Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-29779: Insufficient Information (NVD-CWE-noinfo)
value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2022-06-02T14:15Z
Repository: https://github.com/nginx/njs
Language: C
Files changed: src/njs_array.c, src/test/njs_unit_test.c
Commit date: 2022-04-22 17:02:36 -0700
Commit message: Fixed Array.prototype.slice() with slow "this" argument.

Previously, when "this" argument was not a fast array, but the "deleted" array
was a fast array, the "deleted" array may be left in uninitialized state if
"this" argument had gaps.

This fix is to ensure that "deleted" is properly initialized.

This fixes #485 issue on Github.

Diff: diff --git a/src/njs_array.c b/src/njs_array.c
index 0b8c7b919..2ceb6be7e 100644
--- a/src/njs_array.c
+++ b/src/njs_array.c
@@ -1282,10 +1282,15 @@ njs_array_prototype_splice(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
                 /* TODO:  CreateDataPropertyOrThrow(). */
                 ret = njs_value_property_i64_set(vm, &del_object, i, &value);
                 if (njs_slow_path(ret == NJS_ERROR)) {
                     return ret;
                 }
+
+            } else {
+                if (deleted->object.fast_array) {
+                    njs_set_invalid(&deleted->start[i]);
+                }
             }
         }
 
         ret = njs_object_length_set(vm, &del_object, delete);
         if (njs_slow_path(ret != NJS_OK)) {
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 25e066c32..b28e34fef 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -4867,10 +4867,19 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("var obj = {'9007199254740990': 'A', '9007199254740991': 'B',"
               "           length: 2 ** 53 - 1};"
               "Array.prototype.splice.call(obj, 2**53-2, 0, 'C');"),
       njs_str("TypeError: Invalid length") },
 
+    { njs_str("var a = {1: 'B', length: 2};"
+              "Array.prototype.splice.call(a, 0)"),
+      njs_str(",B") },
+
+    { njs_str("var a = new Uint8Array();"
+              "a.__proto__ = [1,2,3];"
+              "a.splice(0)"),
+      njs_str(",,") },
+
     { njs_str("var a = []; a.reverse()"),
       njs_str("") },
 
     { njs_str("var a = [1]; a.reverse()"),
       njs_str("1") },

Fixed code: 
            } else {
                if (deleted->object.fast_array) {
                    njs_set_invalid(&deleted->start[i]);
                }
    { njs_str("var a = {1: 'B', length: 2};"
              "Array.prototype.splice.call(a, 0)"),
      njs_str(",B") },

    { njs_str("var a = new Uint8Array();"
              "a.__proto__ = [1,2,3];"
              "a.splice(0)"),
      njs_str(",,") },
CVE-2022-29780: Insufficient Information (NVD-CWE-noinfo)
value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2022-06-02T14:15Z
Repository: https://github.com/nginx/njs
Language: C
Files changed: src/njs_array.c, src/test/njs_unit_test.c
Commit date: 2022-04-22 17:02:28 -0700
Commit message: Fixed Array.prototype.sort() when arr size is changed in a comparator.

This fixed #468 issue on Github.

Diff: diff --git a/src/njs_array.c b/src/njs_array.c
index 81a7c1555..0b8c7b919 100644
--- a/src/njs_array.c
+++ b/src/njs_array.c
@@ -2694,11 +2694,11 @@ slow_path:
     if (ctx.exception) {
         ret = NJS_ERROR;
         goto exception;
     }
 
-    if (njs_fast_path(fast_path)) {
+    if (njs_fast_path(fast_path && njs_is_fast_array(this))) {
         array = njs_array(this);
         start = array->start;
 
         for (i = 0; i < len; i++) {
             start[i] = slots[i].value;
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 186defa1a..25e066c32 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -6987,10 +6987,13 @@ static njs_unit_test_t  njs_test[] =
       njs_str("Error: Oops") },
 
     { njs_str("[1,2].sort(1)"),
       njs_str("TypeError: comparefn must be callable or undefined") },
 
+    { njs_str("var a = [1,2]; a.sort(() => {a.length = 65535}); a.length"),
+      njs_str("65535") },
+
     /*
       Array.prototype.keys()
       Array.prototype.values()
       Array.prototype.entries()
     */

Vulnerable code:     if (njs_fast_path(fast_path)) {
Fixed code:     if (njs_fast_path(fast_path && njs_is_fast_array(this))) {
    { njs_str("var a = [1,2]; a.sort(() => {a.length = 65535}); a.length"),
      njs_str("65535") },
CVE-2022-30503: Insufficient Information (NVD-CWE-noinfo)
value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_set_number at src/njs_value.h.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2022-06-02T14:15Z
Repository: https://github.com/nginx/njs
Language: C
Files changed: src/njs_typed_array.c, src/test/njs_unit_test.c
Commit date: 2022-05-06 18:55:35 -0700
Commit message: Fixed Array.prototype.fill() for typed-arrays.

This closes #478 issue on Github.

Diff: diff --git a/src/njs_typed_array.c b/src/njs_typed_array.c
index 94dfd5e89..2e8b0c898 100644
--- a/src/njs_typed_array.c
+++ b/src/njs_typed_array.c
@@ -700,12 +700,10 @@ njs_typed_array_set_value(njs_vm_t *vm, njs_typed_array_t *array,
         return NJS_ERROR;
     }
 
     njs_typed_array_prop_set(vm, array, index, num);
 
-    njs_set_number(setval, num);
-
     return NJS_OK;
 }
 
 
 static njs_int_t
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 77ec044e1..490c0773f 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -5407,10 +5407,13 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("var o = Object({length: 3});"
                  "Object.defineProperty(o, '0', {set: function(v){this.a = 2 * v}});"
                  "Array.prototype.fill.call(o, 2).a"),
       njs_str("4") },
 
+    { njs_str("Array.prototype.fill.call(new Int32Array(1))"),
+      njs_str("0") },
+
     { njs_str("ArrayBuffer()"),
       njs_str("TypeError: Constructor ArrayBuffer requires 'new'") },
 
     { njs_str("new ArrayBuffer()"),
       njs_str("[object ArrayBuffer]") },

Vulnerable code:     njs_set_number(setval, num);

Fixed code:     { njs_str("Array.prototype.fill.call(new Int32Array(1))"),
      njs_str("0") },
CVE-2022-31306: Use After Free (CWE-416)
value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at src/njs_array.c.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2022-06-21T13:15Z
Repository: https://github.com/nginx/njs
Language: C
Files changed: src/njs_array.c, src/test/njs_unit_test.c
Commit date: 2022-05-06 18:55:07 -0700
Commit message: Fixed Object.defineProperty() when a recursive descriptor is provided.

This closes #481 issue on Github.

Diff: diff --git a/src/njs_array.c b/src/njs_array.c
index ec3a5da93..2367420dc 100644
--- a/src/njs_array.c
+++ b/src/njs_array.c
@@ -140,10 +140,14 @@ njs_array_convert_to_slow_array(njs_vm_t *vm, njs_array_t *array)
 {
     uint32_t           i, length;
     njs_value_t        index, value;
     njs_object_prop_t  *prop;
 
+    if (njs_slow_path(!array->object.fast_array)) {
+        return NJS_OK;
+    }
+
     njs_set_array(&value, array);
     array->object.fast_array = 0;
 
     length = array->length;
 
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 87d8d46c0..77ec044e1 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -13835,10 +13835,20 @@ static njs_unit_test_t  njs_test[] =
               "Object.defineProperty(o, 'a', desc);"
               "var d = Object.getOwnPropertyDescriptor(o, 'a');"
               "d.enumerable && d.writable && d.configurable"),
       njs_str("true") },
 
+    { njs_str("const arr = [1,2];"
+              "function f(arg) {"
+              "        const desc = {get: arg};"
+              "        Object.defineProperty(desc, 'set', desc);"
+              "        Object.defineProperty(arr, 1, desc);"
+              "}"
+              "f(f);"
+              "njs.dump(arr)"),
+      njs_str("[1,'[Getter]']") },
+
     { njs_str("Object.defineProperties()"),
       njs_str("TypeError: Object.defineProperties is called on non-object") },
 
     { njs_str("Object.defineProperties(1, {})"),
       njs_str("TypeError: Object.defineProperties is called on non-object") },

Fixed code:     if (njs_slow_path(!array->object.fast_array)) {
        return NJS_OK;
    }

    { njs_str("const arr = [1,2];"
              "function f(arg) {"
              "        const desc = {get: arg};"
              "        Object.defineProperty(desc, 'set', desc);"
              "        Object.defineProperty(arr, 1, desc);"
              "}"
              "f(f);"
              "njs.dump(arr)"),
      njs_str("[1,'[Getter]']") },
CVE-2022-31307: Use After Free (CWE-416)
value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string.c.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2022-06-21T13:15Z
Repository: https://github.com/nginx/njs
Language: C
Files changed: src/njs_iterator.c, src/test/njs_unit_test.c
Commit date: 2022-04-27 16:31:00 -0700
Commit message: Fixed Array.prototype.lastIndexOf() with unicode string as "this".

Previously, when lastIndexOf() was called with unicode string as "this"
argument and a negative "fromIndex" argument null-pointer dererence
might occur because njs_string_offset() was called with invalid index
value whereas njs_string_offset() should always be called with valid
index argument.

The fix is to verify that from index is valid.

This closes #482 issue on Github.

Diff: diff --git a/src/njs_iterator.c b/src/njs_iterator.c
index 90c3046fb..043e4483c 100644
--- a/src/njs_iterator.c
+++ b/src/njs_iterator.c
@@ -558,15 +558,18 @@ njs_object_iterate_reverse(njs_vm_t *vm, njs_iterator_args_t *args,
             }
 
         } else {
             /* UTF-8 string. */
 
-            p = njs_string_offset(string_prop.start, end, from);
-            p = njs_utf8_next(p, end);
-
+            p = NULL;
             i = from + 1;
 
+            if (i > to) {
+                p = njs_string_offset(string_prop.start, end, from);
+                p = njs_utf8_next(p, end);
+            }
+
             while (i-- > to) {
                 pos = njs_utf8_prev(p);
 
                 /* This cannot fail. */
                 (void) njs_string_new(vm, &character, pos, p - pos , 1);
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index def152aa8..0b73c77b3 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -5101,10 +5101,13 @@ static njs_unit_test_t  njs_test[] =
       njs_str("-1") },
 
     { njs_str("Array.prototype.lastIndexOf.call({0:'undefined', length:0}, 'undefined')"),
       njs_str("-1") },
 
+    { njs_str("[1,0,-1,-2].map(v => Array.prototype.lastIndexOf.call('Ф', 'Ф', v))"),
+      njs_str("0,0,0,-1") },
+
     { njs_str("[''].lastIndexOf.call('00000000000000000000000000000а00')"),
       njs_str("-1") },
 
     { njs_str("var o = 'ГВБА';"
               "Array.prototype.lastIndexOf.call(o, 'Г', 0)"),

Vulnerable code:             p = njs_string_offset(string_prop.start, end, from);
            p = njs_utf8_next(p, end);

Fixed code:             p = NULL;
            if (i > to) {
                p = njs_string_offset(string_prop.start, end, from);
                p = njs_utf8_next(p, end);
            }

    { njs_str("[1,0,-1,-2].map(v => Array.prototype.lastIndexOf.call('Ф', 'Ф', v))"),
      njs_str("0,0,0,-1") },
CVE-2024-4140: Insufficient Information (NVD-CWE-noinfo)
value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-02T20:15Z
Repository: https://github.com/rjbs/Email-MIME
Language: Perl
Files changed: lib/Email/MIME.pm
Commit date: 2020-05-09 13:53:27 -0400
Commit message: add MAX_DEPTH to limit depth of parsed emails

Diff: diff --git a/lib/Email/MIME.pm b/lib/Email/MIME.pm
index e6218d0..ce11dde 100644
--- a/lib/Email/MIME.pm
+++ b/lib/Email/MIME.pm
@@ -375,14 +375,21 @@ sub body_str {
 
   my $str = Encode::decode($encoding, $self->body, $self->encode_check);
   return $str;
 }
 
+our $MAX_DEPTH = 10;
+
 sub parts_multipart {
   my $self     = shift;
   my $boundary = $self->{ct}->{attributes}->{boundary};
 
+  our $DEPTH ||= 0;
+
+  Carp::croak("attempted to parse a MIME message more than $MAX_DEPTH deep")
+    if $MAX_DEPTH && $DEPTH > $MAX_DEPTH;
+
   # Take a message, join all its lines together.  Now try to Email::MIME->new
   # it with 1.861 or earlier.  Death!  It tries to recurse endlessly on the
   # body, because every time it splits on boundary it gets itself. Obviously
   # that means it's a bogus message, but a mangled result (or exception) is
   # better than endless recursion. -- rjbs, 2008-01-07
@@ -409,10 +416,11 @@ sub parts_multipart {
 
   my @parts;
   for my $bit (@bits) {
     $bit =~ s/\A[\n\r]+//smg;
     $bit =~ s/(?<!\x0d)$self->{mycrlf}\Z//sm;
+    local $DEPTH = $DEPTH + 1;
     my $email = (ref $self)->new($bit, { encode_check => $self->encode_check });
     push @parts, $email;
   }
 
   $self->{parts} = \@parts;

Fixed code: our $MAX_DEPTH = 10;

  our $DEPTH ||= 0;

  Carp::croak("attempted to parse a MIME message more than $MAX_DEPTH deep")
    if $MAX_DEPTH && $DEPTH > $MAX_DEPTH;

    local $DEPTH = $DEPTH + 1;
CVE-2024-4140: Insufficient Information (NVD-CWE-noinfo)
value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-02T20:15Z
Repository: https://github.com/rjbs/Email-MIME
Language: Perl
Files changed: lib/Email/MIME.pm
Commit date: 2020-05-09 14:23:02 -0400
Commit message: document MAX_DEPTH

Diff: diff --git a/lib/Email/MIME.pm b/lib/Email/MIME.pm
index ce11dde..771c69a 100644
--- a/lib/Email/MIME.pm
+++ b/lib/Email/MIME.pm
@@ -1055,10 +1055,16 @@ For example:
 
   + multipart/alternative; boundary="=_NextPart_2"; charset="BIG-5"
     + text/plain
     + text/html
 
+=head1 CONFIGURATION
+
+The variable C<$Email::MIME::MAX_DEPTH> is the maximum depth of parts that will
+be processed.  It defaults to 10, already higher than legitimate mail is ever
+likely to be.  This value may go up over time as the parser is improved.
+
 =head1 TODO
 
 All of the Email::MIME-specific guts should move to a single entry on the
 object's guts.  This will require changes to both Email::MIME and
 L<Email::MIME::Modifier>, sadly.

Fixed code: =head1 CONFIGURATION

The variable C<$Email::MIME::MAX_DEPTH> is the maximum depth of parts that will
be processed.  It defaults to 10, already higher than legitimate mail is ever
likely to be.  This value may go up over time as the parser is improved.
CVE-2024-4140: Insufficient Information (NVD-CWE-noinfo)
value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-02T20:15Z
Repository: https://github.com/rjbs/Email-MIME
Language: Perl
Files changed: lib/Email/MIME.pm
Commit date: 2024-05-02 13:11:20 -0400
Commit message: document $MAX_PARTS

Diff: diff --git a/lib/Email/MIME.pm b/lib/Email/MIME.pm
index fb2dbe4..c009341 100644
--- a/lib/Email/MIME.pm
+++ b/lib/Email/MIME.pm
@@ -1058,10 +1058,18 @@ For example:
 
 The variable C<$Email::MIME::MAX_DEPTH> is the maximum depth of parts that will
 be processed.  It defaults to 10, already higher than legitimate mail is ever
 likely to be.  This value may go up over time as the parser is improved.
 
+The variable C<$Email::MIME::MAX_PARTS> is the maximum number of parts that
+will be processed.  It defaults to 100, already higher than legitimate mail is
+ever likely to be.  This value may go up over time as the parser is improved or
+as research suggests that our starting position was wrong.
+
+Increasing either of these variables risks significant consumption of memory.
+Test before changing things.
+
 =head1 SEE ALSO
 
 L<Email::Simple>
 
 =head1 THANKS

Fixed code: The variable C<$Email::MIME::MAX_PARTS> is the maximum number of parts that
will be processed.  It defaults to 100, already higher than legitimate mail is
ever likely to be.  This value may go up over time as the parser is improved or
as research suggests that our starting position was wrong.

Increasing either of these variables risks significant consumption of memory.
Test before changing things.
CVE-2024-4140: Insufficient Information (NVD-CWE-noinfo)
value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-02T20:15Z
Repository: https://github.com/rjbs/Email-MIME
Language: Other
Files changed: Changes
Commit date: 2024-05-02 14:53:08 -0400
Commit message: Changes: mention $MAX_PARTS

Diff: diff --git a/Changes b/Changes
index f1d9be7..e94810f 100644
--- a/Changes
+++ b/Changes
@@ -1,8 +1,13 @@
 Revision history for Perl extension Email::MIME.
 
 {{$NEXT}}
+        - Fix for CVE-2024-4140: An excessive memory use issue (CWE-770)
+          exists in Email-MIME, before version 1.954, which can cause denial of
+          service when parsing multipart MIME messages.  The fix is the new
+          $MAX_PARTS configuration limits how many parts we will consider
+          parsing.  The default $MAX_PARTS is 100.
 
 1.953     2023-01-08 19:02:24-05:00 America/New_York
         - as promised, this release no longer works on v5.8; in fact, due to
           some upstream libraries, it hasn't in some time
         - documentation has been cleaned up to stop referencing long-dead other

Fixed code:         - Fix for CVE-2024-4140: An excessive memory use issue (CWE-770)
          exists in Email-MIME, before version 1.954, which can cause denial of
          service when parsing multipart MIME messages.  The fix is the new
          $MAX_PARTS configuration limits how many parts we will consider
          parsing.  The default $MAX_PARTS is 100.
CVE-2022-39237: Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
value: syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
CWE description: The product uses a broken or risky cryptographic algorithm or protocol.
CVSS v3 base score: 9.8
Published: 2022-10-06T18:16Z
Repository: https://github.com/sylabs/sif
Language: Unknown
Commit date: 2022-10-06 07:52:14 -0400
Commit message: Merge pull request from GHSA-m5m3-46gj-wch8

Improve Digital Signature Hash Algorithm Validation
CVE-2024-31462: Insufficient Information (NVD-CWE-noinfo)
value: stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file write affecting Windows systems. The create_ui method (Backup/Restore tab) in modules/ui_extensions.py takes user input into the config_save_name variable on line 653. This user input is later used in the save_config_state method and used to create a file path on line 65, which is afterwards opened for writing on line 67, which leads to a limited file write exploitable on Windows systems. This issue may lead to limited file write. It allows for writing json files anywhere on the server where the web server has access.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-12T22:15Z
Repository: https://github.com/AUTOMATIC1111/stable-diffusion-webui
Language: Python
Files changed: modules/ui_extensions.py
Commit date: 2024-04-08 16:15:25 +0300
Commit message: fix limited file write (thanks, Sylwia)

Diff: diff --git a/modules/ui_extensions.py b/modules/ui_extensions.py
index 913e1444..d822c0b8 100644
--- a/modules/ui_extensions.py
+++ b/modules/ui_extensions.py
@@ -56,12 +56,13 @@ def apply_and_restart(disable_list, update_list, disable_all):
         restart.stop_program()
 
 
 def save_config_state(name):
     current_config_state = config_states.get_config()
-    if not name:
-        name = "Config"
+
+    name = os.path.basename(name or "Config")
+
     current_config_state["name"] = name
     timestamp = datetime.now().strftime('%Y_%m_%d-%H_%M_%S')
     filename = os.path.join(config_states_dir, f"{timestamp}_{name}.json")
     print(f"Saving backup of webui/extension state to {filename}.")
     with open(filename, "w", encoding="utf-8") as f:

Vulnerable code:     if not name:
        name = "Config"
Fixed code: 
    name = os.path.basename(name or "Config")
CVE-2022-25303: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping), meaning the user input is not escaped.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-07-12T15:15Z
Repository: https://github.com/benbusby/whoogle-search
Language: HTML
Files changed: app/templates/error.html
Commit date: 2022-04-26 09:28:05 -0600
Commit message: Render error message w/o `safe` filter

The error message shown in the error template does not need to be
rendered using the safe filter, and furthermore opens up an XSS
vulnerability.

Diff: diff --git a/app/templates/error.html b/app/templates/error.html
index 58f7f42..708f749 100644
--- a/app/templates/error.html
+++ b/app/templates/error.html
@@ -14,11 +14,11 @@
 <link rel="stylesheet" href="{{ cb_url('error.css') }}">
 <style>{{ config.style }}</style>
 <div>
     <h1>Error</h1>
     <p>
-        {{ error_message|safe }}
+        {{ error_message }}
     </p>
     <hr>
     <p>
     {% if blocked is defined %}
         <h4><a class="link" href="https://farside.link">{{ translation['continue-search'] }}</a></h4>

Vulnerable code:         {{ error_message|safe }}
Fixed code:         {{ error_message }}
CVE-2020-35963: Out-of-bounds Write (CWE-787)
value: flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-01-03T19:15Z
Repository: https://github.com/fluent/fluent-bit
Language: C
Files changed: src/flb_gzip.c
Commit date: 2020-11-07 10:40:19 -0600
Commit message: gzip: fix compression size calculation (oss-fuzz 27261)

Signed-off-by: davkor <david@adalogics.com>

Diff: diff --git a/src/flb_gzip.c b/src/flb_gzip.c
index 116c92bf..54f868ea 100644
--- a/src/flb_gzip.c
+++ b/src/flb_gzip.c
@@ -75,12 +75,29 @@ int flb_gzip_compress(void *in_data, size_t in_len,
     size_t out_size;
     void *out_buf;
     z_stream strm;
     mz_ulong crc;
 
-    out_size = in_len + 32;
+
+    /*
+     * GZIP relies on an algorithm with worst-case expansion
+     * of 5 bytes per 32KB data. This means we need to create a variable
+     * length output, that depends on the input length.
+     * See RFC 1951 for details.
+     */
+    int max_input_expansion = ((int)(in_len / 32000) + 1) * 5;
+
+    /*
+     * Max compressed size is equal to sum of:
+     *   10 byte header
+     *   8 byte foot
+     *   max input expansion
+     *   size of input
+     */
+    out_size = 10 + 8 + max_input_expansion + in_len;
     out_buf = flb_malloc(out_size);
+
     if (!out_buf) {
         flb_errno();
         flb_error("[gzip] could not allocate outgoing buffer");
         return -1;
     }

Vulnerable code:     out_size = in_len + 32;
Fixed code: 
    /*
     * GZIP relies on an algorithm with worst-case expansion
     * of 5 bytes per 32KB data. This means we need to create a variable
     * length output, that depends on the input length.
     * See RFC 1951 for details.
     */
    int max_input_expansion = ((int)(in_len / 32000) + 1) * 5;

    /*
     * Max compressed size is equal to sum of:
     *   10 byte header
     *   8 byte foot
     *   max input expansion
     *   size of input
     */
    out_size = 10 + 8 + max_input_expansion + in_len;
CVE-2021-36088: Double Free (CWE-415)
value: Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 9.8
Published: 2021-07-01T03:15Z
Repository: https://github.com/fluent/fluent-bit
Language: C
Files changed: src/flb_parser_json.c
Commit date: 2021-05-06 12:52:11 -0600
Commit message: parser: json: fix double-free (#3453)

Signed-off-by: davkor <david@adalogics.com>
Diff: diff --git a/src/flb_parser_json.c b/src/flb_parser_json.c
index 1afc39a6a..972197708 100644
--- a/src/flb_parser_json.c
+++ b/src/flb_parser_json.c
@@ -109,10 +109,11 @@ int flb_parser_json_do(struct flb_parser *parser,
     /* Set the possible outgoing buffer */
     *out_buf = tmp_out_buf;
     *out_size = tmp_out_size;
     if (mp_buf != tmp_out_buf) {
         flb_free(mp_buf);
+        mp_buf = NULL;
     }
 
     /* Do time resolution ? */
     if (!parser->time_fmt) {
         msgpack_unpacked_destroy(&result);
@@ -139,10 +140,11 @@ int flb_parser_json_do(struct flb_parser *parser,
         }
 
         /* Ensure the pointer we are about to read is not NULL */
         if (k->via.str.ptr == NULL) {
             flb_free(mp_buf);
+            flb_free(tmp_out_buf);
             *out_buf = NULL;
             msgpack_unpacked_destroy(&result);
             return -1;
         }
 

Fixed code:         mp_buf = NULL;
            flb_free(tmp_out_buf);
CVE-2022-2339: Server-Side Request Forgery (SSRF) (CWE-918)
value: With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.5
Published: 2022-07-07T04:15Z
Repository: https://github.com/nocodb/nocodb
Language: Unknown
Commit date: 2022-06-28 15:29:52 +0800
Commit message: Merge pull request #2495 from nocodb/develop

Pre-release 0.92.0
CVE-2022-3423: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.


CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 6.5
Published: 2022-10-07T11:15Z
Repository: https://github.com/nocodb/nocodb
Language: Unknown
Commit date: 2022-06-28 15:29:52 +0800
Commit message: Merge pull request #2495 from nocodb/develop

Pre-release 0.92.0
CVE-2023-49781: Insufficient Information (NVD-CWE-noinfo)
value: NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink(). This function recognizes the pattern URI::(XXX) and creates a hyperlink tag <a> with href=XXX. However, it leaves all the other contents outside of the pattern URI::(XXX) unchanged. This vulnerability is fixed in 0.202.9.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T14:06Z
Repository: https://github.com/nocodb/nocodb
Language: TypeScript
Files changed: packages/nc-gui/utils/urlUtils.ts
Commit date: 2023-11-22 07:17:58 +0000
Commit message: fix: sanitise formula text before rendering

Diff: diff --git a/packages/nc-gui/utils/urlUtils.ts b/packages/nc-gui/utils/urlUtils.ts
index 5fb19860d..3e792c7a5 100644
--- a/packages/nc-gui/utils/urlUtils.ts
+++ b/packages/nc-gui/utils/urlUtils.ts
@@ -4,12 +4,19 @@ export const replaceUrlsWithLink = (text: string): boolean | string => {
   if (!text) {
     return false
   }
 
   const rawText = text.toString()
+
+  // create a temporary element to sanitise the string
+  // by encoding any html code
+  const tempEl = document.createElement('div')
+  tempEl.textContent = rawText
+  const sanitisedText = tempEl.innerHTML
+
   let found = false
-  const out = rawText.replace(/URI::\((.*?)\)/g, (_, url) => {
+  const out = sanitisedText.replace(/URI::\((.*?)\)/g, (_, url) => {
     found = true
     const a = document.createElement('a')
     a.textContent = url
     a.setAttribute('href', url)
     a.setAttribute('target', '_blank')

Vulnerable code:   const out = rawText.replace(/URI::\((.*?)\)/g, (_, url) => {
Fixed code: 
  // create a temporary element to sanitise the string
  // by encoding any html code
  const tempEl = document.createElement('div')
  tempEl.textContent = rawText
  const sanitisedText = tempEl.innerHTML

  const out = sanitisedText.replace(/URI::\((.*?)\)/g, (_, url) => {
CVE-2022-2871: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository notrinos/notrinoserp prior to 0.7.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-08-17T09:15Z
Repository: https://github.com/notrinos/notrinoserp
Language: JavaScript
Files changed: SECURITY.md, libraries/select.js
Commit date: 2022-08-16 08:19:40 +0700
Commit message: Prevent cross-site scripting(XSS) vulnerabilities.

Diff: diff --git a/SECURITY.md b/SECURITY.md
index 450767d..5e31571 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,11 +1,10 @@
 # Security Policy
 
 ## Reporting a Vulnerability
 
-Please share privately the details of your security vulnerability by email to:
-[Contact Info](support@notrinos.com)  
+Please share privately the details of your security vulnerability by email to: support@notrinos.com  
 Or open an issue at [our forum](https://forums.notrinos.com/t/bugs-problems)
 
 Make sure to include as much information as possible, with the detailed steps to reproduce the problem,
 the versions that are affected, the expected results and actual results, and any other information that
 might help us react faster and more efficiently.
diff --git a/libraries/select.js b/libraries/select.js
index b8fb8c9..d165a70 100644
--- a/libraries/select.js
+++ b/libraries/select.js
@@ -13,13 +13,14 @@ var loadSelect2 = {
 	'select': function(e) {
 
 		if((e.hasAttribute('multiple') === false) && $(e).hasClass('nosearch') === false) {
 			$(e).select2({
 				dropdownAutoWidth : true,
-				// break a select option item into multi lines
 				templateResult: function(item) {
-					var selectionText = item.text.split('\n');
+					// replace(/</g, '&lt;') : prevent the code in the option’s value from being executed by the browser.
+					// split('\n') : break a select option item into multi lines
+					var selectionText = item.text.replace(/</g, '&lt;').split('\n');
 					var returnString = $('<span></span>');
 					$.each(selectionText, function(index, value){
 						line = value === undefined ? '' : value;
 						returnString.append(line + '</br>');
 					})

Vulnerable code: Please share privately the details of your security vulnerability by email to:
[Contact Info](support@notrinos.com)  
				// break a select option item into multi lines
					var selectionText = item.text.split('\n');
Fixed code: Please share privately the details of your security vulnerability by email to: support@notrinos.com  
					// replace(/</g, '&lt;') : prevent the code in the option’s value from being executed by the browser.
					// split('\n') : break a select option item into multi lines
					var selectionText = item.text.replace(/</g, '&lt;').split('\n');
CVE-2022-2927: Weak Password Requirements (CWE-521)
value: Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.
CWE description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CVSS v3 base score: 9.8
Published: 2022-08-22T09:15Z
Repository: https://github.com/notrinos/notrinoserp
Language: PHP
Files changed: admin/users.php
Commit date: 2022-08-22 14:46:05 +0700
Commit message: added password validation for adding new user.

Diff: diff --git a/admin/users.php b/admin/users.php
index 52ec55f..0dc548f 100644
--- a/admin/users.php
+++ b/admin/users.php
@@ -29,11 +29,11 @@ function can_process($new) {
 	if (strlen($_POST['user_id']) < 4) {
 		display_error( _('The user login entered must be at least 4 characters long.'));
 		set_focus('user_id');
 		return false;
 	}
-	if (!$new && ($_POST['password'] != '')) {
+	if ($new || (!$new && ($_POST['password'] != ''))) {
 		if (strlen($_POST['password']) < 4) {
 			display_error( _('The password entered must be at least 4 characters long.'));
 			set_focus('password');
 			return false;
 		}

Vulnerable code: 	if (!$new && ($_POST['password'] != '')) {
Fixed code: 	if ($new || (!$new && ($_POST['password'] != ''))) {
CVE-2022-33105: Missing Release of Memory after Effective Lifetime (CWE-401)
value: Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2022-06-23T17:15Z
Repository: https://github.com/redis/redis
Language: C
Files changed: src/t_stream.c
Commit date: 2022-05-22 12:15:26 +0300
Commit message: Fix memory leak in streamGetEdgeID (#10753)

si is initialized by streamIteratorStart(), we should call
streamIteratorStop() on it when done.

regression introduced in #9127 (redis 7.0)
Diff: diff --git a/src/t_stream.c b/src/t_stream.c
index e6e5da731..d3a3b9264 100644
--- a/src/t_stream.c
+++ b/src/t_stream.c
@@ -399,11 +399,11 @@ void streamGetEdgeID(stream *s, int first, int skip_tombstones, streamID *edge_i
     int found = streamIteratorGetID(&si,edge_id,&numfields);
     if (!found) {
         streamID min_id = {0, 0}, max_id = {UINT64_MAX, UINT64_MAX};
         *edge_id = first ? max_id : min_id;
     }
-
+    streamIteratorStop(&si);
 }
 
 /* Adds a new item into the stream 's' having the specified number of
  * field-value pairs as specified in 'numfields' and stored into 'argv'.
  * Returns the new entry ID populating the 'added_id' structure.

Fixed code:     streamIteratorStop(&si);
CVE-2023-28856: Reachable Assertion (CWE-617)
value: Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 6.5
Published: 2023-04-18T21:15Z
Repository: https://github.com/redis/redis
Language: Other
Files changed: src/t_hash.c, tests/unit/type/hash.tcl
Commit date: 2022-08-28 11:33:41 +0300
Commit message: fix hincrbyfloat not to create a key if the new value is invalid (#11149)

Check the validity of the value before performing the create operation,
prevents new data from being generated even if the request fails to execute.

Co-authored-by: Oran Agra <oran@redislabs.com>
Co-authored-by: chendianqiang <chendianqiang@meituan.com>
Co-authored-by: Binbin <binloveplay1314@qq.com>
Diff: diff --git a/src/t_hash.c b/src/t_hash.c
index 63447a4c1f..a2af438aee 100644
--- a/src/t_hash.c
+++ b/src/t_hash.c
@@ -664,10 +664,14 @@ void hincrbyfloatCommand(client *c) {
     sds new;
     unsigned char *vstr;
     unsigned int vlen;
 
     if (getLongDoubleFromObjectOrReply(c,c->argv[3],&incr,NULL) != C_OK) return;
+    if (isnan(incr) || isinf(incr)) {
+        addReplyError(c,"value is NaN or Infinity");
+        return;
+    }
     if ((o = hashTypeLookupWriteOrCreate(c,c->argv[1])) == NULL) return;
     if (hashTypeGetValue(o,c->argv[2]->ptr,&vstr,&vlen,&ll) == C_OK) {
         if (vstr) {
             if (string2ld((char*)vstr,vlen,&value) == 0) {
                 addReplyError(c,"hash value is not a float");
diff --git a/tests/unit/type/hash.tcl b/tests/unit/type/hash.tcl
index ae5677383d..613134af34 100644
--- a/tests/unit/type/hash.tcl
+++ b/tests/unit/type/hash.tcl
@@ -817,6 +817,10 @@ start_server {tags {"hash"}} {
         assert_equal [dict get $k ZIP_STR_32B] [string repeat x 65535]
         set k [dict remove $k ZIP_STR_32B]
         set _ $k
     } {ZIP_INT_8B 127 ZIP_INT_16B 32767 ZIP_INT_32B 2147483647 ZIP_INT_64B 9223372036854775808 ZIP_INT_IMM_MIN 0 ZIP_INT_IMM_MAX 12}
 
+    test {HINCRBYFLOAT does not allow NaN or Infinity} {
+        assert_error "*value is NaN or Infinity*" {r hincrbyfloat hfoo field +inf}
+        assert_equal 0 [r exists hfoo]
+    }
 }

Fixed code:     if (isnan(incr) || isinf(incr)) {
        addReplyError(c,"value is NaN or Infinity");
        return;
    }
    test {HINCRBYFLOAT does not allow NaN or Infinity} {
        assert_error "*value is NaN or Infinity*" {r hincrbyfloat hfoo field +inf}
        assert_equal 0 [r exists hfoo]
    }
CVE-2011-1575: Resource Management Errors (CWE-399)
value: The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2011-05-23T22:55Z
Repository: https://github.com/jedisct1/pure-ftpd
Language: C
Files changed: src/ftp_parser.c
Commit date: 2011-03-07 23:50:46 +0100
Commit message: Flush the command buffer after switching to TLS.
Fixes a flaw similar to CVE-2011-0411.

Diff: diff --git a/src/ftp_parser.c b/src/ftp_parser.c
index 37553a6..69a42a3 100644
--- a/src/ftp_parser.c
+++ b/src/ftp_parser.c
@@ -55,18 +55,24 @@ static void randomdelay(void)
  * Some broken clients are just sending \n ... Grrrrrrrrrrrr !!!!!!!!!!!!!!!
  * 
  * -Frank.
  */
 
+static size_t scanned;
+static size_t readnbd;
+
+static void flush_cmd(void)
+{
+    scanned = readnbd = (size_t) 0U;
+}
+
 int sfgets(void)
 {
     struct pollfd pfd;
     int pollret;
     ssize_t readnb;
     signed char seen_r = 0;
-    static size_t scanned;
-    static size_t readnbd;
     
     if (scanned > (size_t) 0U) {       /* support pipelining */
         readnbd -= scanned;        
         memmove(cmd, cmd + scanned, readnbd);   /* safe */
         scanned = (size_t) 0U;
@@ -360,10 +366,11 @@ void parser(void)
         } else if (enforce_tls_auth > 0 &&
                    !strcmp(cmd, "auth") && !strcasecmp(arg, "tls")) {
             addreply_noformat(234, "AUTH TLS OK.");
             doreply();
             if (tls_cnx == NULL) {
+                flush_cmd();
                 (void) tls_init_new_session();
             }
             goto wayout;
         } else if (!strcmp(cmd, "pbsz")) {
             addreply_noformat(tls_cnx == NULL ? 503 : 200, "PBSZ=0");

Vulnerable code:     static size_t scanned;
    static size_t readnbd;
Fixed code: static size_t scanned;
static size_t readnbd;

static void flush_cmd(void)
{
    scanned = readnbd = (size_t) 0U;
}

                flush_cmd();
CVE-2020-9274: Access of Uninitialized Pointer (CWE-824)
value: An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.
CWE description: The product accesses or uses a pointer that has not been initialized.
CVSS v3 base score: 7.5
Published: 2020-02-26T16:15Z
Repository: https://github.com/jedisct1/pure-ftpd
Language: C
Files changed: src/diraliases.c
Commit date: 2020-02-18 18:36:58 +0100
Commit message: diraliases: always set the tail of the list to NULL

Spotted and reported by Antonio Norales from GitHub Security Labs.
Thanks!

Diff: diff --git a/src/diraliases.c b/src/diraliases.c
index 4002a36..fb70273 100644
--- a/src/diraliases.c
+++ b/src/diraliases.c
@@ -91,11 +91,10 @@ int init_aliases(void)
             if ((head = tail = malloc(sizeof *head)) == NULL ||
                 (tail->alias = strdup(alias)) == NULL ||
                 (tail->dir = strdup(dir)) == NULL) {
                 die_mem();
             }
-            tail->next = NULL;
         } else {
             DirAlias *curr;
 
             if ((curr = malloc(sizeof *curr)) == NULL ||
                 (curr->alias = strdup(alias)) == NULL ||
@@ -103,10 +102,11 @@ int init_aliases(void)
                 die_mem();
             }
             tail->next = curr;
             tail = curr;
         }
+        tail->next = NULL;
     }
     fclose(fp);
     aliases_up++;
 
     return 0;

Vulnerable code:             tail->next = NULL;
Fixed code:         tail->next = NULL;
CVE-2020-9365: Out-of-bounds Read (CWE-125)
value: An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2020-02-24T16:15Z
Repository: https://github.com/jedisct1/pure-ftpd
Language: C
Files changed: src/utils.c
Commit date: 2020-02-24 15:28:41 +0100
Commit message: pure_strcmp(): len(s2) can be > len(s1)

Reported by Antonio Morales from GitHub Security Labs, thanks!

Diff: diff --git a/src/utils.c b/src/utils.c
index f41492d5..5e881044 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -43,7 +43,11 @@ int pure_memcmp(const void * const b1_, const void * const b2_, size_t len)
 
 #endif
 
 int pure_strcmp(const char * const s1, const char * const s2)
 {
-    return pure_memcmp(s1, s2, strlen(s1) + 1U);
+    const size_t s1_len = strlen(s1);
+    const size_t s2_len = strlen(s2);
+    const size_t len = (s1_len < s2_len) ? s1_len : s2_len;
+
+    return pure_memcmp(s1, s2, len + 1);
 }

Vulnerable code:     return pure_memcmp(s1, s2, strlen(s1) + 1U);
Fixed code:     const size_t s1_len = strlen(s1);
    const size_t s2_len = strlen(s2);
    const size_t len = (s1_len < s2_len) ? s1_len : s2_len;

    return pure_memcmp(s1, s2, len + 1);
CVE-2021-40524: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.5
Published: 2021-09-05T19:15Z
Repository: https://github.com/jedisct1/pure-ftpd
Language: C
Files changed: src/ftpd.c
Commit date: 2021-11-23 18:53:59 +0100
Commit message: Initialize the max upload file size when quotas are enabled

Due to an unwanted check, files causing the quota to be exceeded
were deleted after the upload, but not during the upload.

The bug was introduced in 2009 in version 1.0.23

Spotted by @DroidTest, thanks!

Diff: diff --git a/src/ftpd.c b/src/ftpd.c
index d856839a..be2fd78e 100644
--- a/src/ftpd.c
+++ b/src/ftpd.c
@@ -4245,12 +4245,11 @@ void dostor(char *name, const int append, const int autorename)
     }
 #ifdef QUOTAS
     if (quota_update(&quota, 0LL, 0LL, &overflow) == 0 &&
         (overflow > 0 || quota.files >= user_quota_files ||
          quota.size > user_quota_size ||
-         (max_filesize >= (off_t) 0 &&
-          (max_filesize = user_quota_size - quota.size) < (off_t) 0))) {
+         (max_filesize = user_quota_size - quota.size) < (off_t) 0)) {
         overflow = 1;
         (void) close(f);
         goto afterquota;
     }
 #endif

Vulnerable code:          (max_filesize >= (off_t) 0 &&
          (max_filesize = user_quota_size - quota.size) < (off_t) 0))) {
Fixed code:          (max_filesize = user_quota_size - quota.size) < (off_t) 0)) {