Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-3188: Server-Side Request Forgery (SSRF) (CWE-918)
value: Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 6.5
Published: 2023-06-10T02:15Z
Repository: https://github.com/owncast/owncast
Language: Go
Files changed: activitypub/webfinger/webfinger.go, auth/indieauth/client.go
Commit date: 2023-04-24 17:46:58 -0700
Commit message: fix: disable redirects to guard against possible SSRFs

Diff: diff --git a/activitypub/webfinger/webfinger.go b/activitypub/webfinger/webfinger.go
index 4447b9e4a..5cea75c87 100644
--- a/activitypub/webfinger/webfinger.go
+++ b/activitypub/webfinger/webfinger.go
@@ -27,11 +27,18 @@ func GetWebfingerLinks(account string) ([]map[string]interface{}, error) {
 	requestURL.Path = "/.well-known/webfinger"
 	query := requestURL.Query()
 	query.Add("resource", fmt.Sprintf("acct:%s", account))
 	requestURL.RawQuery = query.Encode()
 
-	response, err := http.DefaultClient.Get(requestURL.String())
+	// Do not support redirects.
+	client := &http.Client{
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+
+	response, err := client.Get(requestURL.String())
 	if err != nil {
 		return nil, err
 	}
 
 	defer response.Body.Close()
diff --git a/auth/indieauth/client.go b/auth/indieauth/client.go
index 8f0dd1b34..e3d67e748 100644
--- a/auth/indieauth/client.go
+++ b/auth/indieauth/client.go
@@ -78,11 +78,17 @@ func HandleCallbackCode(code, state string) (*Request, *Response, error) {
 	data.Set("code", code)
 	data.Set("client_id", request.ClientID)
 	data.Set("redirect_uri", request.Callback.String())
 	data.Set("code_verifier", request.CodeVerifier)
 
-	client := &http.Client{}
+	// Do not support redirects.
+	client := &http.Client{
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+
 	r, err := http.NewRequest("POST", request.Endpoint.String(), strings.NewReader(data.Encode())) // URL-encoded payload
 	if err != nil {
 		return nil, nil, err
 	}
 	r.Header.Add("Content-Type", "application/x-www-form-urlencoded")

Vulnerable code: 	response, err := http.DefaultClient.Get(requestURL.String())
	client := &http.Client{}
Fixed code: 	// Do not support redirects.
	client := &http.Client{
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
	}

	response, err := client.Get(requestURL.String())
	// Do not support redirects.
	client := &http.Client{
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
	}
CVE-2024-29026: Insufficient Information (NVD-CWE-noinfo)
value: Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-20T22:15Z
Repository: https://github.com/owncast/owncast
Language: Go
Files changed: router/middleware/auth.go
Commit date: 2023-12-18 22:05:49 -0800
Commit message: fix(auth): limit admin cors access to only localhost:3000

Diff: diff --git a/router/middleware/auth.go b/router/middleware/auth.go
index 574610cdfe..15f1f47764 100644
--- a/router/middleware/auth.go
+++ b/router/middleware/auth.go
@@ -23,15 +23,13 @@ func RequireAdminAuth(handler http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		username := "admin"
 		password := data.GetAdminPassword()
 		realm := "Owncast Authenticated Request"
 
-		// The following line is kind of a work around.
-		// If you want HTTP Basic Auth + Cors it requires _explicit_ origins to be provided in the
-		// Access-Control-Allow-Origin header.  So we just pull out the origin header and specify it.
-		// If we want to lock down admin APIs to not be CORS accessible for anywhere, this is where we would do that.
-		w.Header().Set("Access-Control-Allow-Origin", r.Header.Get("Origin"))
+		// Alow CORS only for localhost:3000 to support Owncast development.
+		validAdminHost := "http://localhost:3000"
+		w.Header().Set("Access-Control-Allow-Origin", validAdminHost)
 		w.Header().Set("Access-Control-Allow-Credentials", "true")
 		w.Header().Set("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization")
 
 		// For request needing CORS, send a 204.
 		if r.Method == "OPTIONS" {

Vulnerable code: 		// The following line is kind of a work around.
		// If you want HTTP Basic Auth + Cors it requires _explicit_ origins to be provided in the
		// Access-Control-Allow-Origin header.  So we just pull out the origin header and specify it.
		// If we want to lock down admin APIs to not be CORS accessible for anywhere, this is where we would do that.
		w.Header().Set("Access-Control-Allow-Origin", r.Header.Get("Origin"))
Fixed code: 		// Alow CORS only for localhost:3000 to support Owncast development.
		validAdminHost := "http://localhost:3000"
		w.Header().Set("Access-Control-Allow-Origin", validAdminHost)
CVE-2024-31450: Insufficient Information (NVD-CWE-noinfo)
value: Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-19T19:15Z
Repository: https://github.com/owncast/owncast
Language: Go
Files changed: controllers/admin/emoji.go
Commit date: 2024-01-20 20:30:29 -0800
Commit message: fix(api): protect emoji delete api from path traversal exploit

Diff: diff --git a/controllers/admin/emoji.go b/controllers/admin/emoji.go
index 43028e6b7c..810b629d13 100644
--- a/controllers/admin/emoji.go
+++ b/controllers/admin/emoji.go
@@ -74,13 +74,17 @@ func DeleteCustomEmoji(w http.ResponseWriter, r *http.Request) {
 	if err := json.NewDecoder(r.Body).Decode(emoji); err != nil {
 		controllers.WriteSimpleResponse(w, false, err.Error())
 		return
 	}
 
-	// var emojiFileName = filepath.Base(emoji.Name)
 	targetPath := filepath.Join(config.CustomEmojiPath, emoji.Name)
 
+	if !filepath.IsLocal(targetPath) {
+		controllers.WriteSimpleResponse(w, false, "Emoji path is not valid")
+		return
+	}
+
 	if err := os.Remove(targetPath); err != nil {
 		if os.IsNotExist(err) {
 			controllers.WriteSimpleResponse(w, false, fmt.Sprintf("Emoji %q doesn't exist", emoji.Name))
 		} else {
 			controllers.WriteSimpleResponse(w, false, err.Error())

Vulnerable code: 	// var emojiFileName = filepath.Base(emoji.Name)
Fixed code: 	if !filepath.IsLocal(targetPath) {
		controllers.WriteSimpleResponse(w, false, "Emoji path is not valid")
		return
	}
CVE-2018-11590: Integer Overflow or Wraparound (CWE-190)
value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via an integer overflow during syntax parsing. This was addressed by fixing stack size detection on Linux in jsutils.c.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2018-05-31T16:29Z
Repository: https://github.com/espruino/Espruino
Language: Other
Files changed: ChangeLog, src/jsutils.c
Commit date: 2018-05-21 09:54:07 +0100
Commit message: Fix stack size detection on Linux (fix #1427)

Diff: diff --git a/ChangeLog b/ChangeLog
index 0887a9bd..a857a162 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,9 @@
             Increase jslMatch error buffer size to handle "UNFINISHED TEMPLATE LITERAL" string (#1426)
             nRF5x: Make FlashWrite cope with flash writes > 4k
             Increase max size of native strings on platforms that support it - 16 bit to 32 bit (#1432)
+            Fix stack size detection on Linux (fix #1427)
 
      1v98 : Allow Crypto SHA1 without SHA256/512 (for ESP8266 where flash is scarce)
             Add better docs for the form of Wifi callback functions
             Modify ESP8266/ESP32 callbacks to match the node.js style used elsewhere
             nRF52: fix pin.toggle() on software-negated pins
diff --git a/src/jsutils.c b/src/jsutils.c
index 7b706f5f..be879cc1 100644
--- a/src/jsutils.c
+++ b/src/jsutils.c
@@ -842,11 +842,13 @@ size_t jsuGetFreeStack() {
 #elif defined(LINUX)
   // On linux, we set STACK_BASE from `main`.
   char ptr; // this is on the stack
   extern void *STACK_BASE;
   uint32_t count =  (uint32_t)((size_t)STACK_BASE - (size_t)&ptr);
-  return 1000000 - count; // give it 1 megabyte of stack
+  const uint32_t max_stack = 1000000; // give it 1 megabyte of stack
+  if (count>max_stack) return 0;
+  return max_stack - count;
 #else
   // stack depth seems pretty platform-specific :( Default to a value that disables it
   return 1000000; // no stack depth check on this platform
 #endif
 }

Vulnerable code:   return 1000000 - count; // give it 1 megabyte of stack
Fixed code:             Fix stack size detection on Linux (fix #1427)
  const uint32_t max_stack = 1000000; // give it 1 megabyte of stack
  if (count>max_stack) return 0;
  return max_stack - count;
CVE-2018-11591: NULL Pointer Dereference (CWE-476)
value: Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer dereference during syntax parsing. This was addressed by adding validation for a debug trace print statement in jsvar.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2018-05-31T16:29Z
Repository: https://github.com/espruino/Espruino
Language: Other
Files changed: ChangeLog, src/jsvar.c
Commit date: 2018-05-18 10:05:57 +0100
Commit message: Add sanity check for debug trace print statement (fix #1420)

Diff: diff --git a/ChangeLog b/ChangeLog
index fcadd4b6..793ab99a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,10 +20,11 @@
             Added Graphics.setFontAlign for font alignment and rotation
             Make software I2C bitrate and waveform more accurate
             Move default I2C bitrate to 100kbit/sec
             Linux: don't create a espruino.flash file if we're not writing to flash
             Add height check for Graphics.createArrayBuffer(...vertical_byte:true) (fix #1421)
+            Add sanity check for debug trace print statement (fix #1420)
 
      1v97 : nRF52: fix NRF.on('connect',...) issue
             STM32: Fix setDeviceClockCmd error for USB.setConsole()
             nRF5x: Fix getPinMode, which fixes SW I2C after save()
             Thingy52: Don't report contents of 'Thingy' in 'dump()'
diff --git a/src/jsvar.c b/src/jsvar.c
index fd6e18ff..8edb27b6 100644
--- a/src/jsvar.c
+++ b/src/jsvar.c
@@ -3312,11 +3312,11 @@ void _jsvTrace(JsVar *var, int indent, JsVar *baseVar, int level) {
   else if (jsvIsInt(var)) jsiConsolePrintf("Integer %d", jsvGetInteger(var));
   else if (jsvIsBoolean(var)) jsiConsolePrintf("Bool %s", jsvGetBool(var)?"true":"false");
   else if (jsvIsFloat(var)) jsiConsolePrintf("Double %f", jsvGetFloat(var));
   else if (jsvIsFunctionParameter(var)) jsiConsolePrintf("Param %q ", var);
   else if (jsvIsArrayBufferName(var)) jsiConsolePrintf("ArrayBufferName[%d] ", jsvGetInteger(var));
-  else if (jsvIsArrayBuffer(var)) jsiConsolePrintf("%s ", jswGetBasicObjectName(var)); // way to get nice name
+  else if (jsvIsArrayBuffer(var)) jsiConsolePrintf("%s ", jswGetBasicObjectName(var)?jswGetBasicObjectName(var):"unknown ArrayBuffer"); // way to get nice name
   else if (jsvIsString(var)) {
     size_t blocks = 1;
     if (jsvGetLastChild(var)) {
       JsVar *v = jsvLock(jsvGetLastChild(var));
       blocks += jsvCountJsVarsUsed(v);

Vulnerable code:   else if (jsvIsArrayBuffer(var)) jsiConsolePrintf("%s ", jswGetBasicObjectName(var)); // way to get nice name
Fixed code:             Add sanity check for debug trace print statement (fix #1420)
  else if (jsvIsArrayBuffer(var)) jsiConsolePrintf("%s ", jswGetBasicObjectName(var)?jswGetBasicObjectName(var):"unknown ArrayBuffer"); // way to get nice name
CVE-2018-11594: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing of "VOID" tokens in jsparse.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2018-05-31T16:29Z
Repository: https://github.com/espruino/Espruino
Language: Other
Files changed: ChangeLog, src/jsparse.c
Commit date: 2018-05-21 14:30:19 +0100
Commit message: Fix stack overflow if void void void... is repeated many times (fix #1434)

Diff: diff --git a/ChangeLog b/ChangeLog
index 7b70824bb..31e8560a5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,10 +2,11 @@
             nRF5x: Make FlashWrite cope with flash writes > 4k
             Increase max size of native strings on platforms that support it - 16 bit to 32 bit (#1432)
             Fix stack size detection on Linux (fix #1427)
             Fix strncat/cpy bounding issues (fix #1425)
             Promises now ignore a second resolve/reject (fix #1433)
+            Fix stack overflow if void void void... is repeated many times (fix #1434)
 
      1v98 : Allow Crypto SHA1 without SHA256/512 (for ESP8266 where flash is scarce)
             Add better docs for the form of Wifi callback functions
             Modify ESP8266/ESP32 callbacks to match the node.js style used elsewhere
             nRF52: fix pin.toggle() on software-negated pins
diff --git a/src/jsparse.c b/src/jsparse.c
index 63c921b02..1a39d4ca7 100644
--- a/src/jsparse.c
+++ b/src/jsparse.c
@@ -1714,10 +1714,11 @@ NO_INLINE JsVar *jspeFactor() {
     return jspeFactorDelete();
   } else if (lex->tk==LEX_R_TYPEOF) {
     if (!jspCheckStackPosition()) return 0;
     return jspeFactorTypeOf();
   } else if (lex->tk==LEX_R_VOID) {
+    if (!jspCheckStackPosition()) return 0;
     JSP_ASSERT_MATCH(LEX_R_VOID);
     jsvUnLock(jspeUnaryExpression());
     return 0;
   }
   JSP_MATCH(LEX_EOF);

Fixed code:             Fix stack overflow if void void void... is repeated many times (fix #1434)
    if (!jspCheckStackPosition()) return 0;
CVE-2018-11596: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because a check for '\0' is made for the wrong array element in jsvar.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2018-05-31T16:29Z
Repository: https://github.com/espruino/Espruino
Language: C
Files changed: src/jsvar.c
Commit date: 2018-05-21 15:29:33 +0100
Commit message: fix jsvGetString regression

Diff: diff --git a/src/jsvar.c b/src/jsvar.c
index 7cd34f357..88d49b3ad 100644
--- a/src/jsvar.c
+++ b/src/jsvar.c
@@ -1188,11 +1188,11 @@ size_t jsvGetString(const JsVar *v, char *str, size_t len) {
   if (s) {
     /* don't use strncpy here because we don't
      * want to pad the entire buffer with zeros */
     len--;
     int l = 0;
-    while (*s && l<len) {
+    while (s[l] && l<len) {
       str[l] = s[l];
       l++;
     }
     str[l] = 0;
     return l;

Vulnerable code:     while (*s && l<len) {
Fixed code:     while (s[l] && l<len) {
CVE-2018-11597: Uncontrolled Recursion (CWE-674)
value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because of a missing check for stack exhaustion with many '{' characters in jsparse.c.
CWE description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
CVSS v3 base score: 5.5
Published: 2018-05-31T16:29Z
Repository: https://github.com/espruino/Espruino
Language: Other
Files changed: ChangeLog, src/jsparse.c
Commit date: 2018-05-28 09:06:06 +0100
Commit message: Fix stack overflow if interpreting a file full of '{' (fix #1448)

Diff: diff --git a/ChangeLog b/ChangeLog
index 285fbf4a3..36672f93a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,10 +6,11 @@
             Fix bug if using an undefined member of an object for for..in (fix #1437)
             Allow for..in to iterate over prototype chains down from Array and Object
             Add for(var i of array) to iterate over elements
             Added getter and setter support
             Stop parsing blocks if not executing (fix #572)
+            Fix stack overflow if interpreting a file full of '{' (fix #1448)
 
      1v99 : Increase jslMatch error buffer size to handle "UNFINISHED TEMPLATE LITERAL" string (#1426)
             nRF5x: Make FlashWrite cope with flash writes > 4k
             Increase max size of native strings on platforms that support it - 16 bit to 32 bit (#1432)
             Fix stack size detection on Linux (fix #1427)
diff --git a/src/jsparse.c b/src/jsparse.c
index ce66a6fbf..09fa77c05 100644
--- a/src/jsparse.c
+++ b/src/jsparse.c
@@ -2718,10 +2718,11 @@ NO_INLINE JsVar *jspeStatement() {
       lex->tk=='(') {
     /* Execute a simple statement that only contains basic arithmetic... */
     return jspeExpression();
   } else if (lex->tk=='{') {
     /* A block of code */
+    if (!jspCheckStackPosition()) return 0;
     jspeBlock();
     return 0;
   } else if (lex->tk==';') {
     /* Empty statement - to allow things like ;;; */
     JSP_ASSERT_MATCH(';');

Fixed code:             Fix stack overflow if interpreting a file full of '{' (fix #1448)
    if (!jspCheckStackPosition()) return 0;
CVE-2023-52264: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-12-30T23:15Z
Repository: https://github.com/thirtybees/beesblog
Language: PHP
Files changed: controllers/front/post.php
Commit date: 2023-10-06 08:22:40 +0200
Commit message: Fix XSS vulnerability

Special thanks to Ulaş Deniz İlhan from Zigrin Security for discovering
and reporting this vulnerability.

Diff: diff --git a/controllers/front/post.php b/controllers/front/post.php
index 43bdf6c..6606d82 100644
--- a/controllers/front/post.php
+++ b/controllers/front/post.php
@@ -71,11 +71,11 @@ class BeesBlogPostModuleFrontController extends ModuleFrontController
             $this->context->controller->addCSS(_PS_MODULE_DIR_.'beesblog/views/css/socialmedia.css', 'all');
             $this->context->controller->addJS(_PS_MODULE_DIR_.'beesblog/views/js/socialmedia.js');
         }
         Media::addJsDef([
             'sharing_name' => addcslashes($post->title, "'"),
-            'sharing_url' => addcslashes(Tools::getHttpHost(true).$_SERVER['REQUEST_URI'], "'"),
+            'sharing_url' => addcslashes($post->link, "'"),
             'sharing_img' => addcslashes(Tools::getHttpHost(true).'/img/beesblog/posts/'.(int) $post->id.'.jpg', "'"),
         ]);
 
         $postProperties = [
             'meta_title'           => $post->meta_title.' - '.Configuration::get('PS_SHOP_NAME'),

Vulnerable code:             'sharing_url' => addcslashes(Tools::getHttpHost(true).$_SERVER['REQUEST_URI'], "'"),
Fixed code:             'sharing_url' => addcslashes($post->link, "'"),
CVE-2021-3757: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-09-02T12:15Z
Repository: https://github.com/immerjs/immer
Language: JavaScript
Files changed: __tests__/patch.js, src/plugins/patches.ts
Commit date: 2021-08-31 19:59:35 +0100
Commit message: fix(security): Follow up on CVE-2020-28477 where `path: [["__proto__"], "x"]` could still pollute the prototype

Diff: diff --git a/__tests__/patch.js b/__tests__/patch.js
index 1885094..8bacae1 100644
--- a/__tests__/patch.js
+++ b/__tests__/patch.js
@@ -1256,10 +1256,28 @@ test("maps can store __proto__, prototype and constructor props", () => {
 	expect(newMap.get("constructor").polluted).toBe("yes")
 	expect(newMap.get("prototype").polluted).toBe("yes")
 	expect(obj.polluted).toBe(undefined)
 })
 
+test("CVE-2020-28477 (https://snyk.io/vuln/SNYK-JS-IMMER-1019369) follow up", () => {
+	const obj = {}
+
+	// @ts-ignore
+	expect(obj.polluted).toBe(undefined)
+	expect(() => {
+		applyPatches({}, [
+			{op: "add", path: [["__proto__"], "polluted"], value: "yes"}
+		])
+	}).toThrow(
+		isProd
+			? "24"
+			: "Patching reserved attributes like __proto__, prototype and constructor is not allowed"
+	)
+	// @ts-ignore
+	expect(obj.polluted).toBe(undefined)
+})
+
 test("#648 assigning object to itself should not change patches", () => {
 	const input = {
 		obj: {
 			value: 200
 		}
diff --git a/src/plugins/patches.ts b/src/plugins/patches.ts
index e0cdc09..c4a7b4a 100644
--- a/src/plugins/patches.ts
+++ b/src/plugins/patches.ts
@@ -205,11 +205,11 @@ export function enablePatches() {
 			const {path, op} = patch
 
 			let base: any = draft
 			for (let i = 0; i < path.length - 1; i++) {
 				const parentType = getArchtype(base)
-				const p = path[i]
+				const p = "" + path[i]
 				// See #738, avoid prototype pollution
 				if (
 					(parentType === Archtype.Object || parentType === Archtype.Array) &&
 					(p === "__proto__" || p === "constructor")
 				)

Vulnerable code: 				const p = path[i]
Fixed code: test("CVE-2020-28477 (https://snyk.io/vuln/SNYK-JS-IMMER-1019369) follow up", () => {
	const obj = {}

	// @ts-ignore
	expect(obj.polluted).toBe(undefined)
	expect(() => {
		applyPatches({}, [
			{op: "add", path: [["__proto__"], "polluted"], value: "yes"}
		])
	}).toThrow(
		isProd
			? "24"
			: "Patching reserved attributes like __proto__, prototype and constructor is not allowed"
	)
	// @ts-ignore
	expect(obj.polluted).toBe(undefined)
})

				const p = "" + path[i]
CVE-2021-23392: Insufficient Information (NVD-CWE-noinfo)
value: The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2021-06-08T08:15Z
Repository: https://github.com/locutusjs/locutus
Language: JavaScript
Files changed: src/php/net-gopher/gopher_parsedir.js
Commit date: 2021-05-27 08:46:30 +0200
Commit message: Prevent ReDos issue with regex inside gopher_parsedir (#446)


Diff: diff --git a/src/php/net-gopher/gopher_parsedir.js b/src/php/net-gopher/gopher_parsedir.js
index ac9a32c3..48cf9a54 100644
--- a/src/php/net-gopher/gopher_parsedir.js
+++ b/src/php/net-gopher/gopher_parsedir.js
@@ -20,11 +20,11 @@ module.exports = function gopher_parsedir (dirent) { // eslint-disable-line came
    * h = HTML file
    * i = informational message
    * s = Audio file format, primarily a WAV file
    */
 
-  const entryPattern = /^(.)(.*?)\t(.*?)\t(.*?)\t(.*?)\u000d\u000a$/
+  const entryPattern = /^(.)([^\t]*)\t([^\t]*)\t([^\t]*)\t([^\t]*)\r\n$/
   const entry = dirent.match(entryPattern)
 
   if (entry === null) {
     throw new Error('Could not parse the directory entry')
     // return false;

Vulnerable code:   const entryPattern = /^(.)(.*?)\t(.*?)\t(.*?)\t(.*?)\u000d\u000a$/
Fixed code:   const entryPattern = /^(.)([^\t]*)\t([^\t]*)\t([^\t]*)\t([^\t]*)\r\n$/
CVE-2021-33295: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-06-16T21:15Z
Repository: https://github.com/laurent22/joplin
Language: TypeScript
Files changed: packages/renderer/htmlUtils.ts
Commit date: 2021-05-10 11:22:12 +0200
Commit message: All: Security: Filter out NOSCRIPT tags that could be used to cause an XSS (thanks to Jubair Rehman for the PoC)

Diff: diff --git a/packages/renderer/htmlUtils.ts b/packages/renderer/htmlUtils.ts
index 34c751a35..1262ae6fd 100644
--- a/packages/renderer/htmlUtils.ts
+++ b/packages/renderer/htmlUtils.ts
@@ -131,11 +131,11 @@ class HtmlUtils {
 		parser.end();
 
 		return output.join('').replace(/\s+/g, ' ');
 	}
 
-	sanitizeHtml(html: string, options: any = null) {
+	public sanitizeHtml(html: string, options: any = null) {
 		options = Object.assign({}, {
 			// If true, adds a "jop-noMdConv" class to all the tags.
 			// It can be used afterwards to restore HTML tags in Markdown.
 			addNoMdConvClass: false,
 		}, options);
@@ -156,11 +156,11 @@ class HtmlUtils {
 		// https://github.com/laurent22/joplin/issues/3021
 		//
 		// "link" can be used to escape the parser and inject JavaScript.
 		// Adding "meta" too for the same reason as it shouldn't be used in
 		// notes anyway.
-		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta'];
+		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];
 
 		const parser = new htmlparser2.Parser({
 
 			onopentag: (name: string, attrs: any) => {
 				tagStack.push(name.toLowerCase());

Vulnerable code: 	sanitizeHtml(html: string, options: any = null) {
		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta'];
Fixed code: 	public sanitizeHtml(html: string, options: any = null) {
		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];
CVE-2021-37916: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Joplin before 2.0.9 allows XSS via button and form in the note body.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-08-03T00:15Z
Repository: https://github.com/laurent22/joplin
Language: TypeScript
Files changed: packages/renderer/htmlUtils.ts
Commit date: 2021-06-11 20:17:45 +0200
Commit message: Desktop, Mobile: Filter out form elements from note body to prevent potential XSS (thanks to Dmytro Vdovychinskiy for the PoC)

Diff: diff --git a/packages/renderer/htmlUtils.ts b/packages/renderer/htmlUtils.ts
index 1262ae6fd..9a27fb31d 100644
--- a/packages/renderer/htmlUtils.ts
+++ b/packages/renderer/htmlUtils.ts
@@ -156,11 +156,11 @@ class HtmlUtils {
 		// https://github.com/laurent22/joplin/issues/3021
 		//
 		// "link" can be used to escape the parser and inject JavaScript.
 		// Adding "meta" too for the same reason as it shouldn't be used in
 		// notes anyway.
-		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];
+		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript', 'button', 'form', 'input', 'select', 'textarea', 'option', 'optgroup'];
 
 		const parser = new htmlparser2.Parser({
 
 			onopentag: (name: string, attrs: any) => {
 				tagStack.push(name.toLowerCase());

Vulnerable code: 		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];
Fixed code: 		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript', 'button', 'form', 'input', 'select', 'textarea', 'option', 'optgroup'];
CVE-2021-4304: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: A vulnerability was found in eprintsug ulcc-core. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file cgi/toolbox/toolbox. The manipulation of the argument password leads to command injection. The attack can be launched remotely. The patch is named 811edaae81eb044891594f00062a828f51b22cb1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217447.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-01-05T10:15Z
Repository: https://github.com/eprintsug/ulcc-core
Language: Other
Files changed: cgi/toolbox/toolbox
Commit date: 2021-02-05 14:14:51 +0000
Commit message: Fixes RCE exploit by validating verb parameter for toolbox before eval (backported from 3.4)

Diff: diff --git a/cgi/toolbox/toolbox b/cgi/toolbox/toolbox
index 49410f3..9c1c6b7 100755
--- a/cgi/toolbox/toolbox
+++ b/cgi/toolbox/toolbox
@@ -23,10 +23,15 @@ my $cmd = $session->param( "verb" );
 my $username = $session->param( "username" );
 my $password = $session->param( "password" );
 
 my %opts = ();
 
+if ( $cmd !~ m/^[a-zA-Z0-9_]+$/ )
+{
+	toolbox_fail( $session, "Invalid toolbox function" );
+}
+
 if( !$session->valid_login( $username, $password ) )
 {
 	toolbox_fail( $session, "Invalid username/password" );
 }
 

Fixed code: if ( $cmd !~ m/^[a-zA-Z0-9_]+$/ )
{
	toolbox_fail( $session, "Invalid toolbox function" );
}
CVE-2024-29864: Insufficient Information (NVD-CWE-noinfo)
value: Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T04:15Z
Repository: https://github.com/89luca89/distrobox
Language: Other
Files changed: distrobox-enter
Commit date: 2024-03-11 15:52:41 +0100
Commit message: enter: do not use a shell when executing a custom command, Fix #1275

Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>

Diff: diff --git a/distrobox-enter b/distrobox-enter
index dda867e..84dbb77 100755
--- a/distrobox-enter
+++ b/distrobox-enter
@@ -56,12 +56,10 @@ fi
 
 # Defaults
 container_command=""
 # by default we use getent to get the login shell of the user and use that
 container_command_login="/bin/sh -c \"\\\$(getent passwd ${USER} | cut -f 7 -d :) -l\""
-# and we execute container_command using sh -c
-container_command_prefix="/bin/sh -c"
 container_image_default="registry.fedoraproject.org/fedora-toolbox:39"
 container_manager="autodetect"
 container_manager_additional_flags=""
 container_name=""
 container_name_default="my-distrobox"
@@ -212,11 +210,11 @@ while :; do
 			non_interactive=1
 			shift
 			;;
 		-e | --exec | --)
 			shift
-			container_command="$1"
+			container_command="\"$1\""
 			shift
 			for arg in "$@"; do
 				arg="$(echo "${arg}x" | sed 's|'\''|'\'\\\\\'\''|g')"
 				arg="${arg%x}"
 				container_command="${container_command} '${arg}'"
@@ -333,11 +331,10 @@ generate_command() {
 		container_command_login="su ${USER}"
 		if [ "${headless}" -eq 0 ]; then
 			container_command_login="${container_command_login} --pty"
 		fi
 		container_command_login="${container_command_login} -c \"\\\$(getent passwd ${USER} | cut -f 7 -d :) -l\""
-		container_command_prefix="${container_command_login} -c"
 	else
 		result_command="${result_command}
 			--user=\"${USER}"\"
 	fi
 
@@ -466,12 +463,11 @@ generate_command() {
 	# Run selected container with specified command.
 	result_command="${result_command}
 		${container_name}"
 
 	if [ -n "${container_command}" ]; then
-		result_command="${result_command}
-			${container_command_prefix} \"${container_command}\""
+		result_command="${result_command} ${container_command}"
 	else
 		# if no command was specified, let's execute a command that will find
 		# and run the default shell for the user
 		result_command="${result_command}
 			${container_command_login}"

Vulnerable code: # and we execute container_command using sh -c
container_command_prefix="/bin/sh -c"
			container_command="$1"
		container_command_prefix="${container_command_login} -c"
		result_command="${result_command}
			${container_command_prefix} \"${container_command}\""
Fixed code: 			container_command="\"$1\""
		result_command="${result_command} ${container_command}"
CVE-2023-41885: Observable Discrepancy (CWE-203)
value: Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not also enforce strong passwords, these lists of valid accounts are likely to be used in a password spray attack with the outcome being attempted takeover of user accounts on the platform. The impact of this vulnerability is minor as it requires chaining with other attack vectors in order to gain more then simply a list of valid users on the underlying platform. The likelihood of this vulnerability is possible as it requires minimal skills to pull off, especially given the underlying login functionality for Piccolo based sites is open source. This issue has been patched in version 0.121.0.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.3
Published: 2023-09-12T21:15Z
Repository: https://github.com/piccolo-orm/piccolo
Language: Python
Files changed: piccolo/apps/user/tables.py
Commit date: 2023-09-11 20:41:25 +0100
Commit message: Merge pull request from GHSA-h7cm-mrvq-wcfr

Co-authored-by: skelmis <ethan@koldfusion.xyz>
Diff: diff --git a/piccolo/apps/user/tables.py b/piccolo/apps/user/tables.py
index 40463d2..878f067 100644
--- a/piccolo/apps/user/tables.py
+++ b/piccolo/apps/user/tables.py
@@ -210,11 +210,14 @@ class BaseUser(Table, tablename="piccolo_user"):
             .where(cls.username == username)
             .first()
             .run()
         )
         if not response:
-            # No match found
+            # No match found. We still call hash_password
+            # here to mitigate the ability to enumerate
+            # users via response timings
+            cls.hash_password(password)
             return None
 
         stored_password = response["password"]
 
         algorithm, iterations_, salt, hashed = cls.split_stored_password(

Vulnerable code:             # No match found
Fixed code:             # No match found. We still call hash_password
            # here to mitigate the ability to enumerate
            # users via response timings
            cls.hash_password(password)
CVE-2023-30861: Use of Persistent Cookies Containing Sensitive Information (CWE-539)
value: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
2. The application sets `session.permanent = True`
3. The application does not access or modify the session at any point during a request.
4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).
5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.
CWE description: The web application uses persistent cookies, but the cookies contain sensitive information.
CVSS v3 base score: 7.5
Published: 2023-05-02T18:15Z
Repository: https://github.com/pallets/flask
Language: Unknown
Commit date: 2023-05-01 08:11:41 -0700
Commit message: Merge pull request from GHSA-m2qf-hxjv-5gpq

set `Vary: Cookie` header consistently for session
CVE-2023-30861: Use of Persistent Cookies Containing Sensitive Information (CWE-539)
value: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
2. The application sets `session.permanent = True`
3. The application does not access or modify the session at any point during a request.
4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).
5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.
CWE description: The web application uses persistent cookies, but the cookies contain sensitive information.
CVSS v3 base score: 7.5
Published: 2023-05-02T18:15Z
Repository: https://github.com/pallets/flask
Language: Unknown
Commit date: 2023-05-02 07:18:08 -0700
Commit message: Merge pull request #5109 from pallets/backport-vary-cookie

backport 2.2.x: set `Vary: Cookie` header consistently for session
CVE-2023-38698: Integer Overflow or Wraparound (CWE-190)
value: Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerability resides `@ensdomains/ens-contracts` prior to version 0.0.22.

If successfully exploited, this vulnerability would enable attackers to force the expiration of any ENS record, ultimately allowing them to claim the affected domains for themselves. Currently, it would require a malicious DAO to exploit it. Nevertheless, any vulnerability present in the controllers could potentially render this issue exploitable in the future. An additional concern is the possibility of renewal discounts. Should ENS decide to implement a system that offers unlimited .eth domains for a fixed fee in the future, the vulnerability could become exploitable by any user due to the reduced attack cost.

Version 0.0.22 contains a patch for this issue. As long as registration cost remains linear or superlinear based on registration duration, or limited to a reasonable maximum (eg, 1 million years), this vulnerability could only be exploited by a malicious DAO. The interim workaround is thus to take no action.

CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 6.5
Published: 2023-08-04T18:15Z
Repository: https://github.com/ensdomains/ens-contracts
Language: Unknown
Commit date: 2023-08-01 12:31:49 +0100
Commit message: Merge pull request from GHSA-rrxv-q8m4-wch3

Initial version of mitigation contracts
CVE-2023-1181: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-05T17:15Z
Repository: https://github.com/icret/easyimages2.0
Language: Markdown
Files changed: docs/update.md
Commit date: 2023-03-04 17:20:10 +0800
Commit message: Update update.md

Diff: diff --git a/docs/update.md b/docs/update.md
index ecdda97..3487743 100644
--- a/docs/update.md
+++ b/docs/update.md
@@ -1,6 +1,6 @@
-* 2023-03-04 v2.7.6 dev
+* 2023-03-04 v2.7.6
 - 增加限定删除文件目录
 - 增加对SVG文件格式过滤
 - 修复开启验证码后绕过验证
 - 修复弱类型验证导致的异常登录
 - 修复上传历史中文件详细信息链接错误

Vulnerable code: * 2023-03-04 v2.7.6 dev
Fixed code: * 2023-03-04 v2.7.6
CVE-2015-7294: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') (CWE-90)
value: ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
CWE description: The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
CVSS v3 base score: 7.5
Published: 2017-09-06T21:29Z
Repository: https://github.com/vesse/node-ldapauth-fork
Language: JavaScript
Files changed: CHANGES.md, lib/ldapauth.js
Commit date: 2015-08-14 10:51:16 +0300
Commit message: Sanitize user input

Replace the specific special characters with codes as defined in LDAP
specification.

Closes #21

Diff: diff --git a/CHANGES.md b/CHANGES.md
index f89dec9..eb1d54e 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,7 +1,11 @@
 # node-ldapauth-fork Changelog
 
+## 2.3.3
+
+- [issue #20] Sanitize user input
+
 ## 2.3.2
 
 - [issue #19] Added messages to options asserts
 
 ## 2.3.1
diff --git a/lib/ldapauth.js b/lib/ldapauth.js
index 5bfafe9..103d619 100644
--- a/lib/ldapauth.js
+++ b/lib/ldapauth.js
@@ -217,10 +217,21 @@ LdapAuth.prototype._search = function (searchBase, options, callback) {
       });
     });
   });
 };
 
+// https://tools.ietf.org/search/rfc4515#section-3
+var sanitizeInput = function (username) {
+  return username
+    .replace(/\*/g, '\\2a')
+    .replace(/\(/g, '\\28')
+    .replace(/\)/g, '\\29')
+    .replace(/\\/g, '\\5c')
+    .replace(/\0/g, '\\00')
+    .replace(/\//g, '\\2f');
+};
+
 /**
  * Find the user record for the given username.
  *
  * @param username {String}
  * @param callback {Function} `function (err, user)`. If no such user is
@@ -231,11 +242,11 @@ LdapAuth.prototype._findUser = function (username, callback) {
   var self = this;
   if (!username) {
     return callback("empty username");
   }
 
-  var searchFilter = self.opts.searchFilter.replace(/{{username}}/g, username);
+  var searchFilter = self.opts.searchFilter.replace(/{{username}}/g, sanitizeInput(username));
   var opts = {filter: searchFilter, scope: self.opts.searchScope};
   if (self.opts.searchAttributes) {
     opts.attributes = self.opts.searchAttributes;
   }
 

Vulnerable code:   var searchFilter = self.opts.searchFilter.replace(/{{username}}/g, username);
Fixed code: ## 2.3.3

- [issue #20] Sanitize user input

// https://tools.ietf.org/search/rfc4515#section-3
var sanitizeInput = function (username) {
  return username
    .replace(/\*/g, '\\2a')
    .replace(/\(/g, '\\28')
    .replace(/\)/g, '\\29')
    .replace(/\\/g, '\\5c')
    .replace(/\0/g, '\\00')
    .replace(/\//g, '\\2f');
};

  var searchFilter = self.opts.searchFilter.replace(/{{username}}/g, sanitizeInput(username));