Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-45957: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-12-22T16:15Z
Repository: https://github.com/thirtybees/thirtybees
Language: PHP
Files changed: controllers/admin/AdminRequestSqlController.php
Commit date: 2023-10-08 09:06:13 +0200
Commit message: Fix Stored XSS vulnerability

Special thanks to Ulaş Deniz İlhan from Zigrin Security for discovering
and reporting this vulnerability.

Diff: diff --git a/controllers/admin/AdminRequestSqlController.php b/controllers/admin/AdminRequestSqlController.php
index 1b30d1abd7..40eb77abaf 100644
--- a/controllers/admin/AdminRequestSqlController.php
+++ b/controllers/admin/AdminRequestSqlController.php
@@ -475,11 +475,11 @@ class AdminRequestSqlControllerCore extends AdminController
                 $view['attributes'] = $requestSql->attributes;
             } else {
                 $view['error'] = true;
             }
         } catch (PrestaShopException $e) {
-            $this->errors[] = $e->getMessage();
+            $this->errors[] = Tools::safeOutput($e->getMessage());
             $view = [
                 'name'    => '',
                 'key'     => '',
                 'results' => [],
             ];

Vulnerable code:             $this->errors[] = $e->getMessage();
Fixed code:             $this->errors[] = Tools::safeOutput($e->getMessage());
CVE-2021-3822: Uncontrolled Resource Consumption (CWE-400)
value: jsoneditor is vulnerable to Inefficient Regular Expression Complexity
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2021-09-27T13:15Z
Repository: https://github.com/josdejong/jsoneditor
Language: JavaScript
Files changed: HISTORY.md, src/js/util.js
Commit date: 2021-09-22 09:20:38 +0200
Commit message: Fix inefficient regex to replace return characters

Diff: diff --git a/HISTORY.md b/HISTORY.md
index 8c9d1e2..b83799e 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,10 +1,15 @@
 # JSON Editor - History
 
 https://github.com/josdejong/jsoneditor
 
 
+## not yet published, version 9.5.6
+
+- Fix inefficient regex to replace return characters. 
+
+
 ## 2021-09-01, version 9.5.5
 
 - Fix `setMode` not throwing an exception anymore in case of a parse error
   (regression since `9.5.4`).
 
diff --git a/src/js/util.js b/src/js/util.js
index 9316e5f..9977855 100644
--- a/src/js/util.js
+++ b/src/js/util.js
@@ -397,12 +397,12 @@ export function getInnerText (element, buffer) {
     }
   }
 
   // text node
   if (element.nodeValue) {
-    // remove return characters and the whitespace surrounding return characters
-    const trimmedValue = element.nodeValue.replace(/\s*\n\s*/g, '')
+    // remove return characters and the whitespaces surrounding those return characters
+    const trimmedValue = element.nodeValue.replace(/(\b|^)\s*\n\s*(\b|$)/g, '')
     if (trimmedValue !== '') {
       return buffer.flush() + trimmedValue
     } else {
       // ignore empty text
       return ''

Vulnerable code:     // remove return characters and the whitespace surrounding return characters
    const trimmedValue = element.nodeValue.replace(/\s*\n\s*/g, '')
Fixed code: ## not yet published, version 9.5.6

- Fix inefficient regex to replace return characters. 


    // remove return characters and the whitespaces surrounding those return characters
    const trimmedValue = element.nodeValue.replace(/(\b|^)\s*\n\s*(\b|$)/g, '')
CVE-2012-3458: Cryptographic Issues (CWE-310)
value: Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Published: 2012-09-15T17:55Z
Repository: https://github.com/bbangert/beaker
Language: Python
Files changed: beaker/crypto/pycrypto.py
Commit date: 2012-08-07 10:13:51 -0700
Commit message: Apply patch from Redhat to secure pycrypto that otherwise could allow an attacker to determine contents of the encrypted payload (but is unable to modify).

Diff: diff --git a/beaker/crypto/pycrypto.py b/beaker/crypto/pycrypto.py
index 1939555..ed42dbe 100644
--- a/beaker/crypto/pycrypto.py
+++ b/beaker/crypto/pycrypto.py
@@ -13,19 +13,20 @@ try:
     # magic.
     aesDecrypt = aesEncrypt
 
 except ImportError:
     from Crypto.Cipher import AES
+    from Crypto.Util import Counter
 
     def aesEncrypt(data, key):
-        cipher = AES.new(key)
+        cipher = AES.new(key, AES.MODE_CTR,
+                         counter=Counter.new(128, initial_value=0))
 
-        data = data + (" " * (16 - (len(data) % 16)))
         return cipher.encrypt(data)
 
     def aesDecrypt(data, key):
-        cipher = AES.new(key)
-
-        return cipher.decrypt(data).rstrip()
+        cipher = AES.new(key, AES.MODE_CTR,
+                         counter=Counter.new(128, initial_value=0))
+        return cipher.decrypt(data)
 
 def getKeyLength():
     return 32

Vulnerable code:         cipher = AES.new(key)
        data = data + (" " * (16 - (len(data) % 16)))
        cipher = AES.new(key)

        return cipher.decrypt(data).rstrip()
Fixed code:     from Crypto.Util import Counter
        cipher = AES.new(key, AES.MODE_CTR,
                         counter=Counter.new(128, initial_value=0))
        cipher = AES.new(key, AES.MODE_CTR,
                         counter=Counter.new(128, initial_value=0))
        return cipher.decrypt(data)
CVE-2019-18857: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript&#9;:alert substring.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 7.5
Published: 2019-11-11T15:15Z
Repository: https://github.com/darylldoyle/svg-sanitizer
Language: Unknown
Commit date: 2019-10-21 23:39:08 +0100
Commit message: Merge branch 'hotfix/31-xss-bypass'
CVE-2022-23638: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-14T21:15Z
Repository: https://github.com/darylldoyle/svg-sanitizer
Language: Unknown
Commit date: 2022-02-13 00:42:56 +0000
Commit message: Merge pull request from GHSA-fqx8-v33p-4qcc

Advisory fix 1
CVE-2019-8903: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: index.js in Total.js Platform before 3.2.3 allows path traversal.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2019-02-18T16:29Z
Repository: https://github.com/totaljs/framework
Language: JSON
Files changed: index.js, package.json
Commit date: 2019-02-14 21:23:38 +0100
Commit message: Fixed again a critical bug with path travel...

Diff: diff --git a/index.js b/index.js
index 98ac10c5..eb48e203 100755
--- a/index.js
+++ b/index.js
@@ -7385,13 +7385,17 @@ F.$requestcontinue = function(req, res, headers) {
 	// Validates if this request is the file (static file)
 	if (req.isStaticFile) {
 
 		// Stops path travelsation outside of "public" directory
 		// A potential security issue
-		if (req.uri.pathname.indexOf('./') !== -1) {
-			req.$total_status(404);
-			return;
+		for (var i = 0; i < req.uri.pathname.length; i++) {
+			var c = req.uri.pathname[i];
+			var n = req.uri.pathname[i + 1];
+			if ((c === '.' && n === '/') || (c === '%' && n === '2' && req.uri.pathname[i + 2] === 'e')) {
+				req.$total_status(404);
+				return;
+			}
 		}
 
 		F.stats.request.file++;
 		if (F._length_files)
 			req.$total_file();
diff --git a/package.json b/package.json
index 6c6788e7..81aa2354 100755
--- a/package.json
+++ b/package.json
@@ -97,11 +97,11 @@
         "email": "pedro@pmcdigital.pt"
     }, {
         "name": "Sarp Aykent",
         "email": "shackhers@gmail.com"
     }],
-    "version": "3.2.2",
+    "version": "3.2.3",
     "homepage": "http://www.totaljs.com",
     "bugs": {
         "url": "https://github.com/totaljs/framework/issues",
         "email": "petersirka@gmail.com"
     }

Vulnerable code: 		if (req.uri.pathname.indexOf('./') !== -1) {
			req.$total_status(404);
			return;
    "version": "3.2.2",
Fixed code: 		for (var i = 0; i < req.uri.pathname.length; i++) {
			var c = req.uri.pathname[i];
			var n = req.uri.pathname[i + 1];
			if ((c === '.' && n === '/') || (c === '%' && n === '2' && req.uri.pathname[i + 2] === 'e')) {
				req.$total_status(404);
				return;
			}
    "version": "3.2.3",
CVE-2019-8903: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: index.js in Total.js Platform before 3.2.3 allows path traversal.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2019-02-18T16:29Z
Repository: https://github.com/totaljs/framework
Language: JSON
Files changed: index.js, package.json
Commit date: 2019-02-14 00:17:23 +0100
Commit message: Improved security.

Diff: diff --git a/index.js b/index.js
index 1d947f00..798c4be9 100755
--- a/index.js
+++ b/index.js
@@ -66,11 +66,10 @@ const REG_WWW = /^www\./i;
 const REG_TEXTAPPLICATION = /text|application/;
 const REG_ENCODINGCLEANER = /[;\s]charset=utf-8/g;
 const REG_SKIPERROR = /epipe|invalid\sdistance/i;
 const REG_OLDCONF = /-/g;
 const REG_UTF8 = /[^\x20-\x7E]+/;
-const REG_TRAVEL = /(\/)?\.\.\//g;
 const FLAGS_INSTALL = ['get'];
 const FLAGS_DOWNLOAD = ['get', 'dnscache'];
 const QUERYPARSEROPTIONS = { maxKeys: 33 };
 const EMPTYARRAY = [];
 const EMPTYOBJECT = {};
@@ -7325,11 +7324,23 @@ F.listener = function(req, res) {
 		return res.throw400();
 
 	var headers = req.headers;
 	req.$protocol = ((req.connection && req.connection.encrypted) || ((headers['x-forwarded-proto'] || ['x-forwarded-protocol']) === 'https')) ? 'https' : 'http';
 
-	req.url = req.url.replace(REG_TRAVEL, '');
+	var beg = 0;
+
+	// Removes directory browsing
+	for (var i = 0; i < req.url.length; i++) {
+		if (req.url[i] === '.' && req.url[i + 1] === '/')
+			beg = i + 1;
+		else if (req.url[i] === '?')
+			break;
+	}
+
+	if (beg)
+		req.url = req.url.substring(beg);
+
 	req.uri = framework_internal.parseURI(req);
 
 	F.stats.request.request++;
 	F.$events.request && EMIT('request', req, res);
 
diff --git a/package.json b/package.json
index 0c891412..a3577e22 100755
--- a/package.json
+++ b/package.json
@@ -97,11 +97,11 @@
         "email": "pedro@pmcdigital.pt"
     }, {
         "name": "Sarp Aykent",
         "email": "shackhers@gmail.com"
     }],
-    "version": "3.2.0",
+    "version": "3.2.1",
     "homepage": "http://www.totaljs.com",
     "bugs": {
         "url": "https://github.com/totaljs/framework/issues",
         "email": "petersirka@gmail.com"
     }

Vulnerable code: const REG_TRAVEL = /(\/)?\.\.\//g;
	req.url = req.url.replace(REG_TRAVEL, '');
    "version": "3.2.0",
Fixed code: 	var beg = 0;

	// Removes directory browsing
	for (var i = 0; i < req.url.length; i++) {
		if (req.url[i] === '.' && req.url[i + 1] === '/')
			beg = i + 1;
		else if (req.url[i] === '?')
			break;
	}

	if (beg)
		req.url = req.url.substring(beg);

    "version": "3.2.1",
CVE-2020-28494: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.6
Published: 2021-02-02T11:15Z
Repository: https://github.com/totaljs/framework
Language: JavaScript
Files changed: image.js
Commit date: 2020-11-27 17:36:16 +0100
Commit message: Fixed "Command Injection" in `image.stream()` - thank to Sam Sanoop.

Diff: diff --git a/image.js b/image.js
index 19631b27..b01a9998 100755
--- a/image.js
+++ b/image.js
@@ -36,10 +36,11 @@ const REGEXP_PATH = /\//g;
 const REGEXP_ESCAPE = /'/g;
 const SPAWN_OPT = { shell: true };
 const D = require('os').platform().substring(0, 3).toLowerCase() === 'win' ? '"' : '\'';
 const CMD_CONVERT = { gm: 'gm', im: 'convert', magick: 'magick' };
 const CMD_CONVERT2 = { gm: 'gm convert', im: 'convert', magick: 'magick' };
+const SUPPORTEDIMAGES = { jpg: 1, png: 1, gif: 1, apng: 1, jpeg: 1, heif: 1, heic: 1, webp: 1, ico: 1 };
 
 var CACHE = {};
 var middlewares = {};
 
 if (!global.framework_utils)
@@ -320,11 +321,11 @@ ImageProto.stream = function(type, writer) {
 
 	var self = this;
 
 	!self.builder.length && self.minify();
 
-	if (!type)
+	if (!type || !SUPPORTEDIMAGES[type])
 		type = self.outputType;
 
 	F.stats.performance.open++;
 	var cmd = spawn(CMD_CONVERT[self.cmdarg], self.arg(self.filename ? wrap(self.filename) : '-', (type ? type + ':' : '') + '-'), SPAWN_OPT);
 	if (self.currentStream) {

Vulnerable code: 	if (!type)
Fixed code: const SUPPORTEDIMAGES = { jpg: 1, png: 1, gif: 1, apng: 1, jpeg: 1, heif: 1, heic: 1, webp: 1, ico: 1 };
	if (!type || !SUPPORTEDIMAGES[type])
CVE-2020-28495: Other (NVD-CWE-Other)
value: This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.3
Published: 2021-02-02T11:15Z
Repository: https://github.com/totaljs/framework
Language: JavaScript
Files changed: utils.js
Commit date: 2020-12-31 11:41:21 +0100
Commit message: Fixed `U.set()` by adding check for `Prototype pollution`.

Diff: diff --git a/utils.js b/utils.js
index 2b2959dd7..916954343 100755
--- a/utils.js
+++ b/utils.js
@@ -6619,10 +6619,14 @@ exports.set = function(obj, path, value) {
 	}
 
 	var v = arr[arr.length - 1];
 	var ispush = v.lastIndexOf('[]') !== -1;
 	var a = builder.join(';') + ';var v=typeof(a)===\'function\'?a(U.get(b)):a;w' + (v[0] === '[' ? '' : '.') + (ispush ? v.replace(REGREPLACEARR, '.push(v)') : (v + '=v')) + ';return v';
+
+	if ((/__proto__|constructor|prototype/).test(a))
+		throw new Error('Prototype pollution');
+
 	var fn = new Function('w', 'a', 'b', a);
 	F.temporary.other[cachekey] = fn;
 	fn(obj, value, path);
 };
 

Fixed code: 
	if ((/__proto__|constructor|prototype/).test(a))
		throw new Error('Prototype pollution');
CVE-2021-23344: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2021-03-04T17:15Z
Repository: https://github.com/totaljs/framework
Language: JavaScript
Files changed: changes.txt, utils.js
Commit date: 2021-02-21 23:59:45 +0100
Commit message: Fixed potential vulnerability in `U.set()` method.

Diff: diff --git a/changes.txt b/changes.txt
index bb2194e62..9b739d458 100755
--- a/changes.txt
+++ b/changes.txt
@@ -1,8 +1,9 @@
 ======= 3.4.9
 
 - fixed measuring dimension for `.gif` images
+- fixed potential remote code execution in `U.set()` founded by [Snyk](https://snyk.io/vuln)
 
 ======= 3.4.7
 
 - fixed: command injection in `Image.pipe()` and `Image.stream()`
 - fixed `DELETE` method for the schemas (now it works like `PATCH` method)
diff --git a/utils.js b/utils.js
index 916954343..1a5512cc9 100755
--- a/utils.js
+++ b/utils.js
@@ -6620,12 +6620,12 @@ exports.set = function(obj, path, value) {
 
 	var v = arr[arr.length - 1];
 	var ispush = v.lastIndexOf('[]') !== -1;
 	var a = builder.join(';') + ';var v=typeof(a)===\'function\'?a(U.get(b)):a;w' + (v[0] === '[' ? '' : '.') + (ispush ? v.replace(REGREPLACEARR, '.push(v)') : (v + '=v')) + ';return v';
 
-	if ((/__proto__|constructor|prototype/).test(a))
-		throw new Error('Prototype pollution');
+	if ((/__proto__|constructor|prototype|eval/).test(a))
+		throw new Error('Potential vulnerability');
 
 	var fn = new Function('w', 'a', 'b', a);
 	F.temporary.other[cachekey] = fn;
 	fn(obj, value, path);
 };

Vulnerable code: 	if ((/__proto__|constructor|prototype/).test(a))
		throw new Error('Prototype pollution');
Fixed code: - fixed potential remote code execution in `U.set()` founded by [Snyk](https://snyk.io/vuln)
	if ((/__proto__|constructor|prototype|eval/).test(a))
		throw new Error('Potential vulnerability');
CVE-2017-15367: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2018-03-07T20:29Z
Repository: https://github.com/bacula-web/bacula-web
Language: PHP
Files changed: client-report.php
Commit date: 2017-09-25 15:33:23 +0200
Commit message: Ensure provided period is a valid integer and a known value

  - if provided period is not an integer or a known value, we
    raise an exception

Diff: diff --git a/client-report.php b/client-report.php
index 0110ecc..5387011 100644
--- a/client-report.php
+++ b/client-report.php
@@ -62,10 +62,19 @@
           throw new Exception('Critical: provided parameter (client_id) is not valid');
        }
 
        $period = CHttpRequest::get_Value('period');
 
+       // Check if period is an integer and listed in known periods
+       if(!array_key_exists( $period, $periods_list)) {
+          throw new Exception('Critical: provided value for (period) is unknown or not valid');
+       }
+
+       if(!filter_var($period, FILTER_VALIDATE_INT)) {
+          throw new Exception('Critical: provided value for (period) is unknown or not valid');
+       }
+
        $view->assign( 'no_report_options', 'false');
        
        // Client informations
        $client_info  = $client->getClientInfos($clientid);
        $view->assign('client_name', $client_info['name']);

Fixed code:        // Check if period is an integer and listed in known periods
       if(!array_key_exists( $period, $periods_list)) {
          throw new Exception('Critical: provided value for (period) is unknown or not valid');
       }

       if(!filter_var($period, FILTER_VALIDATE_INT)) {
          throw new Exception('Critical: provided value for (period) is unknown or not valid');
       }
CVE-2018-14632: Out-of-bounds Write (CWE-787)
value: An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.7
Published: 2018-09-06T14:29Z
Repository: https://github.com/evanphx/json-patch
Language: Go
Files changed: patch.go, patch_test.go
Commit date: 2018-05-25 22:54:09 +0800
Commit message: fix check idx index

Diff: diff --git a/patch.go b/patch.go
index 755d8ba..1a3aa38 100644
--- a/patch.go
+++ b/patch.go
@@ -395,11 +395,13 @@ func (d *partialArray) add(key string, val *lazyNode) error {
 		if idx > len(ary) {
 			return fmt.Errorf("Unable to access invalid index: %d", idx)
 		}
 		idx = len(ary) - idx
 	}
-
+	if idx < 0 || idx >= len(ary) || idx > len(cur) {
+		return fmt.Errorf("Unable to access invalid index: %d", idx)
+	}
 	copy(ary[0:idx], cur[0:idx])
 	ary[idx] = val
 	copy(ary[idx+1:], cur[idx:])
 
 	*d = ary
diff --git a/patch_test.go b/patch_test.go
index c5e69c6..b6b39f7 100644
--- a/patch_test.go
+++ b/patch_test.go
@@ -225,10 +225,14 @@ var BadCases = []BadCase{
 
 	{
 		`{ "name":{ "foo": "bat", "qux": "bum"}}`,
 		`[ { "op": "replace", "path": "/foo/bar", "value":"baz"}]`,
 	},
+	{
+		`{ "foo": ["bar"]}`,
+		`[ {"op": "add", "path": "/foo/2", "value": "bum"}]`,
+	},
 }
 
 func TestAllCases(t *testing.T) {
 	for _, c := range Cases {
 		out, err := applyPatch(c.doc, c.patch)

Fixed code: 	if idx < 0 || idx >= len(ary) || idx > len(cur) {
		return fmt.Errorf("Unable to access invalid index: %d", idx)
	}
	{
		`{ "foo": ["bar"]}`,
		`[ {"op": "add", "path": "/foo/2", "value": "bum"}]`,
	},
CVE-2024-29186: Insufficient Information (NVD-CWE-noinfo)
value: Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref prior to version 2.1.17 is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed. In the parsing process, the `Content-Type` header of each part is read using the `Riverline/multipart-parser` library.

The library, in the `StreamedPart::parseHeaderContent` function, performs slow multi-byte string operations on the header value.
Precisely, the `mb_convert_encoding` function is used with the first (`$string`) and third (`$from_encoding`) parameters read from the header value.

An attacker could send specifically crafted requests which would force the server into performing long operations with a consequent long billed duration.

The attack has the following requirements and limitations: The Lambda should use the Event-Driven Function runtime and the `RequestHandlerInterface` handler and should implement at least an endpoint accepting POST requests; the attacker can send requests up to 6MB long (this is enough to cause a billed duration between 400ms and 500ms with the default 1024MB RAM Lambda image of Bref); and if the Lambda uses a PHP runtime <= php-82, the impact is higher as the billed duration in the default 1024MB RAM Lambda image of Bref could be brought to more than 900ms for each request. Notice that the vulnerability applies only to headers read from the request body as the request header has a limitation which allows a total maximum size of ~10KB.

Version 2.1.17 contains a fix for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-22T17:15Z
Repository: https://github.com/brefphp/bref
Language: JSON
Files changed: composer.json
Commit date: 2024-03-22 13:39:02 +0100
Commit message: Require `riverline/multipart-parser` 2.1.2 to fix security issue

Diff: diff --git a/composer.json b/composer.json
index 148a6061..9b407da2 100644
--- a/composer.json
+++ b/composer.json
@@ -27,11 +27,11 @@
         "hollodotme/fast-cgi-client": "^3.0.1",
         "nyholm/psr7": "^1.4.1",
         "psr/container": "^1.0|^2.0",
         "psr/http-message": "^1.0|^2.0",
         "psr/http-server-handler": "^1.0",
-        "riverline/multipart-parser": "^2.0.6",
+        "riverline/multipart-parser": "^2.1.2",
         "symfony/process": "^4.4|^5.0|^6.0|^7.0"
     },
     "require-dev": {
         "async-aws/core": "^1.0",
         "async-aws/lambda": "^1.0",

Vulnerable code:         "riverline/multipart-parser": "^2.0.6",
Fixed code:         "riverline/multipart-parser": "^2.1.2",
CVE-2022-40897: Inefficient Regular Expression Complexity (CWE-1333)
value: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 5.9
Published: 2022-12-23T00:15Z
Repository: https://github.com/pypa/setuptools
Language: Python
Files changed: setuptools/package_index.py, setuptools/tests/test_packageindex.py
Commit date: 2022-11-04 13:52:26 -0400
Commit message: Limit the amount of whitespace to search/backtrack. Fixes #3659.

Diff: diff --git a/setuptools/package_index.py b/setuptools/package_index.py
index 5619e4da..362e26f3 100644
--- a/setuptools/package_index.py
+++ b/setuptools/package_index.py
@@ -215,11 +215,11 @@ def unique_values(func):
         return unique_everseen(func(*args, **kwargs))
 
     return wrapper
 
 
-REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
+REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)
 """
 Regex for an HTML tag with 'rel="val"' attributes.
 """
 
 
diff --git a/setuptools/tests/test_packageindex.py b/setuptools/tests/test_packageindex.py
index babc1197..7b0bf112 100644
--- a/setuptools/tests/test_packageindex.py
+++ b/setuptools/tests/test_packageindex.py
@@ -305,11 +305,10 @@ class TestPyPIConfig:
         cred = cfg.creds_by_repository['https://pypi.org']
         assert cred.username == 'jaraco'
         assert cred.password == 'pity%'
 
 
-@pytest.mark.xfail(reason="#3659")
 @pytest.mark.timeout(1)
 def test_REL_DoS():
     """
     REL should not hang on a contrived attack string.
     """

Vulnerable code: REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
@pytest.mark.xfail(reason="#3659")
Fixed code: REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)
CVE-2024-6345: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Published: 2024-07-15T01:15Z
Repository: https://github.com/pypa/setuptools
Language: Unknown
Commit date: 2024-04-29 20:01:38 -0400
Commit message: Merge pull request #4332 from pypa/debt/package-index-vcs

Modernize package_index VCS handling
CVE-2024-39943: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2024-07-04T23:15Z
Repository: https://github.com/rejetto/hfs
Language: TypeScript
Files changed: src/util-os.ts
Commit date: 2024-07-03 22:32:51 +0200
Commit message: fix: remote-execution with upload permissions on mac+linux. Thanks to @charmindoge for reporting (CVE requested)

Diff: diff --git a/src/util-os.ts b/src/util-os.ts
index 7790575e..7e5f2f81 100644
--- a/src/util-os.ts
+++ b/src/util-os.ts
@@ -1,8 +1,8 @@
 import { dirname, resolve } from 'path'
 import { existsSync } from 'fs'
-import { exec, execSync } from 'child_process'
+import { exec, execSync, spawnSync } from 'child_process'
 import { onlyTruthy, splitAt, try_ } from './misc'
 import _ from 'lodash'
 import { pid } from 'node:process'
 import { promisify } from 'util'
 import { IS_WINDOWS } from './const'
@@ -16,11 +16,11 @@ export function getDiskSpaceSync(path: string) {
             throw Error('miss')
         return { free: Number(one.FreeSpace), total: Number(one.Size) }
     }
     while (path && !existsSync(path))
         path = dirname(path)
-    const out = try_(() => execSync(`df -k "${path}"`).toString(),
+    const out = try_(() => spawnSync('df', ['-k', path]).stdout.toString(),
         err => { throw err.status === 1 ? Error('miss') : err.status === 127 ? Error('unsupported') : err })
     if (!out?.startsWith('Filesystem'))
         throw Error('unsupported')
     const one = out.split('\n')[1] as string
     const [used, free] = one.split(/\s+/).slice(2, 4).map(x => Number(x) * 1024) as [number, number]

Vulnerable code: import { exec, execSync } from 'child_process'
    const out = try_(() => execSync(`df -k "${path}"`).toString(),
Fixed code: import { exec, execSync, spawnSync } from 'child_process'
    const out = try_(() => spawnSync('df', ['-k', path]).stdout.toString(),
CVE-2019-11932: Double Free (CWE-415)
value: A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 8.8
Published: 2019-10-03T22:15Z
Repository: https://github.com/koral--/android-gif-drawable
Language: C
Files changed: android-gif-drawable/src/main/c/decoding.c
Commit date: 2019-09-09 01:31:47 +0200
Commit message: Do not realloc array if new raster size is 0.

if realloc() is called with 0 size it may return NULL and this will be incorrectly handled
as not enough memory and (also) rasterBits will be freed by realloc but we will not update
it.

Diff: diff --git a/android-gif-drawable/src/main/c/decoding.c b/android-gif-drawable/src/main/c/decoding.c
index 18c5322..f8ebb0a 100644
--- a/android-gif-drawable/src/main/c/decoding.c
+++ b/android-gif-drawable/src/main/c/decoding.c
@@ -54,13 +54,19 @@ void DDGifSlurp(GifInfo *info, bool decode, bool exitAfterFrame) {
 						break;
 					}
 				}
 
 				if (decode) {
-					int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
-					int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;
 					const uint_fast32_t newRasterSize = gifFilePtr->Image.Width * gifFilePtr->Image.Height;
+					if (newRasterSize == 0) {
+						free(info->rasterBits);
+						info->rasterBits = NULL;
+						info->rasterSize = newRasterSize;
+						return;
+					}
+					const int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
+					const int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;
 					if (newRasterSize > info->rasterSize || widthOverflow > 0 || heightOverflow > 0) {
 						void *tmpRasterBits = reallocarray(info->rasterBits, newRasterSize, sizeof(GifPixelType));
 						if (tmpRasterBits == NULL) {
 							gifFilePtr->Error = D_GIF_ERR_NOT_ENOUGH_MEM;
 							break;

Vulnerable code: 					int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
					int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;
Fixed code: 					if (newRasterSize == 0) {
						free(info->rasterBits);
						info->rasterBits = NULL;
						info->rasterSize = newRasterSize;
						return;
					}
					const int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
					const int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;
CVE-2012-3866: Permissions, Privileges, and Access Controls (CWE-264)
value: lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2012-08-06T16:55Z
Repository: https://github.com/puppetlabs/puppet
Language: Ruby
Files changed: lib/puppet/defaults.rb
Commit date: 2012-06-26 17:35:23 -0700
Commit message: Tighten permissions on classfile, resourcefile, lastrunfile, and lastrunreport.

Diff: diff --git a/lib/puppet/defaults.rb b/lib/puppet/defaults.rb
index dc820f061b..56223bb530 100644
--- a/lib/puppet/defaults.rb
+++ b/lib/puppet/defaults.rb
@@ -597,18 +597,18 @@ EOT
       },
     :clientyamldir => {:default => "$vardir/client_yaml", :mode => "750", :desc => "The directory in which client-side YAML data is stored."},
     :client_datadir => {:default => "$vardir/client_data", :mode => "750", :desc => "The directory in which serialized data is stored on the client."},
     :classfile => { :default => "$statedir/classes.txt",
       :owner => "root",
-      :mode => 0644,
+      :mode => 0640,
       :desc => "The file in which puppet agent stores a list of the classes
         associated with the retrieved configuration.  Can be loaded in
         the separate `puppet` executable using the `--loadclasses`
         option."},
     :resourcefile => { :default => "$statedir/resources.txt",
       :owner => "root",
-      :mode => 0644,
+      :mode => 0640,
       :desc => "The file in which puppet agent stores a list of the resources
         associated with the retrieved configuration."  },
     :puppetdlog => { :default => "$logdir/puppetd.log",
       :owner => "root",
       :mode => 0640,
@@ -711,15 +711,15 @@ EOT
     ],
     :report => [true,
       "Whether to send reports after every transaction."
     ],
     :lastrunfile =>  { :default => "$statedir/last_run_summary.yaml",
-      :mode => 0644,
+      :mode => 0640,
       :desc => "Where puppet agent stores the last run report summary in yaml format."
     },
     :lastrunreport =>  { :default => "$statedir/last_run_report.yaml",
-      :mode => 0644,
+      :mode => 0640,
       :desc => "Where puppet agent stores the last run report in yaml format."
     },
     :graph => [false, "Whether to create dot graph files for the different
       configuration graphs.  These dot files can be interpreted by tools
       like OmniGraffle or dot (which is part of ImageMagick)."],

Vulnerable code:       :mode => 0644,
      :mode => 0644,
      :mode => 0644,
      :mode => 0644,
Fixed code:       :mode => 0640,
      :mode => 0640,
      :mode => 0640,
      :mode => 0640,
CVE-2024-22404: Improper Preservation of Permissions (CWE-281)
value: Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.
CWE description: The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
CVSS v3 base score: 4.3
Published: 2024-01-18T21:15Z
Repository: https://github.com/nextcloud/files_zip
Language: Unknown
Commit date: 2023-12-20 22:59:05 +0100
Commit message: Merge pull request #192 from nextcloud/bugfix/share-attributes
CVE-2012-4394: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: JavaScript
Files changed: apps/files/js/filelist.js
Commit date: 2012-07-11 19:15:11 +0200
Commit message: Sanitizing file names

Diff: diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js
index e6a9a6883..3645258f9 100644
--- a/apps/files/js/filelist.js
+++ b/apps/files/js/filelist.js
@@ -12,11 +12,11 @@ FileList={
 		}else{
 			var basename=name;
 			var extension=false;
 		}
 		html+='<td class="filename" style="background-image:url('+img+')"><input type="checkbox" />';
-		html+='<a class="name" href="download.php?file='+$('#dir').val()+'/'+name+'"><span class="nametext">'+basename
+		html+='<a class="name" href="download.php?file='+$('#dir').val().replace(/</, '&lt;').replace(/>/, '&gt;')+'/'+name+'"><span class="nametext">'+basename
 		if(extension){
 			html+='<span class="extension">'+extension+'</span>';
 		}
 		html+='</span></a></td>';
 		if(size!='Pending'){

Vulnerable code: 		html+='<a class="name" href="download.php?file='+$('#dir').val()+'/'+name+'"><span class="nametext">'+basename
Fixed code: 		html+='<a class="name" href="download.php?file='+$('#dir').val().replace(/</, '&lt;').replace(/>/, '&gt;')+'/'+name+'"><span class="nametext">'+basename
CVE-2012-4395: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirect_url parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: index.php
Commit date: 2012-06-15 16:16:00 +0200
Commit message: fixed xss vulnerability

Diff: diff --git a/index.php b/index.php
index 5042ede2e..4df62327c 100644
--- a/index.php
+++ b/index.php
@@ -116,9 +116,9 @@ elseif(OC_User::isLoggedIn()) {
 		}
 	}
 	if(!array_key_exists('sectoken', $_SESSION) || (array_key_exists('sectoken', $_SESSION) && is_null(OC::$REQUESTEDFILE)) || substr(OC::$REQUESTEDFILE, -3) == 'php'){
 		$sectoken=rand(1000000,9999999);
 		$_SESSION['sectoken']=$sectoken;
-		$redirect_url = (isset($_REQUEST['redirect_url'])) ? $_REQUEST['redirect_url'] : $_SERVER['REQUEST_URI'];
+		$redirect_url = (isset($_REQUEST['redirect_url'])) ? strip_tags($_REQUEST['redirect_url']) : $_SERVER['REQUEST_URI'];
 		OC_Template::printGuestPage('', 'login', array('error' => $error, 'sectoken' => $sectoken, 'redirect' => $redirect_url));
 	}
 }

Vulnerable code: 		$redirect_url = (isset($_REQUEST['redirect_url'])) ? $_REQUEST['redirect_url'] : $_SERVER['REQUEST_URI'];
Fixed code: 		$redirect_url = (isset($_REQUEST['redirect_url'])) ? strip_tags($_REQUEST['redirect_url']) : $_SERVER['REQUEST_URI'];
CVE-2012-4396: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: apps/calendar/lib/object.php
Commit date: 2012-06-05 10:49:36 +0200
Commit message: xss vulnerability fixed

Diff: diff --git a/apps/calendar/lib/object.php b/apps/calendar/lib/object.php
index f0a9bf050..cc80a0bb7 100644
--- a/apps/calendar/lib/object.php
+++ b/apps/calendar/lib/object.php
@@ -598,22 +598,22 @@ class OC_Calendar_Object{
 		return self::updateVCalendarFromRequest($request, $vcalendar);
 	}
 
 	public static function updateVCalendarFromRequest($request, $vcalendar)
 	{
-		$title = $request["title"];
-		$location = $request["location"];
+		$title = strip_tags($request["title"]);
+		$location = strip_tags($request["location"]);
 		$categories = $request["categories"];
 		$allday = isset($request["allday"]);
 		$from = $request["from"];
 		$to  = $request["to"];
 		if (!$allday){
 			$fromtime = $request['fromtime'];
 			$totime = $request['totime'];
 		}
 		$vevent = $vcalendar->VEVENT;
-		$description = $request["description"];
+		$description = strip_tags($request["description"]);
 		$repeat = $request["repeat"];
 		if($repeat != 'doesnotrepeat'){
 			$rrule = '';
 			$interval = $request['interval'];
 			$end = $request['end'];

Vulnerable code: 		$title = $request["title"];
		$location = $request["location"];
		$description = $request["description"];
Fixed code: 		$title = strip_tags($request["title"]);
		$location = strip_tags($request["location"]);
		$description = strip_tags($request["description"]);
CVE-2012-4396: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: apps/media/lib_scanner.php
Commit date: 2012-06-05 10:49:26 +0200
Commit message: xss vulnerability fixed

Diff: diff --git a/apps/media/lib_scanner.php b/apps/media/lib_scanner.php
index dc2a8a9be..82170e5ca 100644
--- a/apps/media/lib_scanner.php
+++ b/apps/media/lib_scanner.php
@@ -77,23 +77,23 @@ class OC_MEDIA_SCANNER{
 		}
 		if(!isset($data['comments']['artist'])){
 			OCP\Util::writeLog('media',"error reading artist tag in '$file'",OCP\Util::WARN);
 			$artist='unknown';
 		}else{
-			$artist=stripslashes($data['comments']['artist'][0]);
+			$artist=strip_tags(stripslashes($data['comments']['artist'][0]));
 		}
 		if(!isset($data['comments']['album'])){
 			OCP\Util::writeLog('media',"error reading album tag in '$file'",OCP\Util::WARN);
 			$album='unknown';
 		}else{
-			$album=stripslashes($data['comments']['album'][0]);
+			$album=strip_tags(stripslashes($data['comments']['album'][0]));
 		}
 		if(!isset($data['comments']['title'])){
 			OCP\Util::writeLog('media',"error reading title tag in '$file'",OCP\Util::WARN);
 			$title='unknown';
 		}else{
-			$title=stripslashes($data['comments']['title'][0]);
+			$title=strip_tags(stripslashes($data['comments']['title'][0]));
 		}
 		$size=$data['filesize'];
 		if (isset($data['comments']['track']))
 		{
 			$track = $data['comments']['track'][0];

Vulnerable code: 			$artist=stripslashes($data['comments']['artist'][0]);
			$album=stripslashes($data['comments']['album'][0]);
			$title=stripslashes($data['comments']['title'][0]);
Fixed code: 			$artist=strip_tags(stripslashes($data['comments']['artist'][0]));
			$album=strip_tags(stripslashes($data['comments']['album'][0]));
			$title=strip_tags(stripslashes($data['comments']['title'][0]));