)
 	w.Header().Set("Cache-Control", "private")
 	http.ServeContent(w, r, file.Name, file.ModTime, fd)
 	return 0, nil
 }

Fixed code: 	w.Header().Add("Content-Security-Policy", `script-src 'none';`)
CVE-2018-7560: Improper Input Validation (CWE-20)
value: index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2018-03-04T20:29Z
Repository: https://github.com/myshenin/aws-lambda-multipart-parser
Language: JSON
Files changed: index.js, package.json
Commit date: 2018-03-04 07:24:21 +0100
Commit message: security update

Diff: diff --git a/index.js b/index.js
index d8626fb..e30fb44 100644
--- a/index.js
+++ b/index.js
@@ -5,11 +5,11 @@ function getValueIgnoringKeyCase(obj, lookedKey) {
 }
 
 module.exports.parse = (event, spotText) => {
     const boundary = getValueIgnoringKeyCase(event.headers, 'Content-Type').split('=')[1];
     const body = (event.isBase64Encoded ? Buffer.from(event.body, 'base64').toString('binary') : event.body)
-        .split(new RegExp(boundary))
+        .split(boundary)
         .filter(item => item.match(/Content-Disposition/))
         .map((item) => {
             if (item.match(/filename/)) {
                 const result = {};
                 result[
diff --git a/package.json b/package.json
index 0db7dee..be8d531 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "aws-lambda-multipart-parser",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Parser of multipart/form-data requests for AWS Lambda",
   "main": "index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
   },

Vulnerable code:         .split(new RegExp(boundary))
  "version": "0.1.1",
Fixed code:         .split(boundary)
  "version": "0.1.2",
CVE-2015-10058: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in Wikisource Category Browser. This affects an unknown part of the file index.php. The manipulation of the argument lang leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 764f4e8ce3f9242637df77530c70ae8a2ec4b6a1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218415.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-17T13:15Z
Repository: https://github.com/wikisource/ws-cat-browser
Language: PHP
Files changed: index.php
Commit date: 2015-07-11 08:16:52 +0800
Commit message: Merge branch 'xss' of https://github.com/ricordisamoa/ws-cat-browser

Conflicts:
	index.php

Diff: diff --cc index.php
index bb54ea2,6a69fff..a5e1e2f
--- a/index.php
+++ b/index.php
@@@ -1,10 -1,10 +1,10 @@@
  <?php
  require 'config.php';
  
- $lang = (isset($_GET['lang'])) ? $_GET['lang'] : 'en';
+ $lang = (isset($_GET['lang'])) ? htmlspecialchars($_GET['lang']) : 'en';
 -if ( !in_array($lang, array_keys($dbs))) {
 +if ( !array_key_exists($lang, $dbs)) {
      $err = "The language '$lang' has not yet been included. Please lodge an issue.";
  }
  $suffix = $lang=='en' ? '' : '_'.$lang;
  
  ?><!doctype html>

Vulnerable code:  $lang = (isset($_GET['lang'])) ? $_GET['lang'] : 'en';
Fixed code:  $lang = (isset($_GET['lang'])) ? htmlspecialchars($_GET['lang']) : 'en';
CVE-2021-29435: Cross-Site Request Forgery (CSRF) (CWE-352)
value: trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials. The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2021-04-13T20:15Z
Repository: https://github.com/TrestleAdmin/trestle-auth
Language: Ruby
Files changed: lib/trestle/auth/controller/authentication.rb
Commit date: 2021-04-12 19:42:49 +0930
Commit message: Ensure CSRF protection is prepended before authentication before_actions

Diff: diff --git a/lib/trestle/auth/controller/authentication.rb b/lib/trestle/auth/controller/authentication.rb
index d37fc9b..0b0462b 100644
--- a/lib/trestle/auth/controller/authentication.rb
+++ b/lib/trestle/auth/controller/authentication.rb
@@ -7,10 +7,13 @@ module Trestle
         included do
           helper_method :current_user, :logged_in?, :authentication_scope
 
           prepend_before_action :require_authenticated_user
           prepend_before_action :authenticate_user
+
+          # Ensure that CSRF protection happens before authentication
+          protect_from_forgery prepend: true
         end
 
       protected
         def authentication_backend
           @_authentication_backend ||= Trestle.config.auth.backend.new(controller: self, request: request, session: session, cookies: cookies)

Fixed code: 
          # Ensure that CSRF protection happens before authentication
          protect_from_forgery prepend: true
CVE-2021-40642: Missing Encryption of Sensitive Data (CWE-311)
value: Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.
CWE description: The product does not encrypt sensitive or critical information before storage or transmission.
CVSS v3 base score: 4.3
Published: 2022-06-29T11:15Z
Repository: https://github.com/textpattern/textpattern
Language: PHP
Files changed: textpattern/lib/txplib_misc.php
Commit date: 2021-08-31 22:53:20 +0200
Commit message: Secure cookie test

Diff: diff --git a/textpattern/lib/txplib_misc.php b/textpattern/lib/txplib_misc.php
index e323307e9..9677bf1c5 100644
--- a/textpattern/lib/txplib_misc.php
+++ b/textpattern/lib/txplib_misc.php
@@ -1031,11 +1031,11 @@ function set_cookie($name, $value = '', $options = array())
 {
     $options += array (
         'expires' => time() - 3600,
         'path' => '',
         'domain' => '',
-        'secure' => false,
+        'secure' => strtolower(PROTOCOL) == 'https://',
         'httponly' => false,
         'samesite' => 'Lax' // None || Lax  || Strict
     );
 
     if (version_compare(phpversion(), '7.3.0') >= 0) {

Vulnerable code:         'secure' => false,
Fixed code:         'secure' => strtolower(PROTOCOL) == 'https://',
CVE-2022-28451: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-05-02T00:15Z
Repository: https://github.com/nopSolutions/nopCommerce
Language: C#
Files changed: src/Presentation/Nop.Web/Areas/Admin/Controllers/CommonController.cs
Commit date: 2022-03-28 11:12:02 +0300
Commit message: Fixed a possible issue with database backup filenames

Diff: diff --git a/src/Presentation/Nop.Web/Areas/Admin/Controllers/CommonController.cs b/src/Presentation/Nop.Web/Areas/Admin/Controllers/CommonController.cs
index 69ca0f6f4f..ab7f9ea2e0 100644
--- a/src/Presentation/Nop.Web/Areas/Admin/Controllers/CommonController.cs
+++ b/src/Presentation/Nop.Web/Areas/Admin/Controllers/CommonController.cs
@@ -260,10 +260,12 @@ namespace Nop.Web.Areas.Admin.Controllers
                 return AccessDeniedView();
 
             var action = Request.Form["action"];
 
             var fileName = Request.Form["backupFileName"];
+            fileName = _fileProvider.GetFileName(_fileProvider.GetAbsolutePath(fileName));
+
             var backupPath = _maintenanceService.GetBackupPath(fileName);
 
             try
             {
                 switch (action)

Fixed code:             fileName = _fileProvider.GetFileName(_fileProvider.GetAbsolutePath(fileName));
CVE-2015-7541: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 10
Published: 2016-01-08T21:59Z
Repository: https://github.com/quadule/colorscore
Language: Ruby
Files changed: lib/colorscore/histogram.rb
Commit date: 2016-01-06 02:03:00 -0500
Commit message: Fix CVE-2015-7541

Avoid passsing possible user input directly into the shell. Instead
quote the `image_path` value before calling the `convert` command.

See here http://rubysec.com/advisories/CVE-2015-7541/ for more
information.
Diff: diff --git a/lib/colorscore/histogram.rb b/lib/colorscore/histogram.rb
index 3c2d1b1..4debcd5 100644
--- a/lib/colorscore/histogram.rb
+++ b/lib/colorscore/histogram.rb
@@ -1,9 +1,11 @@
+require "shellwords"
+
 module Colorscore
   class Histogram
     def initialize(image_path, colors=16, depth=8)
-      output = `convert #{image_path} -resize 400x400 -format %c -dither None -quantize YIQ -colors #{colors} -depth #{depth} histogram:info:-`
+      output = `convert #{image_path.shellescape} -resize 400x400 -format %c -dither None -quantize YIQ -colors #{colors.to_i} -depth #{depth.to_i} histogram:info:-`
       @lines = output.lines.sort.reverse.map(&:strip).reject(&:empty?)
     end
 
     # Returns an array of colors in descending order of occurances.
     def colors

Vulnerable code:       output = `convert #{image_path} -resize 400x400 -format %c -dither None -quantize YIQ -colors #{colors} -depth #{depth} histogram:info:-`
Fixed code: require "shellwords"

      output = `convert #{image_path.shellescape} -resize 400x400 -format %c -dither None -quantize YIQ -colors #{colors.to_i} -depth #{depth.to_i} histogram:info:-`
CVE-2018-15531: Improper Restriction of XML External Entity Reference (CWE-611)
value: JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2018-09-26T22:29Z
Repository: https://github.com/javamelody/javamelody
Language: Java
Files changed: javamelody-core/src/main/java/net/bull/javamelody/PayloadNameRequestWrapper.java
Commit date: 2018-09-04 08:31:29 +0200
Commit message: fix for security

Diff: diff --git a/javamelody-core/src/main/java/net/bull/javamelody/PayloadNameRequestWrapper.java b/javamelody-core/src/main/java/net/bull/javamelody/PayloadNameRequestWrapper.java
index c2affb3b..f03c1419 100644
--- a/javamelody-core/src/main/java/net/bull/javamelody/PayloadNameRequestWrapper.java
+++ b/javamelody-core/src/main/java/net/bull/javamelody/PayloadNameRequestWrapper.java
@@ -233,10 +233,12 @@ public class PayloadNameRequestWrapper extends HttpServletRequestWrapper {
 	 */
 	private static String parseSoapMethodName(InputStream stream, String charEncoding) {
 		try {
 			// newInstance() et pas newFactory() pour java 1.5 (issue 367)
 			final XMLInputFactory factory = XMLInputFactory.newInstance();
+			factory.setProperty(XMLInputFactory.SUPPORT_DTD, false); // disable DTDs entirely for that factory
+			factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); // disable external entities
 			final XMLStreamReader xmlReader;
 			if (charEncoding != null) {
 				xmlReader = factory.createXMLStreamReader(stream, charEncoding);
 			} else {
 				xmlReader = factory.createXMLStreamReader(stream);

Fixed code: 			factory.setProperty(XMLInputFactory.SUPPORT_DTD, false); // disable DTDs entirely for that factory
			factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); // disable external entities
CVE-2018-14349: Improper Input Validation (CWE-20)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://gitlab.com/muttmua/mutt
Language: C
Files changed: imap/command.c
Commit date: 2018-07-13 12:24:58 -0700
Commit message: Handle NO response without message properly

Diff: diff --git a/imap/command.c b/imap/command.c
index 82bf54c4..bb267f62 100644
--- a/imap/command.c
+++ b/imap/command.c
@@ -584,11 +584,11 @@ static int cmd_handle_untagged (IMAP_DATA* idata)
   else if (option (OPTIMAPSERVERNOISE) && (ascii_strncasecmp ("NO", s, 2) == 0))
   {
     dprint (2, (debugfile, "Handling untagged NO\n"));
 
     /* Display the warning message from the server */
-    mutt_error ("%s", s+3);
+    mutt_error ("%s", s+2);
     mutt_sleep (2);
   }
 
   return 0;
 }

Vulnerable code:     mutt_error ("%s", s+3);
Fixed code:     mutt_error ("%s", s+2);
CVE-2018-14350: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://gitlab.com/muttmua/mutt
Language: C
Files changed: imap/message.c
Commit date: 2018-07-13 12:15:00 -0700
Commit message: Don't overflow tmp in msg_parse_fetch.

Ensure INTERNALDATE and RFC822.SIZE field sizes fit temp buffer.

Thanks to Jeriko One for the bug report and patch, which this patch is
based upon.

Diff: diff --git a/imap/message.c b/imap/message.c
index 9ebfeb8e..e6056555 100644
--- a/imap/message.c
+++ b/imap/message.c
@@ -1343,10 +1343,11 @@ static int msg_fetch_header (CONTEXT* ctx, IMAP_HEADER* h, char* buf, FILE* fp)
  */
 static int msg_parse_fetch (IMAP_HEADER *h, char *s)
 {
   char tmp[SHORT_STRING];
   char *ptmp;
+  size_t dlen;
 
   if (!s)
     return -1;
 
   while (*s)
@@ -1376,12 +1377,16 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
         dprint (1, (debugfile, "msg_parse_fetch(): bogus INTERNALDATE entry: %s\n", s));
         return -1;
       }
       s++;
       ptmp = tmp;
-      while (*s && *s != '\"')
+      dlen = sizeof(tmp) - 1;
+      while (*s && *s != '\"' && dlen)
+      {
         *ptmp++ = *s++;
+        dlen--;
+      }
       if (*s != '\"')
         return -1;
       s++; /* skip past the trailing " */
       *ptmp = 0;
       h->received = imap_parse_date (tmp);
@@ -1389,12 +1394,16 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
     else if (ascii_strncasecmp ("RFC822.SIZE", s, 11) == 0)
     {
       s += 11;
       SKIPWS (s);
       ptmp = tmp;
-      while (isdigit ((unsigned char) *s))
+      dlen = sizeof(tmp) - 1;
+      while (isdigit ((unsigned char) *s) && dlen)
+      {
         *ptmp++ = *s++;
+        dlen--;
+      }
       *ptmp = 0;
       if (mutt_atol (tmp, &h->content_length) < 0)
         return -1;
     }
     else if (!ascii_strncasecmp ("BODY", s, 4) ||

Vulnerable code:       while (*s && *s != '\"')
      while (isdigit ((unsigned char) *s))
Fixed code:   size_t dlen;
      dlen = sizeof(tmp) - 1;
      while (*s && *s != '\"' && dlen)
      {
        dlen--;
      }
      dlen = sizeof(tmp) - 1;
      while (isdigit ((unsigned char) *s) && dlen)
      {
        dlen--;
      }
CVE-2018-14351: Improper Input Validation (CWE-20)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://gitlab.com/muttmua/mutt
Language: C
Files changed: imap/command.c
Commit date: 2018-07-13 12:35:50 -0700
Commit message: Verify IMAP status mailbox literal count size.

Ensure the length isn't bigger than the idata->buf.

Thanks to Jeriko One fo the bug report and patch, which this commit is
based upon.

Diff: diff --git a/imap/command.c b/imap/command.c
index bb267f623..6abd759d3 100644
--- a/imap/command.c
+++ b/imap/command.c
@@ -967,10 +967,17 @@ static void cmd_parse_status (IMAP_DATA* idata, char* s)
     if (imap_cmd_step (idata) != IMAP_CMD_CONTINUE)
     {
       idata->status = IMAP_FATAL;
       return;
     }
+
+    if (strlen(idata->buf) < litlen)
+    {
+      dprint (1, (debugfile, "Error parsing STATUS mailbox\n"));
+      return;
+    }
+
     mailbox = idata->buf;
     s = mailbox + litlen;
     *s = '\0';
     s++;
     SKIPWS(s);

Fixed code: 
    if (strlen(idata->buf) < litlen)
    {
      dprint (1, (debugfile, "Error parsing STATUS mailbox\n"));
      return;
    }
CVE-2018-14352: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading to a stack-based buffer overflow.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://gitlab.com/muttmua/mutt
Language: C
Files changed: imap/util.c
Commit date: 2018-07-12 20:46:37 -0700
Commit message: Fix imap_quote_string() length check errors.

The function wasn't properly checking for dlen<2 before quoting, and
wasn't properly pre-adjusting dlen to include the initial quote.

Thanks to Jeriko One for reporting these issues.

Diff: diff --git a/imap/util.c b/imap/util.c
index 3274a70c5..277929445 100644
--- a/imap/util.c
+++ b/imap/util.c
@@ -612,24 +612,33 @@ static void _imap_quote_string (char *dest, size_t dlen, const char *src,
                                 const char *to_quote)
 {
   char *pt;
   const char *s;
 
+  if (!(dest && dlen && src && to_quote))
+    return;
+
+  if (dlen < 3)
+  {
+    *dest = 0;
+    return;
+  }
+
   pt = dest;
   s  = src;
 
-  *pt++ = '"';
-  /* save room for trailing quote-char */
-  dlen -= 2;
+  /* save room for pre/post quote-char and trailing null */
+  dlen -= 3;
 
+  *pt++ = '"';
   for (; *s && dlen; s++)
   {
     if (strchr (to_quote, *s))
     {
+      if (dlen < 2)
+        break;
       dlen -= 2;
-      if (!dlen)
-	break;
       *pt++ = '\\';
       *pt++ = *s;
     }
     else
     {

Vulnerable code:   *pt++ = '"';
  /* save room for trailing quote-char */
  dlen -= 2;
      if (!dlen)
	break;
Fixed code:   if (!(dest && dlen && src && to_quote))
    return;

  if (dlen < 3)
  {
    *dest = 0;
    return;
  }

  /* save room for pre/post quote-char and trailing null */
  dlen -= 3;
  *pt++ = '"';
      if (dlen < 2)
        break;
CVE-2018-14353: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://gitlab.com/muttmua/mutt
Language: C
Files changed: imap/util.c
Commit date: 2018-07-12 20:46:37 -0700
Commit message: Fix imap_quote_string() length check errors.

The function wasn't properly checking for dlen<2 before quoting, and
wasn't properly pre-adjusting dlen to include the initial quote.

Thanks to Jeriko One for reporting these issues.

Diff: diff --git a/imap/util.c b/imap/util.c
index 3274a70c5..277929445 100644
--- a/imap/util.c
+++ b/imap/util.c
@@ -612,24 +612,33 @@ static void _imap_quote_string (char *dest, size_t dlen, const char *src,
                                 const char *to_quote)
 {
   char *pt;
   const char *s;
 
+  if (!(dest && dlen && src && to_quote))
+    return;
+
+  if (dlen < 3)
+  {
+    *dest = 0;
+    return;
+  }
+
   pt = dest;
   s  = src;
 
-  *pt++ = '"';
-  /* save room for trailing quote-char */
-  dlen -= 2;
+  /* save room for pre/post quote-char and trailing null */
+  dlen -= 3;
 
+  *pt++ = '"';
   for (; *s && dlen; s++)
   {
     if (strchr (to_quote, *s))
     {
+      if (dlen < 2)
+        break;
       dlen -= 2;
-      if (!dlen)
-	break;
       *pt++ = '\\';
       *pt++ = *s;
     }
     else
     {

Vulnerable code:   *pt++ = '"';
  /* save room for trailing quote-char */
  dlen -= 2;
      if (!dlen)
	break;
Fixed code:   if (!(dest && dlen && src && to_quote))
    return;

  if (dlen < 3)
  {
    *dest = 0;
    return;
  }

  /* save room for pre/post quote-char and trailing null */
  dlen -= 3;
  *pt++ = '"';
      if (dlen < 2)
        break;
CVE-2018-14355: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2018-07-17T17:29Z
Repository: https://gitlab.com/muttmua/mutt
Language: C
Files changed: imap/util.c
Commit date: 2018-07-13 11:33:16 -0700
Commit message: Selectively cache headers.

Thanks to NeoMutt and Jeriko One for the patch, which was slightly
modified to apply to the Mutt code.

Diff: diff --git a/imap/util.c b/imap/util.c
index 277929445..d4cc27425 100644
--- a/imap/util.c
+++ b/imap/util.c
@@ -82,10 +82,11 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path)
 {
   IMAP_MBOX mx;
   ciss_url_t url;
   char cachepath[LONG_STRING];
   char mbox[LONG_STRING];
+  size_t len;
 
   if (path)
     imap_cachepath (idata, path, mbox, sizeof (mbox));
   else
   {
@@ -94,10 +95,16 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path)
 
     imap_cachepath (idata, mx.mbox, mbox, sizeof (mbox));
     FREE (&mx.mbox);
   }
 
+  if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
+    return NULL;
+  len = strlen(mbox);
+  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
+    return NULL;
+
   mutt_account_tourl (&idata->conn->account, &url);
   url.path = mbox;
   url_ciss_tostring (&url, cachepath, sizeof (cachepath), U_PATH);
 
   return mutt_hcache_open (HeaderCache, cachepath, imap_hcache_namer);

Fixed code:   size_t len;
  if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
    return NULL;
  len = strlen(mbox);
  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
    return NULL;
CVE-2018-14356: Access of Uninitialized Pointer (CWE-824)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID.
CWE description: The product accesses or uses a pointer that has not been initialized.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://gitlab.com/muttmua/mutt
Language: C
Files changed: pop.c
Commit date: 2018-07-13 10:47:11 -0700
Commit message: Ensure UID in fetch_uidl.

Diff: diff --git a/pop.c b/pop.c
index ecfd8d7ce..d9d95fbe5 100644
--- a/pop.c
+++ b/pop.c
@@ -150,10 +150,14 @@ static int fetch_uidl (char *line, void *data)
       return -1;
   while (*endp == ' ')
       endp++;
   memmove(line, endp, strlen(endp) + 1);
 
+  /* uid must be at least be 1 byte */
+  if (strlen(line) == 0)
+    return -1;
+
   for (i = 0; i < ctx->msgcount; i++)
     if (!mutt_strcmp (line, ctx->hdrs[i]->data))
       break;
 
   if (i == ctx->msgcount)

Fixed code:   /* uid must be at least be 1 byte */
  if (strlen(line) == 0)
    return -1;
CVE-2018-14358: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://gitlab.com/muttmua/mutt
Language: C
Files changed: imap/message.c
Commit date: 2018-07-13 12:15:00 -0700
Commit message: Don't overflow tmp in msg_parse_fetch.

Ensure INTERNALDATE and RFC822.SIZE field sizes fit temp buffer.

Thanks to Jeriko One for the bug report and patch, which this patch is
based upon.

Diff: diff --git a/imap/message.c b/imap/message.c
index 9ebfeb8ee..e60565555 100644
--- a/imap/message.c
+++ b/imap/message.c
@@ -1343,10 +1343,11 @@ static int msg_fetch_header (CONTEXT* ctx, IMAP_HEADER* h, char* buf, FILE* fp)
  */
 static int msg_parse_fetch (IMAP_HEADER *h, char *s)
 {
   char tmp[SHORT_STRING];
   char *ptmp;
+  size_t dlen;
 
   if (!s)
     return -1;
 
   while (*s)
@@ -1376,12 +1377,16 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
         dprint (1, (debugfile, "msg_parse_fetch(): bogus INTERNALDATE entry: %s\n", s));
         return -1;
       }
       s++;
       ptmp = tmp;
-      while (*s && *s != '\"')
+      dlen = sizeof(tmp) - 1;
+      while (*s && *s != '\"' && dlen)
+      {
         *ptmp++ = *s++;
+        dlen--;
+      }
       if (*s != '\"')
         return -1;
       s++; /* skip past the trailing " */
       *ptmp = 0;
       h->received = imap_parse_date (tmp);
@@ -1389,12 +1394,16 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
     else if (ascii_strncasecmp ("RFC822.SIZE", s, 11) == 0)
     {
       s += 11;
       SKIPWS (s);
       ptmp = tmp;
-      while (isdigit ((unsigned char) *s))
+      dlen = sizeof(tmp) - 1;
+      while (isdigit ((unsigned char) *s) && dlen)
+      {
         *ptmp++ = *s++;
+        dlen--;
+      }
       *ptmp = 0;
       if (mutt_atol (tmp, &h->content_length) < 0)
         return -1;
     }
     else if (!ascii_strncasecmp ("BODY", s, 4) ||

Vulnerable code:       while (*s && *s != '\"')
      while (isdigit ((unsigned char) *s))
Fixed code:   size_t dlen;
      dlen = sizeof(tmp) - 1;
      while (*s && *s != '\"' && dlen)
      {
        dlen--;
      }
      dlen = sizeof(tmp) - 1;
      while (isdigit ((unsigned char) *s) && dlen)
      {
        dlen--;
      }
CVE-2022-0571: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-14T12:15Z
Repository: https://github.com/phoronix-test-suite/phoronix-test-suite
Language: PHP
Files changed: pts-core/phoromatic/phoromatic_functions.php
Commit date: 2022-02-12 04:20:40 -0600
Commit message: phoromatic: Reject HTML encoded character input and other strings that likely have no use within the context of Phoromatic inputs

Diff: diff --git a/pts-core/phoromatic/phoromatic_functions.php b/pts-core/phoromatic/phoromatic_functions.php
index ffbef1c5ed..b7966d86a0 100644
--- a/pts-core/phoromatic/phoromatic_functions.php
+++ b/pts-core/phoromatic/phoromatic_functions.php
@@ -31,11 +31,11 @@ function phoromatic_quit_if_invalid_input_found($input_keys = null)
 		$input_keys = array_keys($_REQUEST);
 	}
 	// backup as to sanitization and stripping elsewhere, safeguard namely check for things like < for fields that shouldn't have it
 	// plus a few simple backups as safeguards for words that really have no legit relevance within Phoromatic...
 
-	foreach(array('<', 'document.write', '../', 'onerror', 'onload', 'alert(') as $invalid_string)
+	foreach(array('<', '>', 'document.write', '../', 'onerror', 'onload', 'alert(', 'String.', 'confirm(', 'focus=', '&lt', '&gt', '&#') as $invalid_string)
 	{
 		foreach($input_keys as $key)
 		{
 			if(isset($_REQUEST[$key]) && !empty($_REQUEST[$key]))
 			{

Vulnerable code: 	foreach(array('<', 'document.write', '../', 'onerror', 'onload', 'alert(') as $invalid_string)
Fixed code: 	foreach(array('<', '>', 'document.write', '../', 'onerror', 'onload', 'alert(', 'String.', 'confirm(', 'focus=', '&lt', '&gt', '&#') as $invalid_string)