Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-36054: Access of Uninitialized Pointer (CWE-824)
value: lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.
CWE description: The product accesses or uses a pointer that has not been initialized.
CVSS v3 base score: 6.5
Published: 2023-08-07T19:15Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/lib/kadm5/kadm_rpc_xdr.c
Commit date: 2023-07-05 14:13:59 -0400
Commit message: Ensure array count consistency in kadm5 RPC

In _xdr_kadm5_principal_ent_rec(), ensure that n_key_data matches the
key_data array count when decoding.  Otherwise when the structure is
later freed, xdr_array() could iterate over the wrong number of
elements, either leaking some memory or freeing uninitialized
pointers.  Reported by Robert Morris.

CVE-2023-36054:

An authenticated attacker can cause a kadmind process to crash by
freeing uninitialized pointers.  Remote code execution is unlikely.
An attacker with control of a kadmin server can cause a kadmin client
to crash by freeing uninitialized pointers.

ticket: 9099 (new)
tags: pullup
target_version: 1.21-next
target_version: 1.20-next

Diff: diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c
index 0411c3fd3f45..287cae750f9d 100644
--- a/src/lib/kadm5/kadm_rpc_xdr.c
+++ b/src/lib/kadm5/kadm_rpc_xdr.c
@@ -388,10 +388,11 @@ bool_t xdr_kadm5_principal_ent_rec(XDR *xdrs,
 static bool_t
 _xdr_kadm5_principal_ent_rec(XDR *xdrs, kadm5_principal_ent_rec *objp,
 			     int v)
 {
 	unsigned int n;
+	bool_t r;
 
 	if (!xdr_krb5_principal(xdrs, &objp->principal)) {
 		return (FALSE);
 	}
 	if (!xdr_krb5_timestamp(xdrs, &objp->princ_expire_time)) {
@@ -441,21 +442,25 @@ _xdr_kadm5_principal_ent_rec(XDR *xdrs, kadm5_principal_ent_rec *objp,
 		return (FALSE);
 	}
 	if (!xdr_krb5_int16(xdrs, &objp->n_key_data)) {
 		return (FALSE);
 	}
+	if (xdrs->x_op == XDR_DECODE && objp->n_key_data < 0) {
+		return (FALSE);
+	}
 	if (!xdr_krb5_int16(xdrs, &objp->n_tl_data)) {
 		return (FALSE);
 	}
 	if (!xdr_nulltype(xdrs, (void **) &objp->tl_data,
 			  xdr_krb5_tl_data)) {
 		return FALSE;
 	}
 	n = objp->n_key_data;
-	if (!xdr_array(xdrs, (caddr_t *) &objp->key_data,
-		       &n, ~0, sizeof(krb5_key_data),
-		       xdr_krb5_key_data_nocontents)) {
+	r = xdr_array(xdrs, (caddr_t *) &objp->key_data, &n, objp->n_key_data,
+		      sizeof(krb5_key_data), xdr_krb5_key_data_nocontents);
+	objp->n_key_data = n;
+	if (!r) {
 		return (FALSE);
 	}
 
 	return (TRUE);
 }

Vulnerable code: 	if (!xdr_array(xdrs, (caddr_t *) &objp->key_data,
		       &n, ~0, sizeof(krb5_key_data),
		       xdr_krb5_key_data_nocontents)) {
Fixed code: 	bool_t r;
	if (xdrs->x_op == XDR_DECODE && objp->n_key_data < 0) {
		return (FALSE);
	}
	r = xdr_array(xdrs, (caddr_t *) &objp->key_data, &n, objp->n_key_data,
		      sizeof(krb5_key_data), xdr_krb5_key_data_nocontents);
	objp->n_key_data = n;
	if (!r) {
CVE-2023-39975: Double Free (CWE-415)
value: kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 8.8
Published: 2023-08-16T15:15Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/kdc/do_tgs_req.c
Commit date: 2023-08-07 14:38:21 -0400
Commit message: Fix double-free in KDC TGS processing

When issuing a ticket for a TGS renew or validate request, copy only
the server field from the outer part of the header ticket to the new
ticket.  Copying the whole structure causes the enc_part pointer to be
aliased to the header ticket until krb5_encrypt_tkt_part() is called,
resulting in a double-free if handle_authdata() fails.

[ghudson@mit.edu: changed the fix to avoid aliasing enc_part rather
than check for aliasing before freeing; rewrote commit message]

CVE-2023-39975:

In MIT krb5 release 1.21, an authenticated attacker can cause a KDC to
free the same pointer twice if it can induce a failure in
authorization data handling.

ticket: 9101 (new)
tags: pullup
target_version: 1.21-next

Diff: diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 6e4c8fa9f382..0acc45850fde 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -1008,12 +1008,13 @@ tgs_issue_ticket(kdc_realm_t *realm, struct tgs_req_info *t,
         }
         ticket_encrypting_key = &server_key;
     }
 
     if (t->req->kdc_options & (KDC_OPT_VALIDATE | KDC_OPT_RENEW)) {
-        /* Copy the whole header ticket except for authorization data. */
-        ticket_reply = *t->header_tkt;
+        /* Copy the header ticket server and all enc-part fields except for
+         * authorization data. */
+        ticket_reply.server = t->header_tkt->server;
         enc_tkt_reply = *t->header_tkt->enc_part2;
         enc_tkt_reply.authorization_data = NULL;
     } else {
         if (t->req->kdc_options & (KDC_OPT_FORWARDED | KDC_OPT_PROXY)) {
             /* Include the requested addresses in the ticket and reply. */

Vulnerable code:         /* Copy the whole header ticket except for authorization data. */
        ticket_reply = *t->header_tkt;
Fixed code:         /* Copy the header ticket server and all enc-part fields except for
         * authorization data. */
        ticket_reply.server = t->header_tkt->server;
CVE-2018-20835: Improper Input Validation (CWE-20)
value: A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2019-04-30T19:29Z
Repository: https://github.com/mafintosh/tar-fs
Language: JavaScript
Files changed: index.js
Commit date: 2018-04-30 13:38:19 +0200
Commit message: force hardlink targets to be in the tar

Diff: diff --git a/index.js b/index.js
index 2e1ae6d..4d67485 100644
--- a/index.js
+++ b/index.js
@@ -259,11 +259,11 @@ exports.extract = function (cwd, opts) {
     }
 
     var onlink = function () {
       if (win32) return next() // skip links on win for now before it can be tested
       xfs.unlink(name, function () {
-        var srcpath = path.resolve(cwd, header.linkname)
+        var srcpath = path.join(cwd, path.join('/', header.linkname))
 
         xfs.link(srcpath, name, function (err) {
           if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) {
             stream = xfs.createReadStream(srcpath)
             return onfile()

Vulnerable code:         var srcpath = path.resolve(cwd, header.linkname)
Fixed code:         var srcpath = path.join(cwd, path.join('/', header.linkname))
CVE-2023-5555: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-10-12T11:15Z
Repository: https://github.com/frappe/lms
Language: Unknown
Commit date: 2023-09-25 22:49:25 +0530
Commit message: Merge pull request #622 from pateljannat/issues

fix: sanitized inputs for people and course creation page
CVE-2021-3694: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.6
Published: 2021-08-23T13:15Z
Repository: https://github.com/ledgersmb/ledgersmb
Language: Unknown
Commit date: 2021-08-06 10:20:10 +0200
Commit message: Merge pull request #5744 from ledgersmb/html-escape-error-messages

Html escape error messages
CVE-2017-18120: Double Free (CWE-415)
value: A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or unspecified other impact via a maliciously crafted file, because last_name is mishandled, a different vulnerability than CVE-2017-1000421.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.8
Published: 2018-02-02T09:29Z
Repository: https://github.com/kohler/gifsicle
Language: C
Files changed: src/gifread.c
Commit date: 2017-12-02 23:10:36 -0500
Commit message: gif_read: Set last_name = NULL unconditionally.

With a non-malicious GIF, last_name is set to NULL when a name
extension is followed by an image. Reported in #117, via
Debian, via a KAIST fuzzing program.

Diff: diff --git a/src/gifread.c b/src/gifread.c
index eec4e31..9c287dd 100644
--- a/src/gifread.c
+++ b/src/gifread.c
@@ -898,10 +898,11 @@ read_gif(Gif_Reader *grr, int read_flags,
   Gif_DeleteArray(last_name);
   Gif_DeleteArray(gfc.prefix);
   Gif_DeleteArray(gfc.suffix);
   Gif_DeleteArray(gfc.length);
   gfc.gfi = 0;
+  last_name = 0;
 
   if (gfs)
     gfs->errors = gfc.errors[1];
   if (gfs && gfc.errors[1] == 0
       && !(read_flags & GIF_READ_TRAILING_GARBAGE_OK)

Fixed code:   last_name = 0;
CVE-2020-35460: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2020-12-14T23:15Z
Repository: https://github.com/joniles/mpxj
Language: Java
Files changed: src/main/java/net/sf/mpxj/common/InputStreamHelper.java
Commit date: 2020-12-14 12:13:14 +0000
Commit message: zip slip fix
Diff: diff --git a/src/main/java/net/sf/mpxj/common/InputStreamHelper.java b/src/main/java/net/sf/mpxj/common/InputStreamHelper.java
index 69e251894..81209caa2 100644
--- a/src/main/java/net/sf/mpxj/common/InputStreamHelper.java
+++ b/src/main/java/net/sf/mpxj/common/InputStreamHelper.java
@@ -112,20 +112,29 @@ public class InputStreamHelper
     * @param dir temporary directory
     * @param inputStream zip file input stream
     */
    private static void processZipStream(File dir, InputStream inputStream) throws IOException
    {
+      String canonicalDestinationDirPath = dir.getCanonicalPath();
       ZipInputStream zip = new ZipInputStream(inputStream);
       while (true)
       {
          ZipEntry entry = zip.getNextEntry();
          if (entry == null)
          {
             break;
          }
 
          File file = new File(dir, entry.getName());
+
+         // https://snyk.io/research/zip-slip-vulnerability
+         String canonicalDestinationFile = file.getCanonicalPath();
+         if (!canonicalDestinationFile.startsWith(canonicalDestinationDirPath + File.separator))
+         {
+            throw new IOException("Entry is outside of the target dir: " + entry.getName());
+         }
+
          if (entry.isDirectory())
          {
             FileHelper.mkdirsQuietly(file);
             continue;
          }

Fixed code:       String canonicalDestinationDirPath = dir.getCanonicalPath();

         // https://snyk.io/research/zip-slip-vulnerability
         String canonicalDestinationFile = file.getCanonicalPath();
         if (!canonicalDestinationFile.startsWith(canonicalDestinationDirPath + File.separator))
         {
            throw new IOException("Entry is outside of the target dir: " + entry.getName());
         }
CVE-2023-37623: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-07-26T20:15Z
Repository: https://github.com/netdisco/netdisco
Language: Perl
Files changed: lib/App/Netdisco/Web/TypeAhead.pm
Commit date: 2023-06-28 12:06:11 +0100
Commit message: avoid CSS vulnerability in Find Anything

Diff: diff --git a/lib/App/Netdisco/Web/TypeAhead.pm b/lib/App/Netdisco/Web/TypeAhead.pm
index 98817f9d..29d27616 100644
--- a/lib/App/Netdisco/Web/TypeAhead.pm
+++ b/lib/App/Netdisco/Web/TypeAhead.pm
@@ -4,19 +4,20 @@ use Dancer ':syntax';
 use Dancer::Plugin::Ajax;
 use Dancer::Plugin::DBIC;
 use Dancer::Plugin::Auth::Extensible;
 
 use App::Netdisco::Util::Web (); # for sort_port
+use HTML::Entities 'encode_entities';
 
 ajax '/ajax/data/devicename/typeahead' => require_login sub {
     return '[]' unless setting('navbar_autocomplete');
 
     my $q = param('query') || param('term');
     my $set = schema(vars->{'tenant'})->resultset('Device')->search_fuzzy($q);
 
     content_type 'application/json';
-    to_json [map {$_->dns || $_->name || $_->ip} $set->all];
+    to_json [map {encode_entities($_->dns || $_->name || $_->ip)} $set->all];
 };
 
 ajax '/ajax/data/deviceip/typeahead' => require_login sub {
     my $q = param('query') || param('term');
     my $set = schema(vars->{'tenant'})->resultset('Device')->search_fuzzy($q);

Vulnerable code:     to_json [map {$_->dns || $_->name || $_->ip} $set->all];
Fixed code: use HTML::Entities 'encode_entities';
    to_json [map {encode_entities($_->dns || $_->name || $_->ip)} $set->all];
CVE-2023-37623: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-07-26T20:15Z
Repository: https://github.com/netdisco/netdisco
Language: CSS
Files changed: share/public/css/netdisco.css, share/views/ajax/admintask/jobqueue.tt, share/views/js/admintask.js
Commit date: 2023-06-28 11:26:43 +0100
Commit message: avoid CSS vulnerability in Job Queue page

Diff: diff --git a/share/public/css/netdisco.css b/share/public/css/netdisco.css
index 8b8234e1..b9405e96 100644
--- a/share/public/css/netdisco.css
+++ b/share/public/css/netdisco.css
@@ -101,12 +101,13 @@ div.content > div.tab-content table.nd_floatinghead thead {
   min-width: 0;
   max-width: none;
 }
 
 .qtip-content {
-  padding-bottom: 0px;
-  line-height: 8px;
+  font-size: 15px;
+  font-family: monospace;
+  white-space: pre;
 }
 
 /* for where min-width is set but we don't want it */
 .nd_no-min-width {
   min-width: 0px;
diff --git a/share/views/ajax/admintask/jobqueue.tt b/share/views/ajax/admintask/jobqueue.tt
index f7f26391..41864ec0 100644
--- a/share/views/ajax/admintask/jobqueue.tt
+++ b/share/views/ajax/admintask/jobqueue.tt
@@ -20,11 +20,11 @@
     [% FOREACH row IN results %]
     <tr
       [% ' class="nd_jobqueueitem success"' IF row.status == 'done' %]
       [% ' class="nd_jobqueueitem error"'   IF row.status == 'error' %]
       [% ' class="nd_jobqueueitem info"'    IF row.status.search('^queued-') %]
-      data-content="<pre>[% row.log | html_entity %]</pre>"
+      data-content="[% row.log | html_entity %]"
     >
       <td class="nd_center-cell">[% row.entered_stamp | html_entity %]</td>
       <td class="nd_center-cell">
         [% FOREACH word IN row.action.split('_') %]
         [% word.ucfirst | html_entity %]&nbsp;
diff --git a/share/views/js/admintask.js b/share/views/js/admintask.js
index e41aff1a..28573ead 100644
--- a/share/views/js/admintask.js
+++ b/share/views/js/admintask.js
@@ -182,11 +182,11 @@
     // bind qtip2 to show the event log output
     $(target).on('mouseover', '.nd_jobqueueitem', function(event) {
       $(this).qtip({
         overwrite: false,
         content: {
-          attr: 'data-content'
+          text: $('<span/>').text( $(this).attr("data-content") ).html()
         },
         show: {
           event: event.type,
           ready: true,
           delay: 100

Vulnerable code:   padding-bottom: 0px;
  line-height: 8px;
      data-content="<pre>[% row.log | html_entity %]</pre>"
          attr: 'data-content'
Fixed code:   font-size: 15px;
  font-family: monospace;
  white-space: pre;
      data-content="[% row.log | html_entity %]"
          text: $('<span/>').text( $(this).attr("data-content") ).html()
CVE-2023-37624: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-07-26T20:15Z
Repository: https://github.com/netdisco/netdisco
Language: Perl
Files changed: lib/App/Netdisco/Web/AuthN.pm
Commit date: 2023-06-28 16:56:04 +0100
Commit message: avoid open redirect vulnerability with return_url login helper

Diff: diff --git a/lib/App/Netdisco/Web/AuthN.pm b/lib/App/Netdisco/Web/AuthN.pm
index ec532b541..feeb2a868 100644
--- a/lib/App/Netdisco/Web/AuthN.pm
+++ b/lib/App/Netdisco/Web/AuthN.pm
@@ -6,10 +6,11 @@ use Dancer::Plugin::Auth::Extensible;
 use Dancer::Plugin::Swagger;
 
 use App::Netdisco; # a safe noop but needed for standalone testing
 use App::Netdisco::Util::Web 'request_is_api';
 use MIME::Base64;
+use URI::Based;
 
 # ensure that regardless of where the user is redirected, we have a link
 # back to the page they requested.
 hook 'before' => sub {
     params->{return_url} ||= ((request->path ne uri_for('/')->path)
@@ -160,11 +161,11 @@ post '/login' => sub {
                 ? () : (token => \'md5(random()::text)')),
             })->discard_changes();
             return to_json { api_key => $user->token };
         }
 
-        redirect param('return_url');
+        redirect ((scalar URI::Based->new(param('return_url'))->path_query) || '/');
     }
     else {
         # invalidate session cookie
         session->destroy;
 

Vulnerable code:         redirect param('return_url');
Fixed code: use URI::Based;
        redirect ((scalar URI::Based->new(param('return_url'))->path_query) || '/');
CVE-2022-36082: Insufficient Information (NVD-CWE-noinfo)
value: mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http, https), mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains a patch for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2022-09-07T22:15Z
Repository: https://github.com/mansuf/mangadex-downloader
Language: Python
Files changed: mangadex_downloader/cli/validator.py
Commit date: 2022-09-04 22:25:37 +0700
Commit message: Fix improper validation in `file:<location>` syntax

Diff: diff --git a/mangadex_downloader/cli/validator.py b/mangadex_downloader/cli/validator.py
index dd3f636..deb4f81 100644
--- a/mangadex_downloader/cli/validator.py
+++ b/mangadex_downloader/cli/validator.py
@@ -29,19 +29,20 @@ def _validate(url):
         _url = validate_legacy_url(url)
     except InvalidURL as e:
         raise argparse.ArgumentTypeError(str(e))
     return _url
 
-def validate_url(url):
-    if os.path.exists(url):
-        with open(url, 'r') as opener:
-            content = opener.read()
-    else:
-        content = url
+def _try_read(path):
+    if not os.path.exists(path):
+        return None
+    
+    with open(path, 'r') as o:
+        return o.read()
 
+def validate_url(url):
     urls = []
-    for _url in content.splitlines():
+    for _url in url.splitlines():
         if not _url:
             continue
 
         urls.append((_validate(_url), _url))
     
@@ -243,11 +244,12 @@ def validate(parser, args):
             # Because this is specified syntax for batch downloading
             # If file doesn't exist, raise error
             elif not os.path.exists(file_path):
                 parser.error(f"File \"{file_path}\" is not exist")
         else:
-            file_path = urls
+            file_content = _try_read(urls)
+            file_path = file_content if file_content is not None else urls
         try:
             args.URL = validate_url(file_path)
         except argparse.ArgumentTypeError as e:
             parser.error(str(e))
         return

Vulnerable code: def validate_url(url):
    if os.path.exists(url):
        with open(url, 'r') as opener:
            content = opener.read()
    else:
        content = url
    for _url in content.splitlines():
            file_path = urls
Fixed code: def _try_read(path):
    if not os.path.exists(path):
        return None
    
    with open(path, 'r') as o:
        return o.read()
def validate_url(url):
    for _url in url.splitlines():
            file_content = _try_read(urls)
            file_path = file_content if file_content is not None else urls
CVE-2019-11808: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)
value: Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
CWE description: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CVSS v3 base score: 3.7
Published: 2019-05-07T07:29Z
Repository: https://github.com/ratpack/ratpack
Language: Java
Files changed: ratpack-session/src/main/java/ratpack/session/SessionModule.java, ratpack-session/src/main/java/ratpack/session/internal/DefaultSessionIdGenerator.java
Commit date: 2019-04-23 11:28:28 +1000
Commit message: Use UUID directly for generating session IDs

Diff: diff --git a/ratpack-session/src/main/java/ratpack/session/SessionModule.java b/ratpack-session/src/main/java/ratpack/session/SessionModule.java
index c0ed6b4ab..cd521e7e0 100644
--- a/ratpack-session/src/main/java/ratpack/session/SessionModule.java
+++ b/ratpack-session/src/main/java/ratpack/session/SessionModule.java
@@ -192,10 +192,11 @@ public class SessionModule extends ConfigurableModule<SessionCookieConfig> {
   SessionStore sessionStoreAdapter(@Named(LOCAL_MEMORY_SESSION_CACHE_BINDING_NAME) Cache<AsciiString, ByteBuf> cache) {
     return new LocalMemorySessionStore(cache);
   }
 
   @Provides
+  @Singleton
   SessionIdGenerator sessionIdGenerator() {
     return new DefaultSessionIdGenerator();
   }
 
   @Provides
diff --git a/ratpack-session/src/main/java/ratpack/session/internal/DefaultSessionIdGenerator.java b/ratpack-session/src/main/java/ratpack/session/internal/DefaultSessionIdGenerator.java
index 1cb30721d..0c7440264 100644
--- a/ratpack-session/src/main/java/ratpack/session/internal/DefaultSessionIdGenerator.java
+++ b/ratpack-session/src/main/java/ratpack/session/internal/DefaultSessionIdGenerator.java
@@ -14,20 +14,19 @@
  * limitations under the License.
  */
 
 package ratpack.session.internal;
 
+import com.google.inject.Singleton;
 import io.netty.util.AsciiString;
 import ratpack.session.SessionIdGenerator;
 
 import java.util.UUID;
-import java.util.concurrent.ThreadLocalRandom;
 
+@Singleton
 public class DefaultSessionIdGenerator implements SessionIdGenerator {
 
   public AsciiString generateSessionId() {
-    ThreadLocalRandom random = ThreadLocalRandom.current();
-    UUID uuid = new UUID(random.nextLong(), random.nextLong());
-    return AsciiString.of(uuid.toString());
+    return AsciiString.cached(UUID.randomUUID().toString());
   }
 
 }

Vulnerable code: import java.util.concurrent.ThreadLocalRandom;
    ThreadLocalRandom random = ThreadLocalRandom.current();
    UUID uuid = new UUID(random.nextLong(), random.nextLong());
    return AsciiString.of(uuid.toString());
Fixed code:   @Singleton
import com.google.inject.Singleton;
@Singleton
    return AsciiString.cached(UUID.randomUUID().toString());
CVE-2019-17513: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 7.5
Published: 2019-10-18T03:15Z
Repository: https://github.com/ratpack/ratpack
Language: Java
Files changed: ratpack-core/src/main/java/ratpack/server/internal/NettyHandlerAdapter.java
Commit date: 2019-10-09 09:24:24 +1000
Commit message: Enable HTTP header validation

Diff: diff --git a/ratpack-core/src/main/java/ratpack/server/internal/NettyHandlerAdapter.java b/ratpack-core/src/main/java/ratpack/server/internal/NettyHandlerAdapter.java
index bfd97aa64..ee1034f6b 100644
--- a/ratpack-core/src/main/java/ratpack/server/internal/NettyHandlerAdapter.java
+++ b/ratpack-core/src/main/java/ratpack/server/internal/NettyHandlerAdapter.java
@@ -154,11 +154,11 @@ public class NettyHandlerAdapter extends ChannelInboundHandlerAdapter {
       requestBody,
       connectionIdleTimeout,
       channel.attr(CLIENT_CERT_KEY).get()
     );
 
-    HttpHeaders nettyHeaders = new DefaultHttpHeaders(false);
+    HttpHeaders nettyHeaders = new DefaultHttpHeaders();
     MutableHeaders responseHeaders = new NettyHeadersBackedMutableHeaders(nettyHeaders);
     AtomicBoolean transmitted = new AtomicBoolean(false);
 
     DefaultResponseTransmitter responseTransmitter = new DefaultResponseTransmitter(transmitted, channel, clock, nettyRequest, request, nettyHeaders, requestBody);
 

Vulnerable code:     HttpHeaders nettyHeaders = new DefaultHttpHeaders(false);
Fixed code:     HttpHeaders nettyHeaders = new DefaultHttpHeaders();
CVE-2020-35605: Other (NVD-CWE-Other)
value: The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2020-12-21T20:15Z
Repository: https://github.com/kovidgoyal/kitty
Language: Other
Files changed: docs/changelog.rst, kitty/graphics.c
Commit date: 2020-11-29 12:02:14 +0530
Commit message: Graphics protocol: Dont return filename in the error message when opening file fails, since filenames can contain control characters

Fixes #3128

Diff: diff --git a/docs/changelog.rst b/docs/changelog.rst
index fc67fe43..45ab3f72 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -24,10 +24,13 @@ To update |kitty|, :doc:`follow the instructions <binary>`.
   (:iss:`2191`)
 
 - Add an option, :opt:`detect_urls` to control whether kitty will detect URLs
   when the mouse moves over them (:pull:`3118`)
 
+- Graphics protocol: Dont return filename in the error message when opening file
+  fails, since filenames can contain control characters (:iss:`3128`)
+
 
 0.19.2 [2020-11-13]
 -------------------
 
 - A new :doc:`kittens/query_terminal` kitten to easily query the running kitty
diff --git a/kitty/graphics.c b/kitty/graphics.c
index 4671531c..07e55c08 100644
--- a/kitty/graphics.c
+++ b/kitty/graphics.c
@@ -400,11 +400,11 @@ handle_add_command(GraphicsManager *self, const GraphicsCommand *g, const uint8_
         case 's': // POSIX shared memory
             if (g->payload_sz > 2048) ABRT(EINVAL, "Filename too long");
             snprintf(fname, sizeof(fname)/sizeof(fname[0]), "%.*s", (int)g->payload_sz, payload);
             if (tt == 's') fd = shm_open(fname, O_RDONLY, 0);
             else fd = open(fname, O_CLOEXEC | O_RDONLY);
-            if (fd == -1) ABRT(EBADF, "Failed to open file %s for graphics transmission with error: [%d] %s", fname, errno, strerror(errno));
+            if (fd == -1) ABRT(EBADF, "Failed to open file for graphics transmission with error: [%d] %s", errno, strerror(errno));
             img->data_loaded = mmap_img_file(self, img, fd, g->data_sz, g->data_offset);
             safe_close(fd, __FILE__, __LINE__);
             if (tt == 't') {
                 if (global_state.boss) { call_boss(safe_delete_temp_file, "s", fname); }
                 else unlink(fname);

Vulnerable code:             if (fd == -1) ABRT(EBADF, "Failed to open file %s for graphics transmission with error: [%d] %s", fname, errno, strerror(errno));
Fixed code: - Graphics protocol: Dont return filename in the error message when opening file
  fails, since filenames can contain control characters (:iss:`3128`)

            if (fd == -1) ABRT(EBADF, "Failed to open file for graphics transmission with error: [%d] %s", errno, strerror(errno));
CVE-2021-29506: Uncontrolled Resource Consumption (CWE-400)
value: GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 6.5
Published: 2021-05-13T19:15Z
Repository: https://github.com/graphhopper/graphhopper
Language: Java
Files changed: navigation/src/main/java/com/graphhopper/navigation/NavigateResource.java
Commit date: 2021-05-04 20:03:31 +0200
Commit message: avoid regex in navigate module (#2304)

* replace two regexs with one indexOf

* make check stricter

* use @easbar's suggestion
Diff: diff --git a/navigation/src/main/java/com/graphhopper/navigation/NavigateResource.java b/navigation/src/main/java/com/graphhopper/navigation/NavigateResource.java
index 75c61c5f3..66880307c 100644
--- a/navigation/src/main/java/com/graphhopper/navigation/NavigateResource.java
+++ b/navigation/src/main/java/com/graphhopper/navigation/NavigateResource.java
@@ -186,17 +186,15 @@ public class NavigateResource {
      * See: https://stackoverflow.com/q/51420380/1548788
      * <p>
      * The url looks like: ".../{profile}/1.522438,42.504606;1.527209,42.504776;1.526113,42.505144;1.527218,42.50529?.."
      */
     private List<GHPoint> getPointsFromRequest(HttpServletRequest httpServletRequest, String profile) {
-
         String url = httpServletRequest.getRequestURI();
-        url = url.replaceFirst("/navigate/directions/v5/gh/" + profile + "/", "");
-        url = url.replaceAll("\\?[*]", "");
-
+        String urlStart = "/navigate/directions/v5/gh/" + profile + "/";
+        if (!url.startsWith(urlStart)) throw new IllegalArgumentException("Incorrect URL " + url);
+        url = url.substring(urlStart.length());
         String[] pointStrings = url.split(";");
-
         List<GHPoint> points = new ArrayList<>(pointStrings.length);
         for (int i = 0; i < pointStrings.length; i++) {
             points.add(GHPoint.fromStringLonLat(pointStrings[i]));
         }
 

Vulnerable code: 
        url = url.replaceFirst("/navigate/directions/v5/gh/" + profile + "/", "");
        url = url.replaceAll("\\?[*]", "");


Fixed code:         String urlStart = "/navigate/directions/v5/gh/" + profile + "/";
        if (!url.startsWith(urlStart)) throw new IllegalArgumentException("Incorrect URL " + url);
        url = url.substring(urlStart.length());
CVE-2020-15085: Cleartext Storage of Sensitive Information (CWE-312)
value: In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0 persisted the cache even after the user logged out. This is fixed in version 2.10.3. A workaround is to manually clear application data (browser's local storage) after logging into Saleor Storefront.
CWE description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CVSS v3 base score: 6.1
Published: 2020-06-30T17:15Z
Repository: https://github.com/mirumee/saleor-storefront
Language: Unknown
Commit date: 2020-06-30 12:44:53 +0200
Commit message: Merge pull request from GHSA-4279-h39w-2jqm

Do not store passwords in localStorage
CVE-2015-8747: Improper Input Validation (CWE-20)
value: The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 10
Published: 2016-02-03T18:59Z
Repository: https://github.com/Unrud/Radicale
Language: Python
Files changed: radicale/storage/multifilesystem.py
Commit date: 2015-12-24 14:39:29 +0100
Commit message: Convert component names safely to filenames
Component names are controlled by the user and
without this checks access to arbitrary files is
possible if the multifilesystem backend is used.

Diff: diff --git a/radicale/storage/multifilesystem.py b/radicale/storage/multifilesystem.py
index fe5637d..93cec87 100644
--- a/radicale/storage/multifilesystem.py
+++ b/radicale/storage/multifilesystem.py
@@ -51,19 +51,29 @@ class Collection(filesystem.Collection):
             text = ical.serialize(
                 self.tag, self.headers, [component] + self.timezones)
             name = (
                 component.name if sys.version_info[0] >= 3 else
                 component.name.encode(filesystem.FILESYSTEM_ENCODING))
+            if not pathutils.is_safe_filesystem_path_component(name):
+                log.LOGGER.debug(
+                    "Can't tranlate name safely to filesystem, "
+                    "skipping component: %s", name)
+                continue
             filesystem_path = os.path.join(self._filesystem_path, name)
             with filesystem.open(filesystem_path, "w") as fd:
                 fd.write(text)
 
     def delete(self):
         shutil.rmtree(self._filesystem_path)
         os.remove(self._props_path)
 
     def remove(self, name):
+        if not pathutils.is_safe_filesystem_path_component(name):
+            log.LOGGER.debug(
+                "Can't tranlate name safely to filesystem, "
+                "skipping component: %s", name)
+            return
         filesystem_path = os.path.join(self._filesystem_path, name)
         if os.path.exists(filesystem_path):
             os.remove(filesystem_path)
 
     @property

Fixed code:             if not pathutils.is_safe_filesystem_path_component(name):
                log.LOGGER.debug(
                    "Can't tranlate name safely to filesystem, "
                    "skipping component: %s", name)
                continue
        if not pathutils.is_safe_filesystem_path_component(name):
            log.LOGGER.debug(
                "Can't tranlate name safely to filesystem, "
                "skipping component: %s", name)
            return
CVE-2015-8748: Permissions, Privileges, and Access Controls (CWE-264)
value: Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 5.3
Published: 2016-02-03T18:59Z
Repository: https://github.com/Unrud/Radicale
Language: Python
Files changed: radicale/rights/regex.py
Commit date: 2015-12-23 07:05:20 +0100
Commit message: Prevent "regex injection"

If an attacker is able to authenticate with a user name like .* he can bypass limitations imposed by "owner_write" and "owner_only".
Diff: diff --git a/radicale/rights/regex.py b/radicale/rights/regex.py
index 35e5893..39c39ae 100644
--- a/radicale/rights/regex.py
+++ b/radicale/rights/regex.py
@@ -63,11 +63,14 @@ DEFINED_RIGHTS = {
 
 def _read_from_sections(user, collection_url, permission):
     """Get regex sections."""
     filename = os.path.expanduser(config.get("rights", "file"))
     rights_type = config.get("rights", "type").lower()
-    regex = ConfigParser({"login": user, "path": collection_url})
+    # Prevent "regex injection"
+    user_escaped = re.escape(user)
+    collection_url_escaped = re.escape(collection_url)
+    regex = ConfigParser({"login": user_escaped, "path": collection_url_escaped})
     if rights_type in DEFINED_RIGHTS:
         log.LOGGER.debug("Rights type '%s'" % rights_type)
         regex.readfp(StringIO(DEFINED_RIGHTS[rights_type]))
     elif rights_type == "from_file":
         log.LOGGER.debug("Reading rights from file %s" % filename)

Vulnerable code:     regex = ConfigParser({"login": user, "path": collection_url})
Fixed code:     # Prevent "regex injection"
    user_escaped = re.escape(user)
    collection_url_escaped = re.escape(collection_url)
    regex = ConfigParser({"login": user_escaped, "path": collection_url_escaped})
CVE-2022-26874: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-11T07:15Z
Repository: https://github.com/horde/Mime_Viewer
Language: PHP
Files changed: doc/Horde/Mime/Viewer/changelog.yml, lib/Horde/Mime/Viewer/Ooo.php
Commit date: 2022-03-02 21:55:50 +0100
Commit message: [jan] Fix XSS vulnerability in Open Document mime viewer with different code path (Reported by: Mahdi Pasche <pasche@b1-systems.de>).

Diff: diff --git a/doc/Horde/Mime/Viewer/changelog.yml b/doc/Horde/Mime/Viewer/changelog.yml
index 745dee0..7b00b14 100644
--- a/doc/Horde/Mime/Viewer/changelog.yml
+++ b/doc/Horde/Mime/Viewer/changelog.yml
@@ -6,12 +6,13 @@
     api: stable
   date: 2022-03-01
   license:
     identifier: LGPL-2.1
     uri: http://www.horde.org/licenses/lgpl21
-  notes: |+
-    
+  notes: |
+    [jan] Fix XSS vulnerability in Open Document mime viewer with different code path (Reported by: Mahdi Pasche <pasche@b1-systems.de>).
+    |+
 2.2.3:
   api: 2.1.0
   state:
     release: stable
     api: stable
diff --git a/lib/Horde/Mime/Viewer/Ooo.php b/lib/Horde/Mime/Viewer/Ooo.php
index d23d404..ad8af83 100644
--- a/lib/Horde/Mime/Viewer/Ooo.php
+++ b/lib/Horde/Mime/Viewer/Ooo.php
@@ -96,11 +96,14 @@ class Horde_Mime_Viewer_Ooo extends Horde_Mime_Viewer_Base
                 if ($has_xsl) {
                     file_put_contents($tmpdir . $file['name'], $content);
                 } elseif ($file['name'] == 'content.xml') {
                     return array(
                         $this->_mimepart->getMimeId() => array(
-                            'data' => str_replace(array_keys($tags), array_values($tags), $content),
+                            'data' => Horde_Text_Filter::filter(
+                                str_replace(array_keys($tags), array_values($tags), $content),
+                                'xss'
+                            ),
                             'status' => array(),
                             'type' => 'text/html; charset=UTF-8'
                         )
                     );
                 }

Vulnerable code:   notes: |+
    
                            'data' => str_replace(array_keys($tags), array_values($tags), $content),
Fixed code:   notes: |
    [jan] Fix XSS vulnerability in Open Document mime viewer with different code path (Reported by: Mahdi Pasche <pasche@b1-systems.de>).
    |+
                            'data' => Horde_Text_Filter::filter(
                                str_replace(array_keys($tags), array_values($tags), $content),
                                'xss'
                            ),
CVE-2023-28753: Out-of-bounds Write (CWE-787)
value: netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could leverage this overflow to create heap memory corruption with attacker controlled data.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2023-05-18T22:15Z
Repository: https://github.com/facebook/netconsd
Language: C
Files changed: ncrx/libncrx.c
Commit date: 2023-03-22 14:20:30 -0700
Commit message: ensure fragment offset is less than total length

Summary:
when messages are received in fragments, we need to make sure the offset value is less than the length of all fragments to be received.

CVE-2023-28753

Reviewed By: kernelslacker

Differential Revision: D44277643

fbshipit-source-id: 8b4b163503a5574b05c0a185b615de61442a0309

Diff: diff --git a/ncrx/libncrx.c b/ncrx/libncrx.c
index e01ed41..5b9091c 100644
--- a/ncrx/libncrx.c
+++ b/ncrx/libncrx.c
@@ -255,10 +255,11 @@ static int parse_packet(const char *payload, struct ncrx_msg *msg)
 
 			if (sscanf(val, "%u/%u", &nf_off, &nf_len) != 2)
 				goto einval;
 			if (!msg->text_len ||
 			    nf_len >= NCRX_LINE_MAX ||
+			    nf_off >= nf_len ||
 			    nf_off + msg->text_len > nf_len)
 				goto einval;
 
 			msg->ncfrag_off = nf_off;
 			msg->ncfrag_len = msg->text_len;

Fixed code: 			    nf_off >= nf_len ||
CVE-2021-3845: External Control of File Name or Path (CWE-73)
value: ws-scrcpy is vulnerable to External Control of File Name or Path
CWE description: The product allows user input to control or influence paths or file names that are used in filesystem operations.
CVSS v3 base score: 7.5
Published: 2022-01-04T17:15Z
Repository: https://github.com/netristv/ws-scrcpy
Language: TypeScript
Files changed: src/server/services/HttpServer.ts
Commit date: 2021-12-15 20:14:56 +0300
Commit message: fix: file access outside the public dir

Diff: diff --git a/src/server/services/HttpServer.ts b/src/server/services/HttpServer.ts
index 10ee844..145d3ae 100644
--- a/src/server/services/HttpServer.ts
+++ b/src/server/services/HttpServer.ts
@@ -43,10 +43,15 @@ export class HttpServer implements Service {
                 res.end(STATUS_CODES[400]);
                 return;
             }
             const parsedUrl = url.parse(req.url);
             let pathname = path.join(publicDir, (parsedUrl.pathname || '.').replace(/^(\.)+/, '.'));
+            if (pathname.indexOf(publicDir) !== 0) {
+                res.statusCode = 403;
+                res.end();
+                return;
+            }
             fs.stat(pathname, (statErr, stat) => {
                 if (statErr) {
                     if (statErr.code === 'ENOENT') {
                         // if the file is not found, return 404
                         res.statusCode = 404;

Fixed code:             if (pathname.indexOf(publicDir) !== 0) {
                res.statusCode = 403;
                res.end();
                return;
            }
CVE-2023-0901: Insufficient Information (NVD-CWE-noinfo)
value: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2023-02-18T01:15Z
Repository: https://github.com/pixelfed/pixelfed
Language: Unknown
Commit date: 2023-01-18 21:59:56 -0700
Commit message: Merge pull request #4102 from pixelfed/staging

Update email form
CVE-2023-0914: Other (NVD-CWE-Other)
value: Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.3
Published: 2023-02-19T01:15Z
Repository: https://github.com/pixelfed/pixelfed
Language: PHP
Files changed: app/Http/Controllers/BookmarkController.php
Commit date: 2023-01-19 06:37:24 -0700
Commit message: Update BookmarkController

Diff: diff --git a/app/Http/Controllers/BookmarkController.php b/app/Http/Controllers/BookmarkController.php
index a340460b9..59ffeab36 100644
--- a/app/Http/Controllers/BookmarkController.php
+++ b/app/Http/Controllers/BookmarkController.php
@@ -5,10 +5,11 @@ namespace App\Http\Controllers;
 use App\Bookmark;
 use App\Status;
 use Auth;
 use Illuminate\Http\Request;
 use App\Services\BookmarkService;
+use App\Services\FollowerService;
 
 class BookmarkController extends Controller
 {
     public function __construct()
     {
@@ -22,10 +23,20 @@ class BookmarkController extends Controller
         ]);
 
         $profile = Auth::user()->profile;
         $status = Status::findOrFail($request->input('item'));
 
+        abort_if(!in_array($status->scope, ['public', 'unlisted', 'private']), 404);
+
+        if($status->scope == 'private') {
+            abort_if(
+                $profile->id !== $status->profile_id && !FollowerService::follows($profile->id, $status->profile_id),
+                404,
+                'Error: Cannot bookmark private posts from accounts you do not follow.'
+            );
+        }
+
         $bookmark = Bookmark::firstOrCreate(
             ['status_id' => $status->id], ['profile_id' => $profile->id]
         );
 
         if (!$bookmark->wasRecentlyCreated) {

Fixed code: use App\Services\FollowerService;
        abort_if(!in_array($status->scope, ['public', 'unlisted', 'private']), 404);

        if($status->scope == 'private') {
            abort_if(
                $profile->id !== $status->profile_id && !FollowerService::follows($profile->id, $status->profile_id),
                404,
                'Error: Cannot bookmark private posts from accounts you do not follow.'
            );
        }