Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-20375: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization (loc) command to elogd.c.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-01-10T05:15Z
Repository: https://bitbucket.org/ritt/elog
Language: C
Files changed: src/elogd.c
Commit date: 2019-12-09 16:28:16 +0100
Commit message: Apply HTML escaping to "loc" command

Diff: diff --git a/src/elogd.c b/src/elogd.c
index 4d992607..21ee48e3 100755
--- a/src/elogd.c
+++ b/src/elogd.c
@@ -27128,12 +27128,14 @@ void interprete(char *lbook, char *path)
       strlcpy(command, getparam("jcmd"), sizeof(command));
 
    /* check for localization command */
    if (stricmp(command, "loc") == 0) {
       show_http_header(NULL, FALSE, NULL);
-      if (isparam("value") && *getparam("value"))
-         rsputs(loc(getparam("value")));
+      if (isparam("value") && *getparam("value")) {
+         strencode2(str, getparam("value"), sizeof(str));
+         rsputs(loc(str));
+      }
 
       /* dummy strings for JS-only translations */
       s = loc("Drop attachments here...");
       s = loc("Insert Timestamp");
       if (s)

Vulnerable code:       if (isparam("value") && *getparam("value"))
         rsputs(loc(getparam("value")));
Fixed code:       if (isparam("value") && *getparam("value")) {
         strencode2(str, getparam("value"), sizeof(str));
         rsputs(loc(str));
      }
CVE-2019-20376: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG document to elogd.c.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-01-10T05:15Z
Repository: https://bitbucket.org/ritt/elog
Language: C
Files changed: src/elogd.c
Commit date: 2019-12-09 16:48:20 +0100
Commit message: Serve SVG files as attachments only to avoid XSS vulnerabilities

Diff: diff --git a/src/elogd.c b/src/elogd.c
index 21ee48e3..0b8fc3c6 100755
--- a/src/elogd.c
+++ b/src/elogd.c
@@ -8414,11 +8414,21 @@ void send_file_direct(char *file_name) {
          strcpy(charset, DEFAULT_HTTP_CHARSET);
 
       if (filetype[i].ext[0]) {
          if (strncmp(filetype[i].type, "text", 4) == 0)
             rsprintf("Content-Type: %s;charset=%s\r\n", filetype[i].type, charset);
-         else
+         else if (strcmp(filetype[i].ext, ".SVG") == 0) {
+            rsprintf("Content-Type: %s\r\n", filetype[i].type);
+            if (strrchr(file_name, '/'))
+               strlcpy(str, strrchr(file_name, '/')+1, sizeof(str));
+            else
+               strlcpy(str, file_name, sizeof(str));
+            if (str[6] == '_' && str[13] == '_')
+               rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str+14);
+            else
+               rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str);
+         } else
             rsprintf("Content-Type: %s\r\n", filetype[i].type);
       } else if (is_ascii(file_name))
          rsprintf("Content-Type: text/plain;charset=%s\r\n", charset);
       else
          rsprintf("Content-Type: application/octet-stream;charset=%s\r\n", charset);

Vulnerable code:          else
Fixed code:          else if (strcmp(filetype[i].ext, ".SVG") == 0) {
            rsprintf("Content-Type: %s\r\n", filetype[i].type);
            if (strrchr(file_name, '/'))
               strlcpy(str, strrchr(file_name, '/')+1, sizeof(str));
            else
               strlcpy(str, file_name, sizeof(str));
            if (str[6] == '_' && str[13] == '_')
               rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str+14);
            else
               rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str);
         } else
CVE-2019-1010062: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2019-07-16T13:15Z
Repository: https://github.com/pluck-cms/pluck
Language: PHP
Files changed: data/inc/images.php
Commit date: 2018-04-08 09:00:13 -0400
Commit message: Fix issue #44. Thanks to Klaus.

Diff: diff --git a/data/inc/images.php b/data/inc/images.php
index 99791da..6f09d06 100644
--- a/data/inc/images.php
+++ b/data/inc/images.php
@@ -32,13 +32,17 @@ defined('IN_PLUCK') or exit('Access denied!');
 </div>
 <?php
 if (isset($_POST['submit'])) {
 	//Check if the file is JPG, PNG or GIF.
 	if (in_array($_FILES['imagefile']['type'], array('image/pjpeg', 'image/jpeg','image/png', 'image/gif'))) {
+		/* fix issue 44. Thanks to Klaus.  */
+        $imagewhitelist = array('jfif', '.png', '.jpg', '.gif', 'jpeg');  
+        if (!in_array(strtolower(substr($_FILES['imagefile']['name'], -4)), $imagewhitelist))
+			show_error($lang['general']['upload_failed'], 1);
+		/* end of fix issue 44. Thanks to Klaus.  */
 		if (!copy($_FILES['imagefile']['tmp_name'], 'images/'.$_FILES['imagefile']['name']))
 			show_error($lang['general']['upload_failed'], 1);
-
 		else {
 			chmod('images/'.$_FILES['imagefile']['name'], 0666);
 			?>
 				<div class="menudiv">
 					<strong><?php echo $lang['images']['name']; ?></strong> <?php echo $_FILES['imagefile']['name']; ?>

Fixed code: 		/* fix issue 44. Thanks to Klaus.  */
        $imagewhitelist = array('jfif', '.png', '.jpg', '.gif', 'jpeg');  
        if (!in_array(strtolower(substr($_FILES['imagefile']['name'], -4)), $imagewhitelist))
			show_error($lang['general']['upload_failed'], 1);
		/* end of fix issue 44. Thanks to Klaus.  */
CVE-2020-15569: Use After Free (CWE-416)
value: PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2020-07-06T14:15Z
Repository: https://github.com/milkytracker/MilkyTracker
Language: C++
Files changed: src/milkyplay/PlayerGeneric.cpp
Commit date: 2020-04-13 23:53:51 +0100
Commit message: Fix use-after-free in PlayerGeneric destructor

Diff: diff --git a/src/milkyplay/PlayerGeneric.cpp b/src/milkyplay/PlayerGeneric.cpp
index 8df2c13..59f7cba 100644
--- a/src/milkyplay/PlayerGeneric.cpp
+++ b/src/milkyplay/PlayerGeneric.cpp
@@ -200,19 +200,20 @@ PlayerGeneric::PlayerGeneric(mp_sint32 frequency, AudioDriverInterface* audioDri
 	}
 }
 	
 PlayerGeneric::~PlayerGeneric()
 {
-	if (mixer)
-		delete mixer;
 
 	if (player)
 	{
-		if (mixer->isActive() && !mixer->isDeviceRemoved(player))
+		if (mixer && mixer->isActive() && !mixer->isDeviceRemoved(player))
 			mixer->removeDevice(player);
 		delete player;
 	}
+	
+	if (mixer)
+		delete mixer;
 
 	delete[] audioDriverName;
 	
 	delete listener;
 }

Vulnerable code: 	if (mixer)
		delete mixer;
		if (mixer->isActive() && !mixer->isDeviceRemoved(player))
Fixed code: 		if (mixer && mixer->isActive() && !mixer->isDeviceRemoved(player))
	
	if (mixer)
		delete mixer;
CVE-2022-34927: Out-of-bounds Write (CWE-787)
value: MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is triggered when the program is supplied a crafted XM module file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-08-03T01:15Z
Repository: https://github.com/milkytracker/MilkyTracker
Language: C++
Files changed: src/milkyplay/LoaderXM.cpp
Commit date: 2022-06-26 17:53:59 +0200
Commit message: Fix possible stack corruption with XM instrument headers claiming a size of less than 4

Closes #275

Diff: diff --git a/src/milkyplay/LoaderXM.cpp b/src/milkyplay/LoaderXM.cpp
index f87f5c1..303e349 100644
--- a/src/milkyplay/LoaderXM.cpp
+++ b/src/milkyplay/LoaderXM.cpp
@@ -476,11 +476,11 @@ mp_sint32 LoaderXM::load(XMFileBase& f, XModule* module)
 		
 			//TXMInstrument* ins = &instr[y];
 		
 			f.readDwords(&instr[y].size,1);
 			
-			if (instr[y].size < 29)
+			if (instr[y].size >= 4 && instr[y].size < 29)
 			{
 				mp_ubyte buffer[29];
 				memset(buffer, 0, sizeof(buffer));
 				f.read(buffer, 1, instr[y].size - 4);
 				memcpy(instr[y].name, buffer, 22);

Vulnerable code: 			if (instr[y].size < 29)
Fixed code: 			if (instr[y].size >= 4 && instr[y].size < 29)
CVE-2019-19274: Out-of-bounds Read (CWE-125)
value: typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2019-11-26T15:15Z
Repository: https://github.com/python/cpython
Language: C
Files changed: Python/ast.c
Commit date: 2019-04-01 07:36:05 -0700
Commit message: bpo-36495: Fix two out-of-bounds array reads (GH-12641)

Research and fix by @bradlarsen.
Diff: diff --git a/Python/ast.c b/Python/ast.c
index e9154fecff0..913e53ad793 100644
--- a/Python/ast.c
+++ b/Python/ast.c
@@ -1398,11 +1398,11 @@ handle_keywordonly_args(struct compiling *c, const node *n, int start,
                           c->c_arena);
                 if (!arg)
                     goto error;
                 asdl_seq_SET(kwonlyargs, j++, arg);
                 i += 1; /* the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT:
                 /* arg will be equal to the last argument processed */
                 arg->type_comment = NEW_TYPE_COMMENT(ch);
@@ -1597,11 +1597,11 @@ ast_for_arguments(struct compiling *c, const node *n)
                 assert(TYPE(ch) == tfpdef || TYPE(ch) == vfpdef);
                 kwarg = ast_for_arg(c, ch);
                 if (!kwarg)
                     return NULL;
                 i += 2; /* the double star and the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT:
                 assert(i);
 

Vulnerable code:                 if (TYPE(CHILD(n, i)) == COMMA)
                if (TYPE(CHILD(n, i)) == COMMA)
Fixed code:                 if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
CVE-2019-19275: Out-of-bounds Read (CWE-125)
value: typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2019-11-26T15:15Z
Repository: https://github.com/python/cpython
Language: C
Files changed: Python/ast.c
Commit date: 2019-04-01 07:36:05 -0700
Commit message: bpo-36495: Fix two out-of-bounds array reads (GH-12641)

Research and fix by @bradlarsen.
Diff: diff --git a/Python/ast.c b/Python/ast.c
index e9154fecff0..913e53ad793 100644
--- a/Python/ast.c
+++ b/Python/ast.c
@@ -1398,11 +1398,11 @@ handle_keywordonly_args(struct compiling *c, const node *n, int start,
                           c->c_arena);
                 if (!arg)
                     goto error;
                 asdl_seq_SET(kwonlyargs, j++, arg);
                 i += 1; /* the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT:
                 /* arg will be equal to the last argument processed */
                 arg->type_comment = NEW_TYPE_COMMENT(ch);
@@ -1597,11 +1597,11 @@ ast_for_arguments(struct compiling *c, const node *n)
                 assert(TYPE(ch) == tfpdef || TYPE(ch) == vfpdef);
                 kwarg = ast_for_arg(c, ch);
                 if (!kwarg)
                     return NULL;
                 i += 2; /* the double star and the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT:
                 assert(i);
 

Vulnerable code:                 if (TYPE(CHILD(n, i)) == COMMA)
                if (TYPE(CHILD(n, i)) == COMMA)
Fixed code:                 if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
CVE-2024-0450: Insufficient Information (NVD-CWE-noinfo)
value: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.

The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.


CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-19T16:15Z
Repository: https://github.com/python/cpython
Language: Python
Files changed: Lib/test/test_zipfile/test_core.py
Commit date: 2024-01-10 15:56:40 +0000
Commit message: Add @requires_zlib() decorator for gh-109858 tests (GH-113918)


Diff: diff --git a/Lib/test/test_zipfile/test_core.py b/Lib/test/test_zipfile/test_core.py
index 41ce81a9d08c..f7b6db465b4b 100644
--- a/Lib/test/test_zipfile/test_core.py
+++ b/Lib/test/test_zipfile/test_core.py
@@ -2270,10 +2270,11 @@ def test_decompress_without_3rd_party_library(self):
             zf.writestr('a.txt', b'a')
         with mock.patch('zipfile.bz2', None):
             with zipfile.ZipFile(zip_file) as zf:
                 self.assertRaises(RuntimeError, zf.extract, 'a.txt')
 
+    @requires_zlib()
     def test_full_overlap(self):
         data = (
             b'PK\x03\x04\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2\x1e'
             b'8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00a\xed'
             b'\xc0\x81\x08\x00\x00\x00\xc00\xd6\xfbK\\d\x0b`P'
@@ -2298,10 +2299,11 @@ def test_full_overlap(self):
             self.assertEqual(zi.file_size, 1033)
             self.assertEqual(len(zipf.read('a')), 1033)
             with self.assertRaisesRegex(zipfile.BadZipFile, 'File name.*differ'):
                 zipf.read('b')
 
+    @requires_zlib()
     def test_quoted_overlap(self):
         data = (
             b'PK\x03\x04\x14\x00\x00\x00\x08\x00\xa0lH\x05Y\xfc'
             b'8\x044\x00\x00\x00(\x04\x00\x00\x01\x00\x00\x00a\x00'
             b'\x1f\x00\xe0\xffPK\x03\x04\x14\x00\x00\x00\x08\x00\xa0l'

Fixed code:     @requires_zlib()
    @requires_zlib()
CVE-2024-21520: Insufficient Information (NVD-CWE-noinfo)
value: Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-26T05:15Z
Repository: https://github.com/encode/django-rest-framework
Language: Python
Files changed: rest_framework/templatetags/rest_framework.py
Commit date: 2024-06-14 10:52:02 +0100
Commit message: Fix potential XSS vulnerability in break_long_headers template filter (#9435)

The header input is now properly escaped before splitting and joining with <br> tags. This prevents potential XSS attacks if the header contains unsanitized user input.
Diff: diff --git a/rest_framework/templatetags/rest_framework.py b/rest_framework/templatetags/rest_framework.py
index e01568cf2..dba8153b1 100644
--- a/rest_framework/templatetags/rest_framework.py
+++ b/rest_framework/templatetags/rest_framework.py
@@ -320,7 +320,7 @@ def break_long_headers(header):
     """
     Breaks headers longer than 160 characters (~page length)
     when possible (are comma separated)
     """
     if len(header) > 160 and ',' in header:
-        header = mark_safe('<br> ' + ', <br>'.join(header.split(',')))
+        header = mark_safe('<br> ' + ', <br>'.join(escape(header).split(',')))
     return header

Vulnerable code:         header = mark_safe('<br> ' + ', <br>'.join(header.split(',')))
Fixed code:         header = mark_safe('<br> ' + ', <br>'.join(escape(header).split(',')))
CVE-2016-15023: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getextension.php of the component Extension Handler. The manipulation leads to path traversal. Upgrading to version 6.6.7 is able to address this issue. The identifier of the patch is 49fff155c303d6cd06ce8f97bba56c9084bf08ac. It is recommended to upgrade the affected component. The identifier VDB-219765 was assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2023-01-31T20:15Z
Repository: https://github.com/sitefusion/server
Language: Other
Files changed: VERSION, www/getextension.php
Commit date: 2016-03-09 11:48:27 +0100
Commit message: Fixed vulnerability in getextension.php that allowed reading files outside of the extension directory.

Diff: diff --git a/VERSION b/VERSION
index 10abd6a..5db1411 100755
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-6.6.6
+6.6.7
diff --git a/www/getextension.php b/www/getextension.php
index baede07..f2d5e67 100755
--- a/www/getextension.php
+++ b/www/getextension.php
@@ -34,11 +34,14 @@ ob_implicit_flush();
 
 include( '../conf/webfrontend.conf' );
 include( 'functions.php' );
 
 $extension = $_GET['extension'];
-if( strpos($extension,'/') || strpos($extension,"\\") or !file_exists($path = $WEBCONFIG['sitefusionPath'].'/extensions/'.$extension) ) {
+$allowedRoot = realpath($WEBCONFIG['sitefusionPath'].'/extensions');
+$path = realpath($allowedRoot.'/'.$extension);
+
+if (!(substr($path, 0, strlen($allowedRoot)) == $allowedRoot && file_exists($path))) {
 	echo "Invalid extension: $extension";
 	exit(1);
 }
 
 header( 'Content-type: application/octet-stream' );

Vulnerable code: 6.6.6
if( strpos($extension,'/') || strpos($extension,"\\") or !file_exists($path = $WEBCONFIG['sitefusionPath'].'/extensions/'.$extension) ) {
Fixed code: 6.6.7
$allowedRoot = realpath($WEBCONFIG['sitefusionPath'].'/extensions');
$path = realpath($allowedRoot.'/'.$extension);

if (!(substr($path, 0, strlen($allowedRoot)) == $allowedRoot && file_exists($path))) {
CVE-2016-10524: Uncontrolled Resource Consumption (CWE-400)
value: i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of Service or content injection.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 8.2
Published: 2018-05-31T20:29Z
Repository: https://github.com/oliversalzburg/i18n-node-angular
Language: JavaScript
Files changed: i18n-node-routes.js
Commit date: 2016-01-07 09:40:02 +0100
Commit message: [FIX] Only register translate route during development

Diff: diff --git a/i18n-node-routes.js b/i18n-node-routes.js
index 0083412..cfe0b1a 100644
--- a/i18n-node-routes.js
+++ b/i18n-node-routes.js
@@ -47,11 +47,14 @@ var configure = function( app, configObject ) {
 		configuration.objectNotation = configObject.objectNotation || configuration.objectNotation;
 	}
 
 	// Register routes
 	app.get( "/i18n/:locale", i18nRoutes.i18n );
-	app.get( "/i18n/:locale/:phrase", i18nRoutes.translate );
+
+	if( process.env.NODE_ENV === "development" ) {
+		app.get( "/i18n/:locale/:phrase", i18nRoutes.translate );
+	}
 };
 
 /**
  * Middleware to allow retrieval of users locale in the template engine.
  * @param {Object} request

Vulnerable code: 	app.get( "/i18n/:locale/:phrase", i18nRoutes.translate );
Fixed code: 
	if( process.env.NODE_ENV === "development" ) {
		app.get( "/i18n/:locale/:phrase", i18nRoutes.translate );
	}
CVE-2021-42917: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 5.5
Published: 2021-11-01T19:15Z
Repository: https://github.com/fuzzard/xbmc
Language: C++
Files changed: xbmc/playlists/PlayListPLS.cpp
Commit date: 2021-10-12 17:42:52 +1000
Commit message: [Playlist] dont use istream directly to a tinyxml structure

Turn istream into a std::string to handle large buffers (#20305)

Diff: diff --git a/xbmc/playlists/PlayListPLS.cpp b/xbmc/playlists/PlayListPLS.cpp
index bc62a1fe7a..17d6e491d2 100644
--- a/xbmc/playlists/PlayListPLS.cpp
+++ b/xbmc/playlists/PlayListPLS.cpp
@@ -287,21 +287,25 @@ bool CPlayListASX::LoadData(std::istream& stream)
   {
     return LoadAsxIniInfo(stream);
   }
   else
   {
+    std::string asxstream(std::istreambuf_iterator<char>(stream), {});
     CXBMCTinyXML xmlDoc;
-    stream >> xmlDoc;
+    xmlDoc.Parse(asxstream, TIXML_DEFAULT_ENCODING);
 
     if (xmlDoc.Error())
     {
       CLog::Log(LOGERROR, "Unable to parse ASX info Error: {}", xmlDoc.ErrorDesc());
       return false;
     }
 
     TiXmlElement *pRootElement = xmlDoc.RootElement();
 
+    if (!pRootElement)
+      return false;
+
     // lowercase every element
     TiXmlNode *pNode = pRootElement;
     TiXmlNode *pChild = NULL;
     std::string value;
     value = pNode->Value();

Vulnerable code:     stream >> xmlDoc;
Fixed code:     std::string asxstream(std::istreambuf_iterator<char>(stream), {});
    xmlDoc.Parse(asxstream, TIXML_DEFAULT_ENCODING);
    if (!pRootElement)
      return false;
CVE-2020-14163: Out-of-bounds Read (CWE-125)
value: An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0. Operations with key/value pairs did not consider the case where garbage collection is triggered after the key operation but before the value operation, as demonstrated by improper read access to memory in ecma_gc_set_object_visited in ecma/base/ecma-gc.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2020-06-15T21:15Z
Repository: https://github.com/jerryscript-project/jerryscript
Language: C
Files changed: jerry-core/ecma/operations/ecma-container-object.c
Commit date: 2020-05-28 07:55:16 +0200
Commit message: Fix adding entries to the internal buffer of a Map object (#3805)

When appending the key/value pair separately, garbage collection could be
triggered before the value is added, which could cause problems during
marking. This patch changes insertion to add both values at the same
time, which prevents partial entries from being present in the internal
buffer.

Fixes #3804.

JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai@inf.u-szeged.hu
Diff: diff --git a/jerry-core/ecma/operations/ecma-container-object.c b/jerry-core/ecma/operations/ecma-container-object.c
index 0dadc5ce5..0732c0235 100644
--- a/jerry-core/ecma/operations/ecma-container-object.c
+++ b/jerry-core/ecma/operations/ecma-container-object.c
@@ -62,15 +62,18 @@ ecma_op_internal_buffer_append (ecma_collection_t *container_p, /**< internal co
                                 ecma_value_t value_arg, /**< value argument */
                                 lit_magic_string_id_t lit_id) /**< class id */
 {
   JERRY_ASSERT (container_p != NULL);
 
-  ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));
-
   if (lit_id == LIT_MAGIC_STRING_WEAKMAP_UL || lit_id == LIT_MAGIC_STRING_MAP_UL)
   {
-    ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (value_arg));
+    ecma_value_t values[] = { ecma_copy_value_if_not_object (key_arg), ecma_copy_value_if_not_object (value_arg) };
+    ecma_collection_append (container_p, values, 2);
+  }
+  else
+  {
+    ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));
   }
 
   ECMA_CONTAINER_SET_SIZE (container_p, ECMA_CONTAINER_GET_SIZE (container_p) + 1);
 } /* ecma_op_internal_buffer_append */
 

Vulnerable code:   ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));

    ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (value_arg));
Fixed code:     ecma_value_t values[] = { ecma_copy_value_if_not_object (key_arg), ecma_copy_value_if_not_object (value_arg) };
    ecma_collection_append (container_p, values, 2);
  }
  else
  {
    ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));
CVE-2020-26947: Uncontrolled Search Path Element (CWE-427)
value: monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which allows local users to gain privileges via a Trojan horse library in the current working directory.
CWE description: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CVSS v3 base score: 7.8
Published: 2020-10-10T21:15Z
Repository: https://github.com/monero-project/monero-gui
Language: Other
Files changed: CMakeLists.txt
Commit date: 2020-10-11 19:51:05 +0000
Commit message: cmake: set CMAKE_SKIP_RPATH on Linux to fix empty RPATH token issue

Diff: diff --git a/CMakeLists.txt b/CMakeLists.txt
index a88f13c4..087d46c7 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -173,10 +173,11 @@ find_package(Boost 1.58 REQUIRED COMPONENTS
 		serialization
 		program_options
 		locale)
 
 if(UNIX AND NOT APPLE)
+    set(CMAKE_SKIP_RPATH ON)
     find_package(X11 REQUIRED)
     message(STATUS "X11_FOUND = ${X11_FOUND}")
     message(STATUS "X11_INCLUDE_DIR = ${X11_INCLUDE_DIR}")
     message(STATUS "X11_LIBRARIES = ${X11_LIBRARIES}")
     include_directories(${X11_INCLUDE_DIR})

Fixed code:     set(CMAKE_SKIP_RPATH ON)
CVE-2020-36631: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to sql injection. The attack can be initiated remotely. The name of the patch is f70eb21394f75019886fbc2fb536de36161ba422. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216772.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2022-12-25T20:15Z
Repository: https://github.com/barronwaffles/dwc_network_server_emulator
Language: Unknown
Commit date: 2020-07-11 13:57:16 +1200
Commit message: Merge pull request #538 from InvoxiPlayGames/master

Fix SQL injection
CVE-2021-39157: Improper Handling of Exceptional Conditions (CWE-755)
value: detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in [detect-character-encoding v0.7.0](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.7.0). No workaround are available and all users should update to resolve this issue.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 7.5
Published: 2021-08-24T19:15Z
Repository: https://github.com/sonicdoe/detect-character-encoding
Language: C++
Files changed: README.md, icuWrapper.cpp, test/index.js
Commit date: 2018-11-06 19:10:49 +0100
Commit message: Return null if no charset matches

Fixes a segmentation fault if no charset matches. According to http://icu-project.org/apiref/icu4c/ucsdet_8h.html#aff2633b5055d472cff4108d94f97cf7d, ucsdet_detect() may return NULL if no charset matches.

Fixes: #15
Co-authored-by: chenzhip <letme2010@gmail.com>

Diff: diff --git a/README.md b/README.md
index 80ace35..7cf48de 100644
--- a/README.md
+++ b/README.md
@@ -25,10 +25,12 @@ console.log(charsetMatch);
 //   encoding: 'UTF-8',
 //   confidence: 60
 // }
 ```
 
+detect-character-encoding may return `null` if no charset matches.
+
 ## Supported operating systems
 
 - macOS High Sierra
 - Ubuntu 18.04, 16.04, and 14.04
 - Debian 9 and 8
diff --git a/icuWrapper.cpp b/icuWrapper.cpp
index a228fe0..78282d5 100644
--- a/icuWrapper.cpp
+++ b/icuWrapper.cpp
@@ -38,10 +38,16 @@ NAN_METHOD(DetectCharacterEncoding) {
 		Nan::ThrowError("Failed to detect charset.");
 		ucsdet_close(charsetDetector);
 		return;
 	}
 
+	if(charsetMatch == NULL) {
+		info.GetReturnValue().Set(Nan::Null());
+		ucsdet_close(charsetDetector);
+		return;
+	}
+
 	const char *charsetName = ucsdet_getName(charsetMatch, &errorCode);
 
 	if(U_FAILURE(errorCode)) {
 		Nan::ThrowError("Failed to get name from charset match.");
 		ucsdet_close(charsetDetector);
diff --git a/test/index.js b/test/index.js
index ea484e6..a955479 100644
--- a/test/index.js
+++ b/test/index.js
@@ -16,10 +16,14 @@ it('should return the encoding', () => {
 
 it('should return a confidence value', () => {
 	assert(typeof detectCharacterEncoding(getFixture('utf-8.txt')).confidence === 'number');
 });
 
+it('should return null if no charset matches', () => {
+	assert.strictEqual(detectCharacterEncoding(Buffer.from([0xAB])), null);
+});
+
 it('should throw a TypeError if argument is not a buffer', () => {
 	assert.throws(() => {
 		detectCharacterEncoding('string');
 	}, TypeError);
 });

Fixed code: detect-character-encoding may return `null` if no charset matches.

	if(charsetMatch == NULL) {
		info.GetReturnValue().Set(Nan::Null());
		ucsdet_close(charsetDetector);
		return;
	}

it('should return null if no charset matches', () => {
	assert.strictEqual(detectCharacterEncoding(Buffer.from([0xAB])), null);
});
CVE-2021-39176: Missing Release of Memory after Effective Lifetime (CWE-401)
value: detect-character-encoding is a package for detecting character encoding using ICU. In detect-character-encoding v0.3.0 and earlier, allocated memory is not released. The problem has been patched in detect-character-encoding v0.3.1.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2021-08-31T18:15Z
Repository: https://github.com/sonicdoe/detect-character-encoding
Language: C++
Files changed: icuWrapper.cpp
Commit date: 2017-03-10 12:24:00 +0100
Commit message: Fix memory leak by properly closing `charsetDetector`

Diff: diff --git a/icuWrapper.cpp b/icuWrapper.cpp
index 440e01e..a228fe0 100644
--- a/icuWrapper.cpp
+++ b/icuWrapper.cpp
@@ -26,39 +26,44 @@ NAN_METHOD(DetectCharacterEncoding) {
 		&errorCode
 	);
 
 	if(U_FAILURE(errorCode)) {
 		Nan::ThrowError("Failed to set ICU charset detector’s text.");
+		ucsdet_close(charsetDetector);
 		return;
 	}
 
 	charsetMatch = ucsdet_detect(charsetDetector, &errorCode);
 
 	if(U_FAILURE(errorCode)) {
 		Nan::ThrowError("Failed to detect charset.");
+		ucsdet_close(charsetDetector);
 		return;
 	}
 
 	const char *charsetName = ucsdet_getName(charsetMatch, &errorCode);
 
 	if(U_FAILURE(errorCode)) {
 		Nan::ThrowError("Failed to get name from charset match.");
+		ucsdet_close(charsetDetector);
 		return;
 	}
 
 	int32_t confidence = ucsdet_getConfidence(charsetMatch, &errorCode);
 
 	if(U_FAILURE(errorCode)) {
 		Nan::ThrowError("Failed to get confidence from charset match.");
+		ucsdet_close(charsetDetector);
 		return;
 	}
 
 	v8::Local<v8::Object> obj = Nan::New<v8::Object>();
 	obj->Set(Nan::New<v8::String>("encoding").ToLocalChecked(), Nan::New<v8::String>(charsetName).ToLocalChecked());
 	obj->Set(Nan::New<v8::String>("confidence").ToLocalChecked(), Nan::New<v8::Number>(confidence));
 
 	info.GetReturnValue().Set(obj);
+	ucsdet_close(charsetDetector);
 }
 
 void Init(v8::Local<v8::Object> exports) {
 	exports->Set(Nan::New<v8::String>("detectCharacterEncoding").ToLocalChecked(),
 		Nan::New<v8::FunctionTemplate>(DetectCharacterEncoding)->GetFunction());

Fixed code: 		ucsdet_close(charsetDetector);
		ucsdet_close(charsetDetector);
		ucsdet_close(charsetDetector);
		ucsdet_close(charsetDetector);
	ucsdet_close(charsetDetector);
CVE-2020-26244: Improper Verification of Cryptographic Signature (CWE-347)
value: Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 6.8
Published: 2020-12-02T20:15Z
Repository: https://github.com/OpenIDC/pyoidc
Language: Unknown
Commit date: 2020-12-01 11:22:03 +0100
Commit message: Merge pull request from GHSA-4fjv-pmhg-3rfg

Cve 2020 26244
CVE-2015-10085: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability was found in GoPistolet. It has been declared as problematic. This vulnerability affects unknown code of the component MTA. The manipulation leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as b91aa4674d460993765884e8463c70e6d886bc90. It is recommended to apply a patch to fix this issue. VDB-221506 is the identifier assigned to this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-02-21T18:15Z
Repository: https://github.com/gopistolet/gopistolet
Language: Unknown
Commit date: 2015-10-27 18:44:15 +0100
Commit message: Merge pull request #27 from gopistolet/ddos

Use ReadUntill to protect against ddos.
CVE-2024-1739: Incorrect Synchronization (CWE-821)
value: lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.
CWE description: The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.
Published: 2024-04-16T00:15Z
Repository: https://github.com/lunary-ai/lunary
Language: TypeScript
Files changed: packages/backend/src/api/v1/auth/index.ts
Commit date: 2024-02-22 09:15:24 -0300
Commit message: fix: case sensitivity for existing user verification

Diff: diff --git a/packages/backend/src/api/v1/auth/index.ts b/packages/backend/src/api/v1/auth/index.ts
index 6a2d829b..b948c6f7 100644
--- a/packages/backend/src/api/v1/auth/index.ts
+++ b/packages/backend/src/api/v1/auth/index.ts
@@ -38,11 +38,11 @@ auth.post("/signup", async (ctx: Context) => {
     ctx.throw(403, "Bad request")
     return
   }
 
   const [existingUser] = await sql`
-    select * from account where email = ${email}
+    select * from account where lower(email) = lower(${email})
   `
   if (existingUser) {
     ctx.throw(403, "User already exists")
   }
 

Vulnerable code:     select * from account where email = ${email}
Fixed code:     select * from account where lower(email) = lower(${email})
CVE-2024-1741: Improper Authorization (CWE-285)
value: lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Published: 2024-04-10T17:15Z
Repository: https://github.com/lunary-ai/lunary
Language: TypeScript
Files changed: packages/backend/src/api/v1/auth/utils.ts
Commit date: 2024-04-10 15:17:46 -0300
Commit message: feat: jwt invalidation (#197)


Diff: diff --git a/packages/backend/src/api/v1/auth/utils.ts b/packages/backend/src/api/v1/auth/utils.ts
index 46cea43d..a78ed891 100644
--- a/packages/backend/src/api/v1/auth/utils.ts
+++ b/packages/backend/src/api/v1/auth/utils.ts
@@ -124,14 +124,11 @@ export async function authMiddleware(ctx: Context, next: Next) {
     return
   }
   // Check if API key is valid
   // Support passing as bearer because legacy SDKs did that
   else if (validateUUID(key)) {
-    console.log("key", key)
-
     const { type, projectId, orgId } = await checkApiKey(ctx, key as string)
-    console.log({ type, projectId, orgId })
 
     ctx.state.projectId = projectId
     ctx.state.orgId = orgId
 
     if (type === "public" && !isPublicRoute) {
@@ -150,16 +147,22 @@ export async function authMiddleware(ctx: Context, next: Next) {
       const { payload } = await verifyJwt<SessionData>(key)
 
       ctx.state.userId = payload.userId
       ctx.state.orgId = payload.orgId
 
+      const [user] =
+        await sql`select * from account where id = ${ctx.state.userId}`
+      if (!user) {
+        ctx.throw(401, "This account no longer exists")
+      }
+
       if (ctx.state.projectId) {
         // Check if user has access to project
 
         const [project] = await sql`
-        select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
-      `
+          select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
+        `
 
         if (!project) {
           throw new Error("Project not found")
         }
       }

Vulnerable code:     console.log("key", key)

    console.log({ type, projectId, orgId })
        select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
      `
Fixed code:       const [user] =
        await sql`select * from account where id = ${ctx.state.userId}`
      if (!user) {
        ctx.throw(401, "This account no longer exists")
      }

          select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
        `
CVE-2024-1902: Insufficient Information (NVD-CWE-noinfo)
value: lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker can exploit this by using an old authorization token to send a PATCH request, modifying the organization's name even after being removed from the organization. This issue is due to incorrect synchronization and affects the orgs.patch route.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-10T17:15Z
Repository: https://github.com/lunary-ai/lunary
Language: TypeScript
Files changed: packages/backend/src/api/v1/auth/utils.ts
Commit date: 2024-04-10 15:17:46 -0300
Commit message: feat: jwt invalidation (#197)


Diff: diff --git a/packages/backend/src/api/v1/auth/utils.ts b/packages/backend/src/api/v1/auth/utils.ts
index 46cea43d..a78ed891 100644
--- a/packages/backend/src/api/v1/auth/utils.ts
+++ b/packages/backend/src/api/v1/auth/utils.ts
@@ -124,14 +124,11 @@ export async function authMiddleware(ctx: Context, next: Next) {
     return
   }
   // Check if API key is valid
   // Support passing as bearer because legacy SDKs did that
   else if (validateUUID(key)) {
-    console.log("key", key)
-
     const { type, projectId, orgId } = await checkApiKey(ctx, key as string)
-    console.log({ type, projectId, orgId })
 
     ctx.state.projectId = projectId
     ctx.state.orgId = orgId
 
     if (type === "public" && !isPublicRoute) {
@@ -150,16 +147,22 @@ export async function authMiddleware(ctx: Context, next: Next) {
       const { payload } = await verifyJwt<SessionData>(key)
 
       ctx.state.userId = payload.userId
       ctx.state.orgId = payload.orgId
 
+      const [user] =
+        await sql`select * from account where id = ${ctx.state.userId}`
+      if (!user) {
+        ctx.throw(401, "This account no longer exists")
+      }
+
       if (ctx.state.projectId) {
         // Check if user has access to project
 
         const [project] = await sql`
-        select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
-      `
+          select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
+        `
 
         if (!project) {
           throw new Error("Project not found")
         }
       }

Vulnerable code:     console.log("key", key)

    console.log({ type, projectId, orgId })
        select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
      `
Fixed code:       const [user] =
        await sql`select * from account where id = ${ctx.state.userId}`
      if (!user) {
        ctx.throw(401, "This account no longer exists")
      }

          select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
        `
CVE-2024-3504: Insufficient Information (NVD-CWE-noinfo)
value: An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-06T18:15Z
Repository: https://github.com/lunary-ai/lunary
Language: TypeScript
Files changed: packages/backend/src/api/v1/users.ts
Commit date: 2024-04-08 23:06:11 -0300
Commit message: fix: set user to owner (#183)


Diff: diff --git a/packages/backend/src/api/v1/users.ts b/packages/backend/src/api/v1/users.ts
index 4891be64..ad1e764d 100644
--- a/packages/backend/src/api/v1/users.ts
+++ b/packages/backend/src/api/v1/users.ts
@@ -267,10 +267,13 @@ users.patch(
     const { userId } = ctx.params
     const { userId: currentUserId } = ctx.state
 
     const { projects, role } = UpdateUserSchema.parse(ctx.request.body)
 
+    if (role === "owner") {
+      ctx.throw(403, "You cannot modify the owner role")
+    }
     const [currentUser] =
       await sql`select * from account where id = ${currentUserId}`
     if (!["owner", "admin"].includes(currentUser.role)) {
       ctx.throw(403, "You do not have permission to modify this user")
     }

Fixed code:     if (role === "owner") {
      ctx.throw(403, "You cannot modify the owner role")
    }