Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-25629: Insufficient Information (NVD-CWE-noinfo)
value: c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-23T15:15Z
Repository: https://github.com/c-ares/c-ares
Language: C
Files changed: src/lib/ares__read_line.c
Commit date: 2024-02-22 16:23:33 -0500
Commit message: Merge pull request from GHSA-mg26-v6qh-x48q


Diff: diff --git a/src/lib/ares__read_line.c b/src/lib/ares__read_line.c
index d65ac1fc..018f55e8 100644
--- a/src/lib/ares__read_line.c
+++ b/src/lib/ares__read_line.c
@@ -57,10 +57,18 @@ ares_status_t ares__read_line(FILE *fp, char **buf, size_t *bufsize)
 
     if (!fgets(*buf + offset, bytestoread, fp)) {
       return (offset != 0) ? 0 : (ferror(fp)) ? ARES_EFILE : ARES_EOF;
     }
     len = offset + ares_strlen(*buf + offset);
+
+    /* Probably means there was an embedded NULL as the first character in
+     * the line, throw away line */
+    if (len == 0) {
+      offset = 0;
+      continue;
+    }
+
     if ((*buf)[len - 1] == '\n') {
       (*buf)[len - 1] = 0;
       break;
     }
     offset = len;

Fixed code: 
    /* Probably means there was an embedded NULL as the first character in
     * the line, throw away line */
    if (len == 0) {
      offset = 0;
      continue;
    }
CVE-2012-3525: Improper Input Validation (CWE-20)
value: s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2012-08-25T16:55Z
Repository: https://github.com/Jabberd2/jabberd2
Language: C
Files changed: s2s/out.c
Commit date: 2012-08-22 08:03:58 +0200
Commit message: Fixed possibility of Unsolicited Dialback Attacks
Diff: diff --git a/s2s/out.c b/s2s/out.c
index 0ed9b30..7b9f44f 100644
--- a/s2s/out.c
+++ b/s2s/out.c
@@ -1659,11 +1659,11 @@ static void _out_result(conn_t out, nad_t nad) {
 
     rkey = s2s_route_key(NULL, to->domain, from->domain);
     rkeylen = strlen(rkey);
 
     /* key is valid */
-    if(nad_find_attr(nad, 0, -1, "type", "valid") >= 0) {
+    if(nad_find_attr(nad, 0, -1, "type", "valid") >= 0 && xhash_get(out->states, rkey) == (void*) conn_INPROGRESS) {
         log_write(out->s2s->log, LOG_NOTICE, "[%d] [%s, port=%d] outgoing route '%s' is now valid%s%s", out->fd->fd, out->ip, out->port, rkey, (out->s->flags & SX_SSL_WRAPPER) ? ", TLS negotiated" : "", out->s->compressed ? ", ZLIB compression enabled" : "");
 
         xhash_put(out->states, pstrdup(xhash_pool(out->states), rkey), (void *) conn_VALID);    /* !!! small leak here */
 
         log_debug(ZONE, "%s valid, flushing queue", rkey);
@@ -1747,11 +1747,11 @@ static void _out_verify(conn_t out, nad_t nad) {
     }
 
     rkey = s2s_route_key(NULL, to->domain, from->domain);
 
     attr = nad_find_attr(nad, 0, -1, "type", "valid");
-    if(attr >= 0) {
+    if(attr >= 0 && xhash_get(in->states, rkey) == (void*) conn_INPROGRESS) {
         xhash_put(in->states, pstrdup(xhash_pool(in->states), rkey), (void *) conn_VALID);
         log_write(in->s2s->log, LOG_NOTICE, "[%d] [%s, port=%d] incoming route '%s' is now valid%s%s", in->fd->fd, in->ip, in->port, rkey, (in->s->flags & SX_SSL_WRAPPER) ? ", TLS negotiated" : "", in->s->compressed ? ", ZLIB compression enabled" : "");
         valid = 1;
     } else {
         log_write(in->s2s->log, LOG_NOTICE, "[%d] [%s, port=%d] incoming route '%s' is now invalid", in->fd->fd, in->ip, in->port, rkey);

Vulnerable code:     if(nad_find_attr(nad, 0, -1, "type", "valid") >= 0) {
    if(attr >= 0) {
Fixed code:     if(nad_find_attr(nad, 0, -1, "type", "valid") >= 0 && xhash_get(out->states, rkey) == (void*) conn_INPROGRESS) {
    if(attr >= 0 && xhash_get(in->states, rkey) == (void*) conn_INPROGRESS) {
CVE-2021-43781: Incorrect Authorization (CWE-863)
value: Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.3
Published: 2021-12-06T18:15Z
Repository: https://github.com/inveniosoftware/invenio-drafts-resources
Language: Python
Files changed: invenio_drafts_resources/services/records/service.py
Commit date: 2021-12-06 09:07:52 +0100
Commit message: security: fix missing permission check of publish

* Invenio-Drafts-Resources does not properly check permissions when a
  record is published. The vulnerability is exploitable in a default
  installation of InvenioRDM. An authenticated a user is able via REST
  API calls to publish draft records of other users if they know the
  record identifier and the draft validates (e.g. all require fields
  filled out). An attacker is not able to modify the data in the record,
  and thus e.g. cannot change a record from restricted to public.

Diff: diff --git a/invenio_drafts_resources/services/records/service.py b/invenio_drafts_resources/services/records/service.py
index 20e367d..c9ee5df 100644
--- a/invenio_drafts_resources/services/records/service.py
+++ b/invenio_drafts_resources/services/records/service.py
@@ -265,14 +265,13 @@ class RecordService(RecordServiceBase):
             - Validate it more strictly than when it was originally saved
               (drafts can be incomplete but only complete drafts can be turned
               into records)
             - Create or update associated (published) record with data
         """
-        self.require_permission(identity, "publish")
-
         # Get the draft
         draft = self.draft_cls.pid.resolve(id_, registered_only=False)
+        self.require_permission(identity, "publish", record=draft)
 
         # Validate the draft strictly - since a draft can be saved with errors
         # we do a strict validation here to make sure only valid drafts can be
         # published.
         self._validate_draft(identity, draft)

Vulnerable code:         self.require_permission(identity, "publish")

Fixed code:         self.require_permission(identity, "publish", record=draft)
CVE-2018-19620: Direct Request ('Forced Browsing') (CWE-425)
value: ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.
CWE description: The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
CVSS v3 base score: 4.3
Published: 2018-11-28T08:29Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Controller/CatalogController.class.php
Commit date: 2018-11-28 10:13:59 +0800
Commit message: Update CatalogController.class.php
Diff: diff --git a/server/Application/Api/Controller/CatalogController.class.php b/server/Application/Api/Controller/CatalogController.class.php
index 700f0bd..fe06fad 100644
--- a/server/Application/Api/Controller/CatalogController.class.php
+++ b/server/Application/Api/Controller/CatalogController.class.php
@@ -110,11 +110,16 @@ class CatalogController extends BaseController {
         }else{
             $data['level'] = 2;
         }
 
         if ($cat_id > 0 ) {
-            
+            $cat = D("Catalog")->where(" cat_id = '$cat_id' ")->find();
+            $item_id = $cat['item_id']; 
+            if (!$this->checkItemPermn($login_user['uid'] , $item_id)) {
+                $this->sendError(10103);
+                return;
+            }
             //如果一个目录已经是别的目录的父目录，那么它将无法再转为level4目录
             if (D("Catalog")->where(" parent_cat_id = '$cat_id' ")->find() && $data['level'] == 4 ) {
                 $this->sendError(10101,"该目录含有子目录，不允许转为底层目录。");
                 return;
             }

Fixed code:             $cat = D("Catalog")->where(" cat_id = '$cat_id' ")->find();
            $item_id = $cat['item_id']; 
            if (!$this->checkItemPermn($login_user['uid'] , $item_id)) {
                $this->sendError(10103);
                return;
            }
CVE-2021-3678: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)
value: showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE description: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CVSS v3 base score: 5.9
Published: 2021-08-04T14:15Z
Repository: https://github.com/star7th/showdoc
Language: Unknown
Commit date: 2021-08-04 01:19:35 +0800
Commit message: Merge pull request #1438 from michaellrowley/security-patch

CVE-2021-3678 Patch
CVE-2021-3680: Improper Verification of Cryptographic Signature (CWE-347)
value: showdoc is vulnerable to Missing Cryptographic Step
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 4.9
Published: 2021-08-04T13:15Z
Repository: https://github.com/star7th/showdoc
Language: Unknown
Commit date: 2021-08-04 01:19:35 +0800
Commit message: Merge pull request #1438 from michaellrowley/security-patch

CVE-2021-3678 Patch
CVE-2021-3993: Cross-Site Request Forgery (CSRF) (CWE-352)
value: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2021-12-01T11:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/index.php
Commit date: 2021-11-22 20:22:29 +0800
Commit message: Cookie security /Cookie 安全

Diff: diff --git a/server/index.php b/server/index.php
index 6f19bcc8..176d03cd 100644
--- a/server/index.php
+++ b/server/index.php
@@ -6,10 +6,22 @@ define('COMPOSER_PHP_VERSION', '7.2.5' );
 if(version_compare(PHP_VERSION,COMPOSER_PHP_VERSION,'>')){
     // 增加自动加载
     require './vendor/autoload.php';
 }
 
+// cookie安全，给PHPSESSID加上Strict
+if (PHP_VERSION_ID >= 70300) {
+    session_set_cookie_params([
+        'samesite' => 'Strict'
+    ]);
+} else { 
+    session_set_cookie_params(
+        NULL,
+        '/; samesite=Strict',
+    );
+}
+
 // 开启调试模式 建议开发阶段开启 部署阶段注释或者设为false
 define('APP_DEBUG',True);
 
 // 定义应用目录
 define('APP_PATH','./Application/');

Fixed code: // cookie安全，给PHPSESSID加上Strict
if (PHP_VERSION_ID >= 70300) {
    session_set_cookie_params([
        'samesite' => 'Strict'
    ]);
} else { 
    session_set_cookie_params(
        NULL,
        '/; samesite=Strict',
    );
}
CVE-2021-4017: Cross-Site Request Forgery (CSRF) (CWE-352)
value: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2021-12-01T11:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/index.php
Commit date: 2021-11-22 20:22:29 +0800
Commit message: Cookie security /Cookie 安全

Diff: diff --git a/server/index.php b/server/index.php
index 6f19bcc82..176d03cdc 100644
--- a/server/index.php
+++ b/server/index.php
@@ -6,10 +6,22 @@ define('COMPOSER_PHP_VERSION', '7.2.5' );
 if(version_compare(PHP_VERSION,COMPOSER_PHP_VERSION,'>')){
     // 增加自动加载
     require './vendor/autoload.php';
 }
 
+// cookie安全，给PHPSESSID加上Strict
+if (PHP_VERSION_ID >= 70300) {
+    session_set_cookie_params([
+        'samesite' => 'Strict'
+    ]);
+} else { 
+    session_set_cookie_params(
+        NULL,
+        '/; samesite=Strict',
+    );
+}
+
 // 开启调试模式 建议开发阶段开启 部署阶段注释或者设为false
 define('APP_DEBUG',True);
 
 // 定义应用目录
 define('APP_PATH','./Application/');

Fixed code: // cookie安全，给PHPSESSID加上Strict
if (PHP_VERSION_ID >= 70300) {
    session_set_cookie_params([
        'samesite' => 'Strict'
    ]);
} else { 
    session_set_cookie_params(
        NULL,
        '/; samesite=Strict',
    );
}
CVE-2022-0079: Generation of Error Message Containing Sensitive Information (CWE-209)
value: showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 5.3
Published: 2022-01-03T03:15Z
Repository: https://github.com/star7th/showdoc
Language: Unknown
Commit date: 2022-01-01 10:40:23 +0800
Commit message: Merge branch 'v2.10.0'
CVE-2022-0362: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL Injection in Packagist showdoc/showdoc prior to 2.10.3.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2022-01-26T13:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Controller/AdminUserController.class.php
Commit date: 2022-01-25 20:34:52 +0800
Commit message: bug

Diff: diff --git a/server/Application/Api/Controller/AdminUserController.class.php b/server/Application/Api/Controller/AdminUserController.class.php
index edf0f559c..9e966b8cd 100644
--- a/server/Application/Api/Controller/AdminUserController.class.php
+++ b/server/Application/Api/Controller/AdminUserController.class.php
@@ -74,11 +74,11 @@ class AdminUserController extends BaseController {
     public function addUser(){
         $login_user = $this->checkLogin();
         $this->checkAdmin();
         $username = I("post.username");
         $password = I("post.password");
-        $uid = I("post.uid");
+        $uid = I("post.uid/d");
         $name = I("post.name");
         if(!$username){
             $this->sendError(10101,'用户名不允许为空');
             return ;
         }

Vulnerable code:         $uid = I("post.uid");
Fixed code:         $uid = I("post.uid/d");
CVE-2022-0880: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-12T04:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-08 11:48:44 +0800
Commit message: file upload bug

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index 3d76105b8..d84898984 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -299,10 +299,11 @@ class AttachmentModel extends BaseModel {
 		if (
 			 $isDangerStr($filename , ".php")
 			|| $isDangerStr($filename , ".svg")
 			|| $isDangerStr($filename , ".htm")
 			|| $isDangerStr($filename , "%")
+			|| $isDangerStr($filename , ".xml")
 		) {
 			return true;
 		}
 	
 		return false;

Fixed code: 			|| $isDangerStr($filename , ".xml")
CVE-2022-0937: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-14T03:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-13 10:27:22 +0800
Commit message: file upload bug

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index d84898984..32fb24799 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -298,10 +298,11 @@ class AttachmentModel extends BaseModel {
 		};
 		if (
 			 $isDangerStr($filename , ".php")
 			|| $isDangerStr($filename , ".svg")
 			|| $isDangerStr($filename , ".htm")
+			|| $isDangerStr($filename , ".shtm")
 			|| $isDangerStr($filename , "%")
 			|| $isDangerStr($filename , ".xml")
 		) {
 			return true;
 		}

Fixed code: 			|| $isDangerStr($filename , ".shtm")
CVE-2022-0938: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-14T08:15Z
Repository: https://github.com/star7th/showdoc
Language: Unknown
Commit date: 2022-03-13 16:03:16 +0800
Commit message: Merge pull request #1628 from ajaysenr/master

Update AttachmentModel.class.php
CVE-2022-0940: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-14T11:15Z
Repository: https://github.com/star7th/showdoc
Language: Unknown
Commit date: 2022-03-13 18:39:59 +0800
Commit message: Merge pull request #1629 from ajaysenr/master

Update AttachmentModel.class.php
CVE-2022-0941: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-14T13:15Z
Repository: https://github.com/star7th/showdoc
Language: Unknown
Commit date: 2022-03-13 20:16:25 +0800
Commit message: Merge pull request #1630 from ajaysenr/master

Update AttachmentModel.class.php
CVE-2022-0942: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T14:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 23:26:49 +0800
Commit message: Upload file vulnerability

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index 965db2e60..b79090dc4 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -52,14 +52,14 @@ class AttachmentModel extends BaseModel {
 		return true ;
 
 	}
 
 	//上传文件，返回url
-	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
+	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
+		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
 			return false;
 		}
 
 		$oss_open = D("Options")->get("oss_open" ) ;
 		if ($oss_open) {
@@ -322,18 +322,16 @@ class AttachmentModel extends BaseModel {
 
 	// 判断上传的文件扩展名是否处于白名单内
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.mp4',
-			'.mov','.webmv','.flac','.mkv',
+			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
-			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.wps',
+			'.pdf','.epub','.xps','.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
 			'.cer','.ppt','.pub','.json','.css',
-			) ;
+		) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
 		if(in_array( $ext , $allow_array ) ){
 			return true ;
 		}

Vulnerable code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;
Fixed code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-0945: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T04:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 10:52:48 +0800
Commit message: bug

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index 3a41ecd99..b518b9b57 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -307,10 +307,12 @@ class AttachmentModel extends BaseModel {
 			|| $isDangerStr($filename , ".asp")			
 			|| $isDangerStr($filename , ".xsl")
 			|| $isDangerStr($filename , ".aspx")
 			|| $isDangerStr($filename , ".xsd")
 			|| $isDangerStr($filename , ".asa")
+			|| $isDangerStr($filename , ".cshtml")
+			|| $isDangerStr($filename , ".axd")
 		) {
 			return true;
 		}
 	
 		return false;

Fixed code: 			|| $isDangerStr($filename , ".cshtml")
			|| $isDangerStr($filename , ".axd")
CVE-2022-0946: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-14T14:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 13:07:40 +0800
Commit message: bug

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index b518b9b57..f7781533d 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -309,10 +309,11 @@ class AttachmentModel extends BaseModel {
 			|| $isDangerStr($filename , ".aspx")
 			|| $isDangerStr($filename , ".xsd")
 			|| $isDangerStr($filename , ".asa")
 			|| $isDangerStr($filename , ".cshtml")
 			|| $isDangerStr($filename , ".axd")
+			|| $isDangerStr($filename , "htm")
 		) {
 			return true;
 		}
 	
 		return false;

Fixed code: 			|| $isDangerStr($filename , "htm")
CVE-2022-0956: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T13:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 20:15:13 +0800
Commit message: file upload bug

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index 7f69b3cba..3ce94ceaf 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -327,11 +327,11 @@ class AttachmentModel extends BaseModel {
 			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
 			'.mov','.webmv','.m3u8a','.flac','.mkv',
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
 			'.pdf','.ofd','.swf','.epub','.xps',
 			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt',
-			'.ppt','.pptx','.xls','.xlsx','.txt','.md','.psd','.csv',
+			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
 			'.cer','.ppt','.pub','.properties','.json','.css',
 			) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
 		if(in_array( $ext , $allow_array ) ){

Vulnerable code: 			'.ppt','.pptx','.xls','.xlsx','.txt','.md','.psd','.csv',
Fixed code: 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
CVE-2022-0957: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T13:15Z
Repository: https://github.com/star7th/showdoc
Language: Unknown
Commit date: 2022-03-14 20:29:34 +0800
Commit message: Merge pull request #1632 from ajaysenr/master

Update AttachmentModel.class.php
CVE-2022-0960: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-14T15:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 22:36:28 +0800
Commit message: file upload bug

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index c1b62cf28..965db2e60 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -322,17 +322,17 @@ class AttachmentModel extends BaseModel {
 
 	// 判断上传的文件扩展名是否处于白名单内
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
+			'.mp3','.wav','.mp4',
 			'.mov','.webmv','.flac','.mkv',
-			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
+			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
 			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps',
+			'.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
-			'.cer','.ppt','.pub','.properties','.json','.css',
+			'.cer','.ppt','.pub','.json','.css',
 			) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
 		if(in_array( $ext , $allow_array ) ){
 			return true ;

Vulnerable code: 			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps',
			'.cer','.ppt','.pub','.properties','.json','.css',
Fixed code: 			'.mp3','.wav','.mp4',
			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
			'.doc','.docx','.wps',
			'.cer','.ppt','.pub','.json','.css',
CVE-2022-0962: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-14T16:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 23:26:49 +0800
Commit message: Upload file vulnerability

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index 965db2e60..b79090dc4 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -52,14 +52,14 @@ class AttachmentModel extends BaseModel {
 		return true ;
 
 	}
 
 	//上传文件，返回url
-	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
+	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
+		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
 			return false;
 		}
 
 		$oss_open = D("Options")->get("oss_open" ) ;
 		if ($oss_open) {
@@ -322,18 +322,16 @@ class AttachmentModel extends BaseModel {
 
 	// 判断上传的文件扩展名是否处于白名单内
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.mp4',
-			'.mov','.webmv','.flac','.mkv',
+			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
-			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.wps',
+			'.pdf','.epub','.xps','.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
 			'.cer','.ppt','.pub','.json','.css',
-			) ;
+		) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
 		if(in_array( $ext , $allow_array ) ){
 			return true ;
 		}

Vulnerable code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;
Fixed code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-0964: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T16:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 23:26:49 +0800
Commit message: Upload file vulnerability

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index 965db2e60..b79090dc4 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -52,14 +52,14 @@ class AttachmentModel extends BaseModel {
 		return true ;
 
 	}
 
 	//上传文件，返回url
-	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
+	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
+		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
 			return false;
 		}
 
 		$oss_open = D("Options")->get("oss_open" ) ;
 		if ($oss_open) {
@@ -322,18 +322,16 @@ class AttachmentModel extends BaseModel {
 
 	// 判断上传的文件扩展名是否处于白名单内
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.mp4',
-			'.mov','.webmv','.flac','.mkv',
+			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
-			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.wps',
+			'.pdf','.epub','.xps','.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
 			'.cer','.ppt','.pub','.json','.css',
-			) ;
+		) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
 		if(in_array( $ext , $allow_array ) ){
 			return true ;
 		}

Vulnerable code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;
Fixed code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-0965: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T16:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 23:26:49 +0800
Commit message: Upload file vulnerability

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index 965db2e60..b79090dc4 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -52,14 +52,14 @@ class AttachmentModel extends BaseModel {
 		return true ;
 
 	}
 
 	//上传文件，返回url
-	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
+	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
+		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
 			return false;
 		}
 
 		$oss_open = D("Options")->get("oss_open" ) ;
 		if ($oss_open) {
@@ -322,18 +322,16 @@ class AttachmentModel extends BaseModel {
 
 	// 判断上传的文件扩展名是否处于白名单内
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.mp4',
-			'.mov','.webmv','.flac','.mkv',
+			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
-			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.wps',
+			'.pdf','.epub','.xps','.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
 			'.cer','.ppt','.pub','.json','.css',
-			) ;
+		) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
 		if(in_array( $ext , $allow_array ) ){
 			return true ;
 		}

Vulnerable code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;
Fixed code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-0966: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T16:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 23:26:49 +0800
Commit message: Upload file vulnerability

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index 965db2e60..b79090dc4 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -52,14 +52,14 @@ class AttachmentModel extends BaseModel {
 		return true ;
 
 	}
 
 	//上传文件，返回url
-	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
+	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
+		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
 			return false;
 		}
 
 		$oss_open = D("Options")->get("oss_open" ) ;
 		if ($oss_open) {
@@ -322,18 +322,16 @@ class AttachmentModel extends BaseModel {
 
 	// 判断上传的文件扩展名是否处于白名单内
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.mp4',
-			'.mov','.webmv','.flac','.mkv',
+			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
-			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.wps',
+			'.pdf','.epub','.xps','.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
 			'.cer','.ppt','.pub','.json','.css',
-			) ;
+		) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
 		if(in_array( $ext , $allow_array ) ){
 			return true ;
 		}

Vulnerable code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;
Fixed code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-0967: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T16:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-03-14 23:26:49 +0800
Commit message: Upload file vulnerability

Diff: diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index 965db2e60..b79090dc4 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -52,14 +52,14 @@ class AttachmentModel extends BaseModel {
 		return true ;
 
 	}
 
 	//上传文件，返回url
-	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
+	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
+		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
 			return false;
 		}
 
 		$oss_open = D("Options")->get("oss_open" ) ;
 		if ($oss_open) {
@@ -322,18 +322,16 @@ class AttachmentModel extends BaseModel {
 
 	// 判断上传的文件扩展名是否处于白名单内
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.mp4',
-			'.mov','.webmv','.flac','.mkv',
+			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
-			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.wps',
+			'.pdf','.epub','.xps','.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
 			'.cer','.ppt','.pub','.json','.css',
-			) ;
+		) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
 		if(in_array( $ext , $allow_array ) ){
 			return true ;
 		}

Vulnerable code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;
Fixed code: 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-1711: Server-Side Request Forgery (SSRF) (CWE-918)
value: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.5
Published: 2022-05-17T13:15Z
Repository: https://github.com/jgraph/drawio
Language: Java
Files changed: src/main/java/com/mxgraph/online/ProxyServlet.java
Commit date: 2022-05-15 09:39:38 +0100
Commit message: Adds isLinkLocalAddress() to address checks
Diff: diff --git a/src/main/java/com/mxgraph/online/ProxyServlet.java b/src/main/java/com/mxgraph/online/ProxyServlet.java
index 99a88937f..7cc03353b 100644
--- a/src/main/java/com/mxgraph/online/ProxyServlet.java
+++ b/src/main/java/com/mxgraph/online/ProxyServlet.java
@@ -252,10 +252,11 @@ public class ProxyServlet extends HttpServlet
 				host = host.toLowerCase();
 
 				return (protocol.equals("http") || protocol.equals("https"))
 						&& !address.isAnyLocalAddress()
 						&& !address.isLoopbackAddress()
+						&& !address.isLinkLocalAddress()
 						&& !host.endsWith(".internal") // Redundant
 						&& !host.endsWith(".local") // Redundant
 						&& !host.contains("localhost") // Redundant
 						&& !hostAddress.startsWith("0.") // 0.0.0.0/8 
 						&& !hostAddress.startsWith("10.") // 10.0.0.0/8

Fixed code: 						&& !address.isLinkLocalAddress()
CVE-2022-1722: Server-Side Request Forgery (SSRF) (CWE-918)
value: SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 3.3
Published: 2022-05-16T15:15Z
Repository: https://github.com/jgraph/drawio
Language: Java
Files changed: src/main/java/com/mxgraph/online/ProxyServlet.java
Commit date: 2022-05-15 09:39:38 +0100
Commit message: Adds isLinkLocalAddress() to address checks
Diff: diff --git a/src/main/java/com/mxgraph/online/ProxyServlet.java b/src/main/java/com/mxgraph/online/ProxyServlet.java
index 99a88937f..7cc03353b 100644
--- a/src/main/java/com/mxgraph/online/ProxyServlet.java
+++ b/src/main/java/com/mxgraph/online/ProxyServlet.java
@@ -252,10 +252,11 @@ public class ProxyServlet extends HttpServlet
 				host = host.toLowerCase();
 
 				return (protocol.equals("http") || protocol.equals("https"))
 						&& !address.isAnyLocalAddress()
 						&& !address.isLoopbackAddress()
+						&& !address.isLinkLocalAddress()
 						&& !host.endsWith(".internal") // Redundant
 						&& !host.endsWith(".local") // Redundant
 						&& !host.contains("localhost") // Redundant
 						&& !hostAddress.startsWith("0.") // 0.0.0.0/8 
 						&& !hostAddress.startsWith("10.") // 10.0.0.0/8

Fixed code: 						&& !address.isLinkLocalAddress()