Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-5207: Improper Privilege Management (CWE-269)
value: Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.8
Published: 2017-03-23T16:59Z
Repository: https://github.com/netblue30/firejail
Language: Other
Files changed: RELNOTES, src/firejail/bandwidth.c
Commit date: 2017-01-06 22:45:11 -0500
Commit message: security fix

Diff: diff --git a/RELNOTES b/RELNOTES
index 969eecb..b9a982d 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,7 +1,8 @@
 firejail (0.9.45) baseline; urgency=low
   * development version, work in progress
+  * security: --bandwidth root shel found by Martin Carpenter
   * security: disabled --allow-debuggers when running on kernel
     versions prior to 4.8; a kernel bug in ptrace system call
     allows a full bypass of seccomp filter; problem reported by Lizzie Dixon
   * security: overwrite /etc/resolv.conf found by Martin Carpenter
   * secuirty: TOCTOU exploit for --get and --put found by Daniel Hodson
diff --git a/src/firejail/bandwidth.c b/src/firejail/bandwidth.c
index 5e9002f..84c9dc5 100644
--- a/src/firejail/bandwidth.c
+++ b/src/firejail/bandwidth.c
@@ -433,19 +433,12 @@ void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, in
 	if (setreuid(0, 0))
 		errExit("setreuid");
 	if (setregid(0, 0))
 		errExit("setregid");
 
-	if (!cfg.shell)
-		cfg.shell = guess_shell();
-	if (!cfg.shell) {
-		fprintf(stderr, "Error: no POSIX shell found, please use --shell command line option\n");
-		exit(1);
-	}
-
 	char *arg[4];
-	arg[0] = cfg.shell;
+	arg[0] = "/bin/sh";
 	arg[1] = "-c";
 	arg[2] = cmd;
 	arg[3] = NULL;
 	clearenv();
 	execvp(arg[0], arg);

Vulnerable code: 	if (!cfg.shell)
		cfg.shell = guess_shell();
	if (!cfg.shell) {
		fprintf(stderr, "Error: no POSIX shell found, please use --shell command line option\n");
		exit(1);
	}

	arg[0] = cfg.shell;
Fixed code:   * security: --bandwidth root shel found by Martin Carpenter
	arg[0] = "/bin/sh";
CVE-2019-6009: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2019-09-12T17:15Z
Repository: https://github.com/shirasagi/shirasagi
Language: Ruby
Files changed: app/controllers/concerns/sns/login_filter.rb
Commit date: 2018-04-11 17:16:18 +0900
Commit message: [fix] sns/login: close open redirect (#2061)


Diff: diff --git a/app/controllers/concerns/sns/login_filter.rb b/app/controllers/concerns/sns/login_filter.rb
index 16529482f..3db189856 100644
--- a/app/controllers/concerns/sns/login_filter.rb
+++ b/app/controllers/concerns/sns/login_filter.rb
@@ -20,11 +20,11 @@ module Sns::LoginFilter
   end
 
   def login_success
     if params[:ref].blank?
       redirect_to default_logged_in_path
-    elsif params[:ref] =~ /^\//
+    elsif params[:ref] =~ /^\/[^\/]/
       redirect_to params[:ref]
     else
       render "sns/login/redirect"
     end
   end

Vulnerable code:     elsif params[:ref] =~ /^\//
Fixed code:     elsif params[:ref] =~ /^\/[^\/]/
CVE-2023-52138: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa.

CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 9.6
Published: 2024-02-05T15:15Z
Repository: https://github.com/mate-desktop/engrampa
Language: C
Files changed: src/fr-command-cpio.c, src/fr-command-unarchiver.c
Commit date: 2024-02-04 22:21:38 +0000
Commit message: Use unar instead of cpio for CPIO archives

Diff: diff --git a/src/fr-command-cpio.c b/src/fr-command-cpio.c
index c6a7198..3d0fcd9 100644
--- a/src/fr-command-cpio.c
+++ b/src/fr-command-cpio.c
@@ -217,11 +217,11 @@ fr_command_cpio_extract (FrCommand *comm,
 	g_string_free (cmd, TRUE);
 
 	fr_process_end_command (comm->process);
 }
 
-const char *cpio_mime_type[] = { "application/x-cpio", NULL };
+const char *cpio_mime_type[] = { /*"application/x-cpio",*/ NULL };
 
 static const char **
 fr_command_cpio_get_mime_types (FrCommand *comm)
 {
 	return cpio_mime_type;
@@ -233,12 +233,12 @@ fr_command_cpio_get_capabilities (FrCommand  *comm,
 				  gboolean    check_command)
 {
 	FrCommandCaps capabilities;
 
 	capabilities = FR_COMMAND_CAN_ARCHIVE_MANY_FILES;
-	if (is_program_available (CPIO_PATH, check_command))
-		capabilities |= FR_COMMAND_CAN_READ;
+/*	if (is_program_available (CPIO_PATH, check_command))
+		capabilities |= FR_COMMAND_CAN_READ;*/
 
 	return capabilities;
 }
 
 static const char *
diff --git a/src/fr-command-unarchiver.c b/src/fr-command-unarchiver.c
index c7aa5e6..a6a8c2d 100644
--- a/src/fr-command-unarchiver.c
+++ b/src/fr-command-unarchiver.c
@@ -245,10 +245,11 @@ fr_command_unarchiver_handle_error (FrCommand   *comm,
 }
 
 const char *unarchiver_mime_type[] = { "application/zip",
 				       "application/x-cbr",
 				       "application/x-rar",
+				       "application/x-cpio",
 				       NULL };
 
 static const char **
 fr_command_unarchiver_get_mime_types (FrCommand *comm)
 {

Vulnerable code: const char *cpio_mime_type[] = { "application/x-cpio", NULL };
	if (is_program_available (CPIO_PATH, check_command))
		capabilities |= FR_COMMAND_CAN_READ;
Fixed code: const char *cpio_mime_type[] = { /*"application/x-cpio",*/ NULL };
/*	if (is_program_available (CPIO_PATH, check_command))
		capabilities |= FR_COMMAND_CAN_READ;*/
				       "application/x-cpio",
CVE-2013-0266: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
value: manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.
CWE description: The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Published: 2013-03-08T21:55Z
Repository: https://github.com/puppetlabs/puppetlabs-cinder
Language: Other
Files changed: manifests/base.pp
Commit date: 2013-02-07 13:42:38 -0800
Commit message: Restrict permissions on cinder configuration

Prior to this commit, the puppetlabs-cinder module applied the mode
0644 to the File[$::cinder::params::cinder_conf] resource which
were too permissive. This commit explicitly sets the mode to 0600.

Diff: diff --git a/manifests/base.pp b/manifests/base.pp
index 01e2aca..dd00f73 100644
--- a/manifests/base.pp
+++ b/manifests/base.pp
@@ -30,11 +30,14 @@ class cinder::base (
     group   => 'cinder',
     mode    => '0644',
     require => Package[$::cinder::params::package_name],
   }
 
-  file { $::cinder::params::cinder_conf: }
+  file { $::cinder::params::cinder_conf:
+    mode => '0600',
+  }
+
   file { $::cinder::params::cinder_paste_api_ini: }
 
   # Temporary fixes
   file { ['/var/log/cinder', '/var/lib/cinder']:
     ensure => directory,

Vulnerable code:   file { $::cinder::params::cinder_conf: }
Fixed code:   file { $::cinder::params::cinder_conf:
    mode => '0600',
  }
CVE-2018-25055: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in FarCry Solr Pro Plugin up to 1.5.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file packages/forms/solrProSearch.cfc of the component Search Handler. The manipulation of the argument suggestion leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is b8f3d61511c9b02b781ec442bfb803cbff8e08d5. It is recommended to upgrade the affected component. The identifier VDB-216961 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-28T12:15Z
Repository: https://github.com/jeffcoughlin/farcrysolrpro
Language: Other
Files changed: packages/forms/solrProSearch.cfc
Commit date: 2018-09-04 14:08:06 -0400
Commit message: fixes #78 escape suggestion to avoid xss

Diff: diff --git a/packages/forms/solrProSearch.cfc b/packages/forms/solrProSearch.cfc
index 5e1eb4e..3d8ae08 100644
--- a/packages/forms/solrProSearch.cfc
+++ b/packages/forms/solrProSearch.cfc
@@ -195,11 +195,11 @@
 		) />
 		
 		<!--- build the HTML and return it --->
 		<cfset var str = "" />
 		<cfsavecontent variable="str">
-			<cfoutput>Did you mean <a href="#arguments.linkUrl#">#suggestion#</a>?</cfoutput>
+			<cfoutput>Did you mean <a href="#arguments.linkUrl#">#application.stPlugins.farcrysolrpro.oCustomFunctions.xmlSafeText(suggestion)#</a>?</cfoutput>
 		</cfsavecontent>
 		
 		<cfreturn trim(str) />
 		
 	</cffunction>

Vulnerable code: 			<cfoutput>Did you mean <a href="#arguments.linkUrl#">#suggestion#</a>?</cfoutput>
Fixed code: 			<cfoutput>Did you mean <a href="#arguments.linkUrl#">#application.stPlugins.farcrysolrpro.oCustomFunctions.xmlSafeText(suggestion)#</a>?</cfoutput>
CVE-2022-31071: Incorrect Default Permissions (CWE-276)
value: Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octopoller 0.3.0. Two workarounds are available. Users can use the previous version of the gem, v0.1.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 3.3
Published: 2022-06-15T23:15Z
Repository: https://github.com/octokit/octopoller.rb
Language: Unknown
Commit date: 2022-06-15 15:03:32 -0500
Commit message: Merge pull request #25 from octokit/updates-release-steps-checks

Adds details on how to run a manual file integrity check
CVE-2019-10477: Data Processing Errors (CWE-19)
value: The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions.
CWE description: Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
CVSS v3 base score: 7.5
Published: 2019-03-29T14:29Z
Repository: https://github.com/fusioninventory/fusioninventory-for-glpi
Language: PHP
Files changed: front/send_inventory.php, inc/toolbox.class.php
Commit date: 2019-03-28 15:37:31 +0100
Commit message: Fix a security problem. Thanks to Julien Szlamowicz && Damien Picard from company synacktiv

Diff: diff --git a/front/send_inventory.php b/front/send_inventory.php
index c8abca09c..82c69a639 100644
--- a/front/send_inventory.php
+++ b/front/send_inventory.php
@@ -48,15 +48,14 @@
 include ("../../../inc/includes.php");
 
 //Session::checkRight('config', "w");
 
 $itemtype = $_GET['itemtype'];
-$function = $_GET['function'];
 $items_id = $_GET['items_id'];
 
 header('Cache-control: private, must-revalidate'); /// IE BUG + SSL
 header('Content-disposition: attachment; filename='.$_GET['filename']);
 header('Content-type: text/plain');
 
 
-call_user_func(['PluginFusioninventoryToolbox', $function], $items_id, $itemtype);
+call_user_func(['PluginFusioninventoryToolbox', 'sendXML'], $items_id, $itemtype);
 
diff --git a/inc/toolbox.class.php b/inc/toolbox.class.php
index c0136ca0d..9d106f829 100644
--- a/inc/toolbox.class.php
+++ b/inc/toolbox.class.php
@@ -516,11 +516,12 @@ class PluginFusioninventoryToolbox {
     *
     * @param integer $items_id
     * @param string $itemtype
     */
    static function sendXML($items_id, $itemtype) {
-      if (call_user_func([$itemtype, 'canView'])) {
+      if (preg_match("/^([a-zA-Z]+)\/(\d+)\/(\d+)\.xml$/", $items_id)
+         && call_user_func([$itemtype, 'canView'])) {
          $xml = file_get_contents(GLPI_PLUGIN_DOC_DIR."/fusioninventory/xml/".$items_id);
          echo $xml;
       } else {
          Html::displayRightError();
       }

Vulnerable code: $function = $_GET['function'];
call_user_func(['PluginFusioninventoryToolbox', $function], $items_id, $itemtype);
      if (call_user_func([$itemtype, 'canView'])) {
Fixed code: call_user_func(['PluginFusioninventoryToolbox', 'sendXML'], $items_id, $itemtype);
      if (preg_match("/^([a-zA-Z]+)\/(\d+)\/(\d+)\.xml$/", $items_id)
         && call_user_func([$itemtype, 'canView'])) {
CVE-2021-25913: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-02-08T22:15Z
Repository: https://github.com/IonicaBizau/set-or-get.js
Language: JavaScript
Files changed: lib/index.js
Commit date: 2020-12-17 22:52:45 +0530
Commit message: Security fix for Prototype Pollution
Diff: diff --git a/lib/index.js b/lib/index.js
index 3c04df8..f9c76f4 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -11,9 +11,11 @@ var Deffy = require("deffy");
  * @param {String|Number} field The field you want to update/create.
  * @param {Object|Array} def The default value.
  * @return {Object|Array} The field value.
  */
 function SetOrGet(input, field, def) {
+    if (field == '__proto__' || field == 'constructor' || field == 'prototype')
+        throw new Error('Restricted setting magical attributes')
     return input[field] = Deffy(input[field], def);
 }
 
 module.exports = SetOrGet;

Fixed code:     if (field == '__proto__' || field == 'constructor' || field == 'prototype')
        throw new Error('Restricted setting magical attributes')
CVE-2021-23386: Missing Initialization of Resource (CWE-909)
value: This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.
CWE description: The product does not initialize a critical resource.
CVSS v3 base score: 6.5
Published: 2021-05-20T17:15Z
Repository: https://github.com/mafintosh/dns-packet
Language: JavaScript
Files changed: index.js
Commit date: 2021-05-19 19:59:39 +0200
Commit message: do trim on encodingLength as well

Diff: diff --git a/index.js b/index.js
index b6a52c6..9b9b4de 100644
--- a/index.js
+++ b/index.js
@@ -76,11 +76,11 @@ name.decode = function (buf, offset) {
 
 name.decode.bytes = 0
 
 name.encodingLength = function (n) {
   if (n === '.') return 1
-  return Buffer.byteLength(n) + 2
+  return Buffer.byteLength(n.replace(/^\.|\.$/gm, '')) + 2
 }
 
 const string = {}
 
 string.encode = function (s, buf, offset) {

Vulnerable code:   return Buffer.byteLength(n) + 2
Fixed code:   return Buffer.byteLength(n.replace(/^\.|\.$/gm, '')) + 2
CVE-2021-23360: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2021-03-21T16:15Z
Repository: https://github.com/ssnau/killport
Language: JavaScript
Files changed: index.js
Commit date: 2021-03-18 01:26:35 +0800
Commit message: fix a vulnerability issue if a provided port is not a number

Diff: diff --git a/index.js b/index.js
index e5f2d6d..8043f1f 100644
--- a/index.js
+++ b/index.js
@@ -3,10 +3,11 @@ var async = require('async');
 var cp = require('child_process');
 var notEmpty = function(x) {return x};
 
 module.exports = function killport(port) {
   return (new Promise(function(resolve, reject) {
+    if (!/^\d+$/.test(port)) throw new Error('port must be a number.');
     var cmd = 'lsof -i:' + port; 
     cp.exec(cmd, function(err, stdout, stderr){
       // do not check `err`, if no process found
       // err will be an instance of Error
       if (stderr) return reject(stderr);

Fixed code:     if (!/^\d+$/.test(port)) throw new Error('port must be a number.');
CVE-2022-25887: Inefficient Regular Expression Complexity (CWE-1333)
value: The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2022-08-30T05:15Z
Repository: https://github.com/apostrophecms/sanitize-html
Language: Unknown
Commit date: 2022-07-20 13:54:07 -0400
Commit message: Merge pull request #557 from apostrophecms/release-2.7.1

Release 2.7.1
CVE-2024-21501: Insufficient Information (NVD-CWE-noinfo)
value: Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-24T05:15Z
Repository: https://github.com/apostrophecms/sanitize-html
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2024-02-22 10:39:04 -0500
Commit message: Merge pull request #650 from dylanarmstrong/fix/ignore-source-maps

fix: ignore source maps when processing with postcss
Diff: diff --cc CHANGELOG.md
index 7a4c168,74d7b22..e4a19bc
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@@ -1,13 -1,15 +1,15 @@@
  # Changelog
  
 -## UNRELEASED
 +## 2.12.0 (2024-02-21)
  
 -- Introduced the `allowedEmptyAttributes` option, enabling explicit specification of empty string values for select attributes, with the default attribute set to `alt`.
 +- Introduced the `allowedEmptyAttributes` option, enabling explicit specification of empty string values for select attributes, with the default attribute set to `alt`. Thanks to [Na](https://github.com/zhna123) for the contribution.
  
 -- Clarified the use of SVGs with a new test and changes to documentation. 
 +- Clarified the use of SVGs with a new test and changes to documentation. Thanks to [Gauav Kumar](https://github.com/gkumar9891) for the contribution.
  
+ - Do not process source maps when processing style tags with PostCSS.
+ 
  ## 2.11.0 (2023-06-21)
  
  - Fix to allow `false` in `allowedClasses` attributes. Thanks to [Kevin Jiang](https://github.com/KevinSJ) for this fix!
  - Upgrade mocha version
  - Apply small linter fixes in tests

Fixed code:  - Do not process source maps when processing style tags with PostCSS.
CVE-2018-20303: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2018-12-20T00:29Z
Repository: https://github.com/gogs/gogs
Language: Go
Files changed: gogs.go, pkg/tool/path.go, pkg/tool/path_test.go, templates/.VERSION
Commit date: 2018-12-18 01:38:08 -0500
Commit message: pkg/tool: improve SanitizePath (#5558)

Diff: diff --git a/gogs.go b/gogs.go
index 8826eb1f..2d8350f7 100644
--- a/gogs.go
+++ b/gogs.go
@@ -14,11 +14,11 @@ import (
 
 	"github.com/gogs/gogs/cmd"
 	"github.com/gogs/gogs/pkg/setting"
 )
 
-const APP_VER = "0.11.81.1217"
+const APP_VER = "0.11.82.1218"
 
 func init() {
 	setting.AppVer = APP_VER
 }
 
diff --git a/pkg/tool/path.go b/pkg/tool/path.go
index 3c0d2d02..528db86d 100644
--- a/pkg/tool/path.go
+++ b/pkg/tool/path.go
@@ -15,7 +15,9 @@ func IsSameSiteURLPath(url string) bool {
 	return len(url) >= 2 && url[0] == '/' && url[1] != '/' && url[1] != '\\'
 }
 
 // SanitizePath sanitizes user-defined file paths to prevent remote code execution.
 func SanitizePath(path string) string {
-	return strings.TrimLeft(path, "./")
+	path = strings.TrimLeft(path, "/")
+	path = strings.Replace(path, "../", "", -1)
+	return path
 }
diff --git a/pkg/tool/path_test.go b/pkg/tool/path_test.go
index c9e18294..9f3441b1 100644
--- a/pkg/tool/path_test.go
+++ b/pkg/tool/path_test.go
@@ -36,10 +36,11 @@ func Test_SanitizePath(t *testing.T) {
 		testCases := []struct {
 			path   string
 			expect string
 		}{
 			{"../../../../../../../../../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"},
+			{"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"},
 
 			{"data/sessions/a/9/a9f0ab6c3ef63dd8", "data/sessions/a/9/a9f0ab6c3ef63dd8"},
 		}
 		for _, tc := range testCases {
 			So(SanitizePath(tc.path), ShouldEqual, tc.expect)
diff --git a/templates/.VERSION b/templates/.VERSION
index da31b367..9f1b25ca 100644
--- a/templates/.VERSION
+++ b/templates/.VERSION
@@ -1 +1 @@
-0.11.81.1217
+0.11.82.1218

Vulnerable code: const APP_VER = "0.11.81.1217"
	return strings.TrimLeft(path, "./")
0.11.81.1217
Fixed code: const APP_VER = "0.11.82.1218"
	path = strings.TrimLeft(path, "/")
	path = strings.Replace(path, "../", "", -1)
	return path
			{"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"},
0.11.82.1218
CVE-2021-43786: Improper Authentication (CWE-287)
value: Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2021-11-29T20:15Z
Repository: https://github.com/NodeBB/NodeBB
Language: JavaScript
Files changed: src/routes/authentication.js
Commit date: 2021-10-25 13:23:54 -0400
Commit message: fix: token verify

Diff: diff --git a/src/routes/authentication.js b/src/routes/authentication.js
index d6b98aa05..6d7a36e03 100644
--- a/src/routes/authentication.js
+++ b/src/routes/authentication.js
@@ -42,17 +42,13 @@ Auth.setAuthVars = function setAuthVars(req) {
 Auth.getLoginStrategies = function () {
 	return loginStrategies;
 };
 
 Auth.verifyToken = async function (token, done) {
-	let { tokens = [] } = await meta.settings.get('core.api');
-	tokens = tokens.reduce((memo, cur) => {
-		memo[cur.token] = cur.uid;
-		return memo;
-	}, {});
-
-	const uid = tokens[token];
+	const { tokens = [] } = await meta.settings.get('core.api');
+	const tokenObj = tokens.find(t => t.token === token);
+	const uid = tokenObj ? tokenObj.uid : undefined;
 
 	if (uid !== undefined) {
 		if (parseInt(uid, 10) > 0) {
 			done(null, {
 				uid: uid,

Vulnerable code: 	let { tokens = [] } = await meta.settings.get('core.api');
	tokens = tokens.reduce((memo, cur) => {
		memo[cur.token] = cur.uid;
		return memo;
	}, {});

	const uid = tokens[token];
Fixed code: 	const { tokens = [] } = await meta.settings.get('core.api');
	const tokenObj = tokens.find(t => t.token === token);
	const uid = tokenObj ? tokenObj.uid : undefined;
CVE-2021-43787: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 6.1
Published: 2021-11-29T20:15Z
Repository: https://github.com/NodeBB/NodeBB
Language: JavaScript
Files changed: src/socket.io/uploads.js
Commit date: 2021-10-25 13:17:33 -0400
Commit message: fix: guard against prototype pollution

Diff: diff --git a/src/socket.io/uploads.js b/src/socket.io/uploads.js
index c3fd025e0..66b7266b0 100644
--- a/src/socket.io/uploads.js
+++ b/src/socket.io/uploads.js
@@ -13,15 +13,16 @@ uploads.upload = async function (socket, data) {
 	const methodToFunc = {
 		'user.uploadCroppedPicture': socketUser.uploadCroppedPicture,
 		'user.updateCover': socketUser.updateCover,
 		'groups.cover.update': socketGroup.cover.update,
 	};
-	if (!socket.uid || !data || !data.chunk || !data.params || !data.params.method || !methodToFunc[data.params.method]) {
+	if (!socket.uid || !data || !data.chunk ||
+		!data.params || !data.params.method || !methodToFunc.hasOwnProperty(data.params.method)) {
 		throw new Error('[[error:invalid-data]]');
 	}
 
-	inProgress[socket.id] = inProgress[socket.id] || {};
+	inProgress[socket.id] = inProgress[socket.id] || Object.create(null);
 	const socketUploads = inProgress[socket.id];
 	const { method } = data.params;
 
 	socketUploads[method] = socketUploads[method] || { imageData: '' };
 	socketUploads[method].imageData += data.chunk;

Vulnerable code: 	if (!socket.uid || !data || !data.chunk || !data.params || !data.params.method || !methodToFunc[data.params.method]) {
	inProgress[socket.id] = inProgress[socket.id] || {};
Fixed code: 	if (!socket.uid || !data || !data.chunk ||
		!data.params || !data.params.method || !methodToFunc.hasOwnProperty(data.params.method)) {
	inProgress[socket.id] = inProgress[socket.id] || Object.create(null);
CVE-2021-43787: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-11-29T20:15Z
Repository: https://github.com/NodeBB/NodeBB
Language: JavaScript
Files changed: src/socket.io/uploads.js
Commit date: 2021-10-25 13:17:33 -0400
Commit message: fix: guard against prototype pollution

Diff: diff --git a/src/socket.io/uploads.js b/src/socket.io/uploads.js
index c3fd025e0..66b7266b0 100644
--- a/src/socket.io/uploads.js
+++ b/src/socket.io/uploads.js
@@ -13,15 +13,16 @@ uploads.upload = async function (socket, data) {
 	const methodToFunc = {
 		'user.uploadCroppedPicture': socketUser.uploadCroppedPicture,
 		'user.updateCover': socketUser.updateCover,
 		'groups.cover.update': socketGroup.cover.update,
 	};
-	if (!socket.uid || !data || !data.chunk || !data.params || !data.params.method || !methodToFunc[data.params.method]) {
+	if (!socket.uid || !data || !data.chunk ||
+		!data.params || !data.params.method || !methodToFunc.hasOwnProperty(data.params.method)) {
 		throw new Error('[[error:invalid-data]]');
 	}
 
-	inProgress[socket.id] = inProgress[socket.id] || {};
+	inProgress[socket.id] = inProgress[socket.id] || Object.create(null);
 	const socketUploads = inProgress[socket.id];
 	const { method } = data.params;
 
 	socketUploads[method] = socketUploads[method] || { imageData: '' };
 	socketUploads[method].imageData += data.chunk;

Vulnerable code: 	if (!socket.uid || !data || !data.chunk || !data.params || !data.params.method || !methodToFunc[data.params.method]) {
	inProgress[socket.id] = inProgress[socket.id] || {};
Fixed code: 	if (!socket.uid || !data || !data.chunk ||
		!data.params || !data.params.method || !methodToFunc.hasOwnProperty(data.params.method)) {
	inProgress[socket.id] = inProgress[socket.id] || Object.create(null);
CVE-2022-36076: Cross-Site Request Forgery (CSRF) (CWE-352)
value: NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 7.5
Published: 2022-09-02T13:15Z
Repository: https://github.com/NodeBB/NodeBB
Language: JavaScript
Files changed: src/routes/authentication.js
Commit date: 2021-06-14 14:13:39 -0400
Commit message: fix: accidental unnecessarily strict conditional that effectively rendered SSO state checking opt-in instead of opt-out

Diff: diff --git a/src/routes/authentication.js b/src/routes/authentication.js
index ca7b98d870..cbc3841872 100644
--- a/src/routes/authentication.js
+++ b/src/routes/authentication.js
@@ -102,11 +102,11 @@ Auth.reloadRoutes = async function (params) {
 				let opts = {
 					scope: strategy.scope,
 					prompt: strategy.prompt || undefined,
 				};
 
-				if (strategy.checkState) {
+				if (strategy.checkState !== false) {
 					req.session.ssoState = req.csrfToken && req.csrfToken();
 					opts.state = req.session.ssoState;
 				}
 
 				// Allow SSO plugins to override/append options (for use in passport prototype authorizationParams)

Vulnerable code: 				if (strategy.checkState) {
Fixed code: 				if (strategy.checkState !== false) {
CVE-2022-46164: Improper Initialization (CWE-665)
value: NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

CWE description: The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
CVSS v3 base score: 9.8
Published: 2022-12-05T21:15Z
Repository: https://github.com/NodeBB/NodeBB
Language: JavaScript
Files changed: src/socket.io/index.js
Commit date: 2022-11-27 19:32:35 -0500
Commit message: fix: prototype vulnerability in socket.io onMessage

Diff: diff --git a/src/socket.io/index.js b/src/socket.io/index.js
index 58134ae2e2..b77edbb57d 100644
--- a/src/socket.io/index.js
+++ b/src/socket.io/index.js
@@ -11,11 +11,11 @@ const db = require('../database');
 const user = require('../user');
 const logger = require('../logger');
 const plugins = require('../plugins');
 const ratelimit = require('../middleware/ratelimit');
 
-const Namespaces = {};
+const Namespaces = Object.create(null);
 
 const Sockets = module.exports;
 
 Sockets.init = async function (server) {
 	requireModules();

Vulnerable code: const Namespaces = {};
Fixed code: const Namespaces = Object.create(null);
CVE-2023-26045: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2023-07-24T22:15Z
Repository: https://github.com/NodeBB/NodeBB
Language: JavaScript
Files changed: src/api/users.js, src/socket.io/user/profile.js
Commit date: 2023-02-27 09:10:53 -0500
Commit message: fix: object destructuring overwriting type parameter

also check for valid types in generateExport

Diff: diff --git a/src/api/users.js b/src/api/users.js
index e0382c95cd7..bbb02a43bbf 100644
--- a/src/api/users.js
+++ b/src/api/users.js
@@ -441,10 +441,14 @@ usersAPI.changePicture = async (caller, data) => {
 		'icon:bgColor': data.bgColor,
 	}, ['picture', 'icon:bgColor']);
 };
 
 usersAPI.generateExport = async (caller, { uid, type }) => {
+	const validTypes = ['profile', 'posts', 'uploads'];
+	if (!validTypes.includes(type)) {
+		throw new Error('[[error:invalid-data]]');
+	}
 	const count = await db.incrObjectField('locks', `export:${uid}${type}`);
 	if (count > 1) {
 		throw new Error('[[error:already-exporting]]');
 	}
 
diff --git a/src/socket.io/user/profile.js b/src/socket.io/user/profile.js
index 20a869056c1..95c00971161 100644
--- a/src/socket.io/user/profile.js
+++ b/src/socket.io/user/profile.js
@@ -72,8 +72,8 @@ module.exports = function (SocketUser) {
 			throw new Error('[[error:invalid-data]]');
 		}
 
 		await user.isAdminOrSelf(socket.uid, data.uid);
 
-		api.users.generateExport(socket, { type, ...data });
+		api.users.generateExport(socket, { type, uid: data.uid });
 	}
 };

Vulnerable code: 		api.users.generateExport(socket, { type, ...data });
Fixed code: 	const validTypes = ['profile', 'posts', 'uploads'];
	if (!validTypes.includes(type)) {
		throw new Error('[[error:invalid-data]]');
	}
		api.users.generateExport(socket, { type, uid: data.uid });
CVE-2023-30591: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 7.5
Published: 2023-09-29T06:15Z
Repository: https://github.com/NodeBB/NodeBB
Language: JavaScript
Files changed: loader.js
Commit date: 2023-03-27 10:55:44 -0400
Commit message: fix: #11403, remove loader.js crash counter logic

Diff: diff --git a/loader.js b/loader.js
index 1d86d3a37ef..9a1f0cdbad9 100644
--- a/loader.js
+++ b/loader.js
@@ -28,13 +28,11 @@ if (!fs.existsSync(logDir)) {
 
 const output = logrotate({ file: outputLogFilePath, size: '1m', keep: 3, compress: true });
 const silent = nconf.get('silent') === 'false' ? false : nconf.get('silent') !== false;
 let numProcs;
 const workers = [];
-const Loader = {
-	timesStarted: 0,
-};
+const Loader = {};
 const appPath = path.join(__dirname, 'app.js');
 
 Loader.init = function () {
 	if (silent) {
 		console.log = (...args) => {
@@ -55,25 +53,10 @@ Loader.displayStartupMessages = function () {
 	console.log('');
 };
 
 Loader.addWorkerEvents = function (worker) {
 	worker.on('exit', (code, signal) => {
-		if (code !== 0) {
-			if (Loader.timesStarted < numProcs * 3) {
-				Loader.timesStarted += 1;
-				if (Loader.crashTimer) {
-					clearTimeout(Loader.crashTimer);
-				}
-				Loader.crashTimer = setTimeout(() => {
-					Loader.timesStarted = 0;
-				}, 10000);
-			} else {
-				console.log(`${numProcs * 3} restarts in 10 seconds, most likely an error on startup. Halting.`);
-				process.exit();
-			}
-		}
-
 		console.log(`[cluster] Child Process (${worker.pid}) has exited (code: ${code}, signal: ${signal})`);
 		if (!(worker.suicide || code === 0)) {
 			console.log('[cluster] Spinning up another process...');
 
 			forkWorker(worker.index, worker.isPrimary);

Vulnerable code: const Loader = {
	timesStarted: 0,
};
		if (code !== 0) {
			if (Loader.timesStarted < numProcs * 3) {
				Loader.timesStarted += 1;
				if (Loader.crashTimer) {
					clearTimeout(Loader.crashTimer);
				}
				Loader.crashTimer = setTimeout(() => {
					Loader.timesStarted = 0;
				}, 10000);
			} else {
				console.log(`${numProcs * 3} restarts in 10 seconds, most likely an error on startup. Halting.`);
				process.exit();
			}
		}

Fixed code: const Loader = {};
CVE-2023-30591: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 7.5
Published: 2023-09-29T06:15Z
Repository: https://github.com/NodeBB/NodeBB
Language: JavaScript
Files changed: src/socket.io/index.js, test/socket.io.js
Commit date: 2023-03-27 10:38:53 -0400
Commit message: fix: don't crash if event name is not a string

Diff: diff --git a/src/socket.io/index.js b/src/socket.io/index.js
index 60c7a8cd277..30e4e23581f 100644
--- a/src/socket.io/index.js
+++ b/src/socket.io/index.js
@@ -118,11 +118,16 @@ async function onMessage(socket, payload) {
 
 	if (!eventName) {
 		return winston.warn('[socket.io] Empty method name');
 	}
 
-	const parts = eventName.toString().split('.');
+	if (typeof eventName !== 'string') {
+		const escapedName = validator.escape(String(eventName));
+		return callback({ message: `[[error:invalid-event, ${escapedName}]]` });
+	}
+
+	const parts = eventName.split('.');
 	const namespace = parts[0];
 	const methodToCall = parts.reduce((prev, cur) => {
 		if (prev !== null && prev[cur] && (!prev.hasOwnProperty || prev.hasOwnProperty(cur))) {
 			return prev[cur];
 		}
diff --git a/test/socket.io.js b/test/socket.io.js
index 1a94a38f7c9..333a9cea97e 100644
--- a/test/socket.io.js
+++ b/test/socket.io.js
@@ -105,10 +105,19 @@ describe('socket.io', () => {
 			assert.equal(err.message, '[[error:invalid-event, constructor.toString]]');
 			done();
 		});
 	});
 
+	it('should return error for invalid eventName type', (done) => {
+		const eventName = ['topics.loadMoreTags'];
+		io.emit(eventName, function (err) {
+			const eventAsString = String(eventName);
+			assert.strictEqual(err.message, `[[error:invalid-event, ${eventAsString}]]`);
+			done();
+		});
+	});
+
 	it('should get installed themes', (done) => {
 		const themes = ['nodebb-theme-lavender', 'nodebb-theme-persona', 'nodebb-theme-vanilla'];
 		io.emit('admin.themes.getInstalled', (err, data) => {
 			assert.ifError(err);
 			assert(data);

Vulnerable code: 	const parts = eventName.toString().split('.');
Fixed code: 	if (typeof eventName !== 'string') {
		const escapedName = validator.escape(String(eventName));
		return callback({ message: `[[error:invalid-event, ${escapedName}]]` });
	}

	const parts = eventName.split('.');
	it('should return error for invalid eventName type', (done) => {
		const eventName = ['topics.loadMoreTags'];
		io.emit(eventName, function (err) {
			const eventAsString = String(eventName);
			assert.strictEqual(err.message, `[[error:invalid-event, ${eventAsString}]]`);
			done();
		});
	});
CVE-2020-36637: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been declared as problematic. This vulnerability affects unknown code of the file resources/core/adminserv.php. The manipulation of the argument text leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7. It is recommended to apply a patch to fix this issue. VDB-217042 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-30T12:15Z
Repository: https://github.com/Chris92de/AdminServ
Language: Unknown
Commit date: 2020-10-04 22:51:06 +0200
Commit message: Merge pull request #7 from lacaulac/patch-2

Fixed an XSS vulnerability
CVE-2021-46461: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2022-02-14T22:15Z
Repository: https://github.com/nginx/njs
Language: C
Files changed: src/njs_vmcode.c, src/test/njs_unit_test.c
Commit date: 2021-12-24 10:00:15 +0300
Commit message: Added missing element in typeof table for DataView() type.

Previously, typeof operation for DataView object resulted
in out of bounds array accessing.

This fixes #450 issue on Github.

Diff: diff --git a/src/njs_vmcode.c b/src/njs_vmcode.c
index 5facef5..7591125 100644
--- a/src/njs_vmcode.c
+++ b/src/njs_vmcode.c
@@ -1514,10 +1514,11 @@ njs_vmcode_typeof(njs_vm_t *vm, njs_value_t *value, njs_value_t *invld)
         &njs_string_object,
         &njs_string_object,
         &njs_string_object,
         &njs_string_object,
         &njs_string_object,
+        &njs_string_object,
     };
 
     vm->retval = *types[value->type];
 
     return sizeof(njs_vmcode_2addr_t);
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index c8440d1..7470b4b 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -6388,10 +6388,13 @@ static njs_unit_test_t  njs_test[] =
       njs_str("-Infinity,-5,0,0,1,2,3,3,Infinity,NaN,NaN") },
 
     { njs_str("(new DataView(new ArrayBuffer(3)))"),
       njs_str("[object DataView]") },
 
+    { njs_str("var x = new ArrayBuffer(3); [typeof x, typeof new DataView(x)]"),
+      njs_str("object,object") },
+
     { njs_str("(new DataView(new ArrayBuffer(3))).buffer"),
       njs_str("[object ArrayBuffer]") },
 
     { njs_str("(new DataView(new ArrayBuffer(3))).byteLength"),
       njs_str("3") },

Fixed code:         &njs_string_object,
    { njs_str("var x = new ArrayBuffer(3); [typeof x, typeof new DataView(x)]"),
      njs_str("object,object") },