Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-18313: Out-of-bounds Read (CWE-125)
value: Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2018-12-07T21:29Z
Repository: https://github.com/Perl/perl5
Language: C
Files changed: regcomp.c
Commit date: 2017-11-06 14:31:45 -0700
Commit message: regcomp.c: Convert some strchr to memchr

This allows things to work properly in the face of embedded NULs.
See the branch merge message for more information.

Diff: diff --git a/regcomp.c b/regcomp.c
index 892aed82cd..9aec81ddfa 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -12054,11 +12054,11 @@ S_grok_bslash_N(pTHX_ RExC_state_t *pRExC_state,
 	vFAIL("Missing braces on \\N{}");
     }
 
     RExC_parse++;	/* Skip past the '{' */
 
-    endbrace = strchr(RExC_parse, '}');
+    endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
     if (! endbrace) { /* no trailing brace */
         vFAIL2("Missing right brace on \\%c{}", 'N');
     }
     else if (!(   endbrace == RExC_parse	/* nothing between the {} */
                || memBEGINs(RExC_parse,   /* U+ (bad hex is checked below
@@ -12771,13 +12771,15 @@ S_regatom(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, U32 depth)
                 }
             }
             else {
                 STRLEN length;
                 char name = *RExC_parse;
-                char * endbrace;
+                char * endbrace = NULL;
                 RExC_parse += 2;
-                endbrace = strchr(RExC_parse, '}');
+                if (RExC_parse < RExC_end) {
+                    endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
+                }
 
                 if (! endbrace) {
                     vFAIL2("Missing right brace on \\%c{}", name);
                 }
                 /* XXX Need to decide whether to take spaces or not.  Should be
@@ -16310,11 +16312,11 @@ S_regclass(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, U32 depth,
 
 		if (RExC_parse >= RExC_end)
 		    vFAIL2("Empty \\%c", (U8)value);
 		if (*RExC_parse == '{') {
 		    const U8 c = (U8)value;
-		    e = strchr(RExC_parse, '}');
+		    e = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
                     if (!e) {
                         RExC_parse++;
                         vFAIL2("Missing right brace on \\%c{}", c);
                     }
 

Vulnerable code:     endbrace = strchr(RExC_parse, '}');
                char * endbrace;
                endbrace = strchr(RExC_parse, '}');
		    e = strchr(RExC_parse, '}');
Fixed code:     endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
                char * endbrace = NULL;
                if (RExC_parse < RExC_end) {
                    endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
                }
		    e = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
CVE-2021-36770: Uncontrolled Search Path Element (CWE-427)
value: Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
CWE description: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CVSS v3 base score: 7.8
Published: 2021-08-11T23:15Z
Repository: https://github.com/Perl/perl5
Language: Perl
Files changed: cpan/Encode/Encode.pm
Commit date: 2021-08-09 08:24:42 -0400
Commit message: Encode.pm: apply a local patch for CVE-2021-36770

I expect Encode to see a new release today.

Without this fix, Encode::ConfigLocal can be loaded from a path relative
to the current directory, because the || operator will evaluate @INC in
scalar context, putting an integer as the only value in @INC.

Diff: diff --git a/cpan/Encode/Encode.pm b/cpan/Encode/Encode.pm
index a56a99947f..b96a850416 100644
--- a/cpan/Encode/Encode.pm
+++ b/cpan/Encode/Encode.pm
@@ -5,11 +5,12 @@ package Encode;
 use strict;
 use warnings;
 use constant DEBUG => !!$ENV{PERL_ENCODE_DEBUG};
 our $VERSION;
 BEGIN {
-    $VERSION = sprintf "%d.%02d", q$Revision: 3.10 $ =~ /(\d+)/g;
+    $VERSION = "3.10_01";
+    $VERSION = eval $VERSION;
     require XSLoader;
     XSLoader::load( __PACKAGE__, $VERSION );
 }
 
 use Exporter 5.57 'import';
@@ -63,12 +64,12 @@ require Encode::Config;
 #  https://bugzilla.redhat.com/show_bug.cgi?id=435505#c2
 #  to find why sig handlers inside eval{} are disabled.
 eval {
     local $SIG{__DIE__};
     local $SIG{__WARN__};
-    local @INC = @INC || ();
-    pop @INC if $INC[-1] eq '.';
+    local @INC = @INC;
+    pop @INC if @INC && $INC[-1] eq '.';
     require Encode::ConfigLocal;
 };
 
 sub encodings {
     my %enc;

Vulnerable code:     $VERSION = sprintf "%d.%02d", q$Revision: 3.10 $ =~ /(\d+)/g;
    local @INC = @INC || ();
    pop @INC if $INC[-1] eq '.';
Fixed code:     $VERSION = "3.10_01";
    $VERSION = eval $VERSION;
    local @INC = @INC;
    pop @INC if @INC && $INC[-1] eq '.';
CVE-2020-36565: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2022-12-07T17:15Z
Repository: https://github.com/labstack/echo
Language: Unknown
Commit date: 2020-12-15 16:31:52 +0100
Commit message: Merge pull request #1718 from little-cui/master

Fix static directory traversal security vulnerability for Windows
CVE-2021-4294: Observable Discrepancy (CWE-203)
value: A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.9
Published: 2022-12-28T17:15Z
Repository: https://github.com/openshift/osin
Language: Go
Files changed: client.go, util.go
Commit date: 2021-01-13 13:41:01 +0100
Commit message: Use constant time comparisons for client secrets

This is a precaution to avoid possible timing attacks on
client secrets.

Diff: diff --git a/client.go b/client.go
index f32a038..f4e0a24 100644
--- a/client.go
+++ b/client.go
@@ -1,7 +1,9 @@
 package osin
 
+import "crypto/subtle"
+
 // Client information
 type Client interface {
 	// Client id
 	GetId() string
 
@@ -47,11 +49,11 @@ func (d *DefaultClient) GetUserData() interface{} {
 	return d.UserData
 }
 
 // Implement the ClientSecretMatcher interface
 func (d *DefaultClient) ClientSecretMatches(secret string) bool {
-	return d.Secret == secret
+	return subtle.ConstantTimeCompare([]byte(d.Secret), []byte(secret)) == 1
 }
 
 func (d *DefaultClient) CopyFrom(client Client) {
 	d.Id = client.GetId()
 	d.Secret = client.GetSecret()
diff --git a/util.go b/util.go
index a630998..d44efb0 100644
--- a/util.go
+++ b/util.go
@@ -1,8 +1,9 @@
 package osin
 
 import (
+	"crypto/subtle"
 	"encoding/base64"
 	"errors"
 	"net/http"
 	"net/url"
 	"strings"
@@ -26,11 +27,11 @@ func CheckClientSecret(client Client, secret string) bool {
 	case ClientSecretMatcher:
 		// Prefer the more secure method of giving the secret to the client for comparison
 		return client.ClientSecretMatches(secret)
 	default:
 		// Fallback to the less secure method of extracting the plain text secret from the client for comparison
-		return client.GetSecret() == secret
+		return subtle.ConstantTimeCompare([]byte(client.GetSecret()), []byte(secret)) == 1
 	}
 }
 
 // Return authorization header data
 func CheckBasicAuth(r *http.Request) (*BasicAuth, error) {

Vulnerable code: 	return d.Secret == secret
		return client.GetSecret() == secret
Fixed code: import "crypto/subtle"

	return subtle.ConstantTimeCompare([]byte(d.Secret), []byte(secret)) == 1
	"crypto/subtle"
		return subtle.ConstantTimeCompare([]byte(client.GetSecret()), []byte(secret)) == 1
CVE-2022-23952: Insufficient Information (NVD-CWE-noinfo)
value: In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-09-21T19:15Z
Repository: https://github.com/keylime/keylime
Language: Shell
Files changed: installer.sh
Commit date: 2022-01-20 09:55:33 -0500
Commit message: Explicitly set permissions on new keylime.conf files installed

Signed-off-by: Michael Peters <mpeters@redhat.com>

Diff: diff --git a/installer.sh b/installer.sh
index 647c78e..e743ea1 100755
--- a/installer.sh
+++ b/installer.sh
@@ -529,14 +529,16 @@ python3 -m pip install . -r requirements.txt
 
 if [[ -f "/etc/keylime.conf" ]] ; then
     if [[ $(diff -N "/etc/keylime.conf" "keylime.conf") ]] ; then
         echo "Modified keylime.conf found in /etc/, creating /etc/keylime.conf.new instead"
         cp keylime.conf /etc/keylime.conf.new
+        chmod 600 /etc/keylime.conf.new
     fi
 else
     echo "Installing keylime.conf to /etc/"
     cp -n keylime.conf /etc/
+    chmod 600 /etc/keylime.conf
 fi
 
 echo
 echo "=================================================================================="
 echo $'\t\t\t\tCheck for tpm_cert_store'

Fixed code:         chmod 600 /etc/keylime.conf.new
    chmod 600 /etc/keylime.conf
CVE-2017-7271: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-27T17:59Z
Repository: https://github.com/yiisoft/yii2
Language: Markdown
Files changed: framework/CHANGELOG.md, framework/web/ErrorHandler.php
Commit date: 2017-01-18 01:05:50 +0300
Commit message: Fixes #13401: Fixed lack of escaping of request dump at exception screens


Diff: diff --git a/framework/CHANGELOG.md b/framework/CHANGELOG.md
index a3fc2a1a9..d87be35d6 100644
--- a/framework/CHANGELOG.md
+++ b/framework/CHANGELOG.md
@@ -102,11 +102,11 @@ Yii Framework 2 Change Log
 - Enh: Added constants for specifying `yii\validators\CompareValidator::$type` (cebe)
 - Enh: Refactored `yii\web\ErrorAction` to make it reusable (silverfire)
 - Enh: Added support for field `yii\console\controllers\BaseMigrateController::$migrationNamespaces` setup from CLI (schmunk42)
 - Bug #13287: Fixed translating "and" separator in `UniqueValidator` error message (jetexe)
 - Enh #11464: Populate foreign key names from schema (joaoppereira)
-
+- Bug #13401: Fixed lack of escaping of request dump at exception screens (samdark)
 
 2.0.10 October 20, 2016
 -----------------------
 
 - Bug #7670: Added `yii\web\UrlNormalizer` for normalizing requests with and without trailing slashes (rob006, cronfy, klimov-paul)
diff --git a/framework/web/ErrorHandler.php b/framework/web/ErrorHandler.php
index 0f4527721..b43d23567 100644
--- a/framework/web/ErrorHandler.php
+++ b/framework/web/ErrorHandler.php
@@ -321,11 +321,11 @@ class ErrorHandler extends \yii\base\ErrorHandler
             if (!empty($GLOBALS[$name])) {
                 $request .= '$' . $name . ' = ' . VarDumper::export($GLOBALS[$name]) . ";\n\n";
             }
         }
 
-        return '<pre>' . rtrim($request, "\n") . '</pre>';
+        return '<pre>' . $this->htmlEncode(rtrim($request, "\n")) . '</pre>';
     }
 
     /**
      * Determines whether given name of the file belongs to the framework.
      * @param string $file name to be checked.

Vulnerable code: 
        return '<pre>' . rtrim($request, "\n") . '</pre>';
Fixed code: - Bug #13401: Fixed lack of escaping of request dump at exception screens (samdark)
        return '<pre>' . $this->htmlEncode(rtrim($request, "\n")) . '</pre>';
CVE-2018-6009: Cross-Site Request Forgery (CSRF) (CWE-352)
value: In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2018-01-22T22:29Z
Repository: https://github.com/yiisoft/yii2
Language: PHP
Files changed: framework/CHANGELOG.md, framework/web/User.php, tests/framework/helpers/UrlTest.php
Commit date: 2018-01-14 02:13:24 +0300
Commit message: Fixes #15496: CSRF token is now regenerated on changing identity


Diff: diff --git a/framework/CHANGELOG.md b/framework/CHANGELOG.md
index 0565af452..4c8f340ea 100644
--- a/framework/CHANGELOG.md
+++ b/framework/CHANGELOG.md
@@ -1,10 +1,12 @@
 Yii Framework 2 Change Log
 ==========================
 
 2.0.14 under development
 ------------------------
+
+- Enh #15496: CSRF token is now regenerated on changing identity (samdark, rhertogh)
 - Enh #15417: Added `yii\validators\FileValidator::$minFiles` (vladis84)
 - Bug #8983: Only truncate the original log file for rotation (matthewyang, developeruz)
 - Bug #14157: Add support for loading default value `CURRENT_TIMESTAMP` of MySQL `datetime` field (rossoneri)
 - Bug #14276: Fixed I18N format with dotted parameters (developeruz)
 - Bug #14484: Fixed `yii\validators\UniqueValidator` for target classes with a default scope (laszlovl, developeruz)
diff --git a/framework/web/User.php b/framework/web/User.php
index 6104d2d01..35314934d 100644
--- a/framework/web/User.php
+++ b/framework/web/User.php
@@ -639,10 +639,13 @@ class User extends Component
             }
             if ($this->enableAutoLogin && $duration > 0) {
                 $this->sendIdentityCookie($identity, $duration);
             }
         }
+
+        // regenerate CSRF token
+        Yii::$app->getRequest()->getCsrfToken(true);
     }
 
     /**
      * Updates the authentication status using the information from session and cookie.
      *
diff --git a/tests/framework/helpers/UrlTest.php b/tests/framework/helpers/UrlTest.php
index a9e6e91e3..cf57f1507 100644
--- a/tests/framework/helpers/UrlTest.php
+++ b/tests/framework/helpers/UrlTest.php
@@ -27,10 +27,11 @@ class UrlTest extends TestCase
         parent::setUp();
         $this->mockApplication([
             'components' => [
                 'request' => [
                     'class' => 'yii\web\Request',
+                    'cookieValidationKey' => '123',
                     'scriptUrl' => '/base/index.php',
                     'hostInfo' => 'http://example.com/',
                     'url' => '/base/index.php&r=site%2Fcurrent&id=42',
                 ],
                 'urlManager' => [

Fixed code: 
- Enh #15496: CSRF token is now regenerated on changing identity (samdark, rhertogh)

        // regenerate CSRF token
        Yii::$app->getRequest()->getCsrfToken(true);
                    'cookieValidationKey' => '123',
CVE-2020-15148: Deserialization of Untrusted Data (CWE-502)
value: Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 10
Published: 2020-09-15T19:15Z
Repository: https://github.com/yiisoft/yii2
Language: Markdown
Files changed: framework/CHANGELOG.md, framework/db/BatchQueryResult.php
Commit date: 2020-09-15 00:15:51 +0300
Commit message: Merge pull request from GHSA-699q-wcff-g9mj

* Fix unsafe unserialize()

* Add changelog and comments on why unserialize() is disabled

* Add since tag
Diff: diff --git a/framework/CHANGELOG.md b/framework/CHANGELOG.md
index 255deb74e6..3d5b30bd3b 100644
--- a/framework/CHANGELOG.md
+++ b/framework/CHANGELOG.md
@@ -2,10 +2,11 @@ Yii Framework 2 Change Log
 ==========================
 
 2.0.38 under development
 ------------------------
 
+- Bug: (CVE-2020-15148): Disable unserialization of `yii\db\BatchQueryResult` to prevent remote code execution in case application calls unserialize() on user input containing specially crafted string (samdark, russtone)
 - Enh #18213: Do not load fixtures with circular dependencies twice instead of throwing an exception (JesseHines0)
 - Bug #18066: Fix `yii\db\Query::create()` wasn't using all info from `withQuery()` (maximkou)
 - Bug #18269: Fix integer safe attribute to work properly in `yii\base\Model` (Ladone)
 - Enh #18236: Allow `yii\filters\RateLimiter` to accept a closure function for the `$user` property in order to assign values on runtime (nadar)
 - Bug #18248: Render only one stack trace on a console for chained exceptions (mikehaertl)
diff --git a/framework/db/BatchQueryResult.php b/framework/db/BatchQueryResult.php
index 68fd03fc92..c08b8745cf 100644
--- a/framework/db/BatchQueryResult.php
+++ b/framework/db/BatchQueryResult.php
@@ -221,6 +221,17 @@ class BatchQueryResult extends BaseObject implements \Iterator
             }
         }
 
         return null;
     }
+
+    /**
+     * Unserialization is disabled to prevent remote code execution in case application
+     * calls unserialize() on user input containing specially crafted string.
+     * @see CVE-2020-15148
+     * @since 2.0.38
+     */
+    public function __wakeup()
+    {
+        throw new \BadMethodCallException('Cannot unserialize ' . __CLASS__);
+    }
 }

Fixed code: - Bug: (CVE-2020-15148): Disable unserialization of `yii\db\BatchQueryResult` to prevent remote code execution in case application calls unserialize() on user input containing specially crafted string (samdark, russtone)

    /**
     * Unserialization is disabled to prevent remote code execution in case application
     * calls unserialize() on user input containing specially crafted string.
     * @see CVE-2020-15148
     * @since 2.0.38
     */
    public function __wakeup()
    {
        throw new \BadMethodCallException('Cannot unserialize ' . __CLASS__);
    }
CVE-2022-27816: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.1
Published: 2022-03-30T02:15Z
Repository: https://github.com/waycrate/swhkd
Language: Rust
Files changed: src/server.rs
Commit date: 2022-03-25 20:50:01 +0530
Commit message: [patch] CVE-2022-27816

Diff: diff --git a/src/server.rs b/src/server.rs
index 22fd30f..1cc2764 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -10,11 +10,11 @@ use sysinfo::{ProcessExt, System, SystemExt};
 
 fn main() -> std::io::Result<()> {
     env::set_var("RUST_LOG", "swhks=trace");
     env_logger::init();
 
-    let pid_file_path = String::from("/tmp/swhks.pid");
+    let pid_file_path = String::from(format!("/run/user/{}/swhks.pid", unistd::Uid::current()));
     let sock_file_path = String::from(format!("/run/user/{}/swhkd.sock", unistd::Uid::current()));
 
     if Path::new(&pid_file_path).exists() {
         log::trace!("Reading {} file and checking for running instances.", pid_file_path);
         let swhkd_pid = match fs::read_to_string(&pid_file_path) {

Vulnerable code:     let pid_file_path = String::from("/tmp/swhks.pid");
Fixed code:     let pid_file_path = String::from(format!("/run/user/{}/swhks.pid", unistd::Uid::current()));
CVE-2013-4789: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2013-08-09T21:55Z
Repository: https://github.com/Cotonti/Cotonti
Language: PHP
Files changed: modules/rss/rss.php
Commit date: 2013-07-17 22:49:02 +0400
Commit message: Fixed SQL injection vulnerability in RSS module

Diff: diff --git a/modules/rss/rss.php b/modules/rss/rss.php
index f4d56f93..f18dfc19 100644
--- a/modules/rss/rss.php
+++ b/modules/rss/rss.php
@@ -197,11 +197,11 @@
 }
 elseif ($default_mode)
 {
 	require_once cot_incfile('page', 'module');
 
-	if (!empty($c))
+	if (!empty($c) && isset($structure['page'][$c]))
 	{
 		$mtch = $structure['page'][$c]['path'].".";
 		$mtchlen = mb_strlen($mtch);
 		$catsub = array();
 		$catsub[] = $c;

Vulnerable code: 	if (!empty($c))
Fixed code: 	if (!empty($c) && isset($structure['page'][$c]))
CVE-2022-25854: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-29T20:15Z
Repository: https://github.com/yairEO/tagify
Language: JavaScript
Files changed: src/tagify.js
Commit date: 2022-02-17 10:16:09 +0200
Commit message: fixes #989 - fix XSS

Diff: diff --git a/src/tagify.js b/src/tagify.js
index 2929ae2..63d5d93 100644
--- a/src/tagify.js
+++ b/src/tagify.js
@@ -99,11 +99,11 @@ Tagify.prototype = {
 
         var _s = this.settings = extend({}, DEFAULTS, settings)
 
         _s.disabled = input.hasAttribute('disabled')
         _s.readonly = _s.readonly || input.hasAttribute('readonly')
-        _s.placeholder = input.getAttribute('placeholder') || _s.placeholder || ""
+        _s.placeholder = escapeHTML(input.getAttribute('placeholder') || _s.placeholder || "")
         _s.required = input.hasAttribute('required')
 
         for( let name in _s.classNames )
             Object.defineProperty(_s.classNames, name + "Selector" , {
                 get(){ return "."+this[name].split(" ")[0] }

Vulnerable code:         _s.placeholder = input.getAttribute('placeholder') || _s.placeholder || ""
Fixed code:         _s.placeholder = escapeHTML(input.getAttribute('placeholder') || _s.placeholder || "")
CVE-2022-41417: Missing Authorization (CWE-862)
value: BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 9.8
Published: 2023-01-18T14:15Z
Repository: https://github.com/BlogEngine/BlogEngine.NET
Language: Unknown
Commit date: 2022-05-05 22:09:29 -0500
Commit message: Merge pull request #247 from 0xLanks/fix-security-issues

Fixed security issues
CVE-2022-41418: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.2
Published: 2022-12-19T20:15Z
Repository: https://github.com/BlogEngine/BlogEngine.NET
Language: Unknown
Commit date: 2022-05-05 22:09:29 -0500
Commit message: Merge pull request #247 from 0xLanks/fix-security-issues

Fixed security issues
CVE-2023-36260: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 7.5
Published: 2024-01-30T09:15Z
Repository: https://github.com/craftcms/feed-me
Language: PHP
Files changed: CHANGELOG.md, src/controllers/FeedsController.php
Commit date: 2023-03-31 14:55:23 -0700
Commit message: Fixed a PHP error that could occur when saving a feed using an Asset element type with no volume selected.

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 632cab9..9d4ba8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,11 @@
 # Release Notes for Feed Me 4.x
 
+## Unreleased
+
+- Fixed a PHP error that could occur when saving a feed using an Asset element type with no volume selected.
+
 ## 4.6.1.1 - 2023-03-24 
 
 - Fixed a PHP error that could occur when importing into some 3rd party fields. ([#1264](https://github.com/craftcms/feed-me/issues/1264), [#1265](https://github.com/craftcms/feed-me/pull/1265))
 
 ## 4.6.1 - 2023-03-20
diff --git a/src/controllers/FeedsController.php b/src/controllers/FeedsController.php
index 81e47be..ede4640 100644
--- a/src/controllers/FeedsController.php
+++ b/src/controllers/FeedsController.php
@@ -150,10 +150,21 @@ class FeedsController extends Controller
      */
     public function actionSaveFeed()
     {
         $feed = $this->_getModelFromPost();
 
+        if ($feed->getErrors()) {
+            $this->setFailFlash(Craft::t('feed-me', 'Couldn’t save the feed.'));
+
+            // Send the category group back to the template
+            Craft::$app->getUrlManager()->setRouteParams([
+                'feed' => $feed,
+            ]);
+
+            return null;
+        }
+
         return $this->_saveAndRedirect($feed, 'feed-me/feeds/', true);
     }
 
     /**
      * @return \yii\web\Response|null

Fixed code: ## Unreleased

- Fixed a PHP error that could occur when saving a feed using an Asset element type with no volume selected.

        if ($feed->getErrors()) {
            $this->setFailFlash(Craft::t('feed-me', 'Couldn’t save the feed.'));

            // Send the category group back to the template
            Craft::$app->getUrlManager()->setRouteParams([
                'feed' => $feed,
            ]);

            return null;
        }
CVE-2018-17294: Out-of-bounds Read (CWE-125)
value: The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2018-09-21T07:29Z
Repository: https://github.com/liblouis/liblouis
Language: C
Files changed: liblouis/lou_translateString.c
Commit date: 2018-09-03 11:52:24 +0200
Commit message: Fix a buffer overflow

Fixes #635

Thanks to HongxuChen for reporting it

Diff: diff --git a/liblouis/lou_translateString.c b/liblouis/lou_translateString.c
index dc1cb7ad..7c207f45 100644
--- a/liblouis/lou_translateString.c
+++ b/liblouis/lou_translateString.c
@@ -352,11 +352,13 @@ failure:
 static int
 matchCurrentInput(
 		const InString *input, int pos, const widechar *passInstructions, int passIC) {
 	int k;
 	int kk = pos;
-	for (k = passIC + 2; k < passIC + 2 + passInstructions[passIC + 1]; k++)
+	for (k = passIC + 2;
+			((k < passIC + 2 + passInstructions[passIC + 1]) && (kk < input->length));
+			k++)
 		if (input->chars[kk] == ENDSEGMENT || passInstructions[k] != input->chars[kk++])
 			return 0;
 	return 1;
 }
 

Vulnerable code: 	for (k = passIC + 2; k < passIC + 2 + passInstructions[passIC + 1]; k++)
Fixed code: 	for (k = passIC + 2;
			((k < passIC + 2 + passInstructions[passIC + 1]) && (kk < input->length));
			k++)
CVE-2022-29869: Insertion of Sensitive Information into Log File (CWE-532)
value: cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 5.3
Published: 2022-04-28T01:15Z
Repository: https://github.com/piastry/cifs-utils
Language: C
Files changed: mount.cifs.c
Commit date: 2022-04-26 17:07:40 -0700
Commit message: mount.cifs: fix verbose messages on option parsing

When verbose logging is enabled, invalid credentials file lines may be
dumped to stderr. This may lead to information disclosure in particular
conditions when the credentials file given is sensitive and contains '='
signs.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15026

Signed-off-by: Jeffrey Bencteux <jbe@improsec.com>
Reviewed-by: David Disseldorp <ddiss@suse.de>

Diff: diff --git a/mount.cifs.c b/mount.cifs.c
index 3a6b449..2278995 100644
--- a/mount.cifs.c
+++ b/mount.cifs.c
@@ -626,21 +626,17 @@ static int open_cred_file(char *file_name,
 			i = set_password(parsed_info, temp_val);
 			if (i)
 				goto return_i;
 			break;
 		case CRED_DOM:
-			if (parsed_info->verboseflag)
-				fprintf(stderr, "domain=%s\n",
-					temp_val);
 			strlcpy(parsed_info->domain, temp_val,
 				sizeof(parsed_info->domain));
 			break;
 		case CRED_UNPARSEABLE:
 			if (parsed_info->verboseflag)
 				fprintf(stderr, "Credential formatted "
-					"incorrectly: %s\n",
-					temp_val ? temp_val : "(null)");
+					"incorrectly\n");
 			break;
 		}
 	}
 	i = 0;
 return_i:

Vulnerable code: 			if (parsed_info->verboseflag)
				fprintf(stderr, "domain=%s\n",
					temp_val);
					"incorrectly: %s\n",
					temp_val ? temp_val : "(null)");
Fixed code: 					"incorrectly\n");
CVE-2023-34411: Improper Restriction of XML External Entity Reference (CWE-611)
value: The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 7.5
Published: 2023-06-05T04:15Z
Repository: https://github.com/netvl/xml-rs
Language: Rust
Files changed: src/reader/lexer.rs
Commit date: 2023-06-01 14:17:14 +0200
Commit message: Avoid panic when displaying unexpected token error

Avoid entering unreachable!() when displaying an error message for an
invalid `<!` token. This fixes a panic when processing a malformed
XML which contains such token in an unexpected place, like the
following:

`<!DOCTYPEs/%<!A`

Diff: diff --git a/src/reader/lexer.rs b/src/reader/lexer.rs
index f6ce5fe..a8345ba 100644
--- a/src/reader/lexer.rs
+++ b/src/reader/lexer.rs
@@ -79,10 +79,11 @@ impl fmt::Display for Token {
                 Token::ReferenceStart             => "&",
                 Token::ReferenceEnd               => ";",
                 Token::EqualsSign                 => "=",
                 Token::SingleQuote                => "'",
                 Token::DoubleQuote                => "\"",
+                Token::MarkupDeclarationStart     => "<!",
                 _                          => unreachable!()
             }.fmt(f),
         }
     }
 }

Fixed code:                 Token::MarkupDeclarationStart     => "<!",
CVE-2014-125057: Incorrect Comparison (CWE-697)
value: A vulnerability was found in mrobit robitailletheknot. It has been classified as problematic. This affects an unknown part of the file app/filters.php of the component CSRF Token Handler. The manipulation of the argument _token leads to incorrect comparison. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6b2813696ccb88d0576dfb305122ee880eb36197. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217599.
CWE description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CVSS v3 base score: 9.8
Published: 2023-01-07T10:15Z
Repository: https://github.com/mrobit/robitailletheknot
Language: PHP
Files changed: app/filters.php
Commit date: 2014-11-10 10:31:00 -0500
Commit message: Patch security vulnerability.

Diff: diff --git a/app/filters.php b/app/filters.php
index fd0b4bc..97a9468 100644
--- a/app/filters.php
+++ b/app/filters.php
@@ -81,10 +81,10 @@ Route::filter('guest', function()
 |
 */
 
 Route::filter('csrf', function()
 {
-	if (Session::token() != Input::get('_token'))
+	if (Session::token() !== Input::get('_token'))
 	{
 		throw new Illuminate\Session\TokenMismatchException;
 	}
 });

Vulnerable code: 	if (Session::token() != Input::get('_token'))
Fixed code: 	if (Session::token() !== Input::get('_token'))
CVE-2022-24813: Improper Authentication (CWE-287)
value: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` branch of CreateWiki's GitHub repository.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 5.3
Published: 2022-04-04T18:15Z
Repository: https://github.com/miraheze/CreateWiki
Language: PHP
Files changed: includes/RequestWiki/RequestWikiRequestViewer.php
Commit date: 2022-04-02 19:18:41 +0100
Commit message: T9018: Add submission check for anonymous users POSTing
Diff: diff --git a/includes/RequestWiki/RequestWikiRequestViewer.php b/includes/RequestWiki/RequestWikiRequestViewer.php
index c7b82bb..fdc1cab 100644
--- a/includes/RequestWiki/RequestWikiRequestViewer.php
+++ b/includes/RequestWiki/RequestWikiRequestViewer.php
@@ -329,13 +329,18 @@ class RequestWikiRequestViewer {
 		array $formData,
 		HTMLForm $form,
 		WikiRequest $request
 	) {
 		$out = $form->getContext()->getOutput();
-
-		if ( isset( $formData['submit-comment'] ) ) {
-			$request->addComment( $formData['comment'], $form->getUser() );
+		$user = $form->getUser();
+
+		if ( $user->isAnon() ) {
+			$out->addHTML( Html::errorBox( wfMessage( 'exception-nologin-text' )->parse() ) );
+			
+			return false;
+		} elseif ( isset( $formData['submit-comment'] ) ) {
+			$request->addComment( $formData['comment'], $user );
 		} elseif ( isset( $formData['submit-edit'] ) ) {
 			$subdomain = $formData['edit-url'];
 			$err = '';
 			$status = $request->parseSubdomain( $subdomain, $err );
 
@@ -357,13 +362,13 @@ class RequestWikiRequestViewer {
 			$request->reopen( $form->getUser() );
 		} elseif ( isset( $formData['submit-handle'] ) ) {
 			$request->visibility = $formData['visibility'];
 
 			if ( $formData['submission-action'] == 'approve' ) {
-				$request->approve( $form->getUser(), $formData['reason'] );
+				$request->approve( $user, $formData['reason'] );
 			} else {
-				$request->decline( $formData['reason'], $form->getUser() );
+				$request->decline( $formData['reason'], $user );
 			}
 		}
 
 		$out->addHTML( Html::successBox( wfMessage( 'requestwiki-edit-success' )->escaped() ) );
 

Vulnerable code: 
		if ( isset( $formData['submit-comment'] ) ) {
			$request->addComment( $formData['comment'], $form->getUser() );
				$request->approve( $form->getUser(), $formData['reason'] );
				$request->decline( $formData['reason'], $form->getUser() );
Fixed code: 		$user = $form->getUser();

		if ( $user->isAnon() ) {
			$out->addHTML( Html::errorBox( wfMessage( 'exception-nologin-text' )->parse() ) );
			
			return false;
		} elseif ( isset( $formData['submit-comment'] ) ) {
			$request->addComment( $formData['comment'], $user );
				$request->approve( $user, $formData['reason'] );
				$request->decline( $formData['reason'], $user );
CVE-2024-29898: Insufficient Information (NVD-CWE-noinfo)
value: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the `(read)` permission. This vulnerability is fixed in 8f8442ed5299510ea3e58416004b9334134c149c.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-28T14:15Z
Repository: https://github.com/miraheze/CreateWiki
Language: PHP
Files changed: includes/RequestWiki/Handler/RestWikiRequest.php, includes/RequestWiki/RequestWikiRequestViewer.php
Commit date: 2024-03-27 21:50:50 +0100
Commit message: Remove checks for `(read)` (#497)

Unnecessary checks, since if the user doesn't have this perm it should
not be able to reach the special pages or APIs to begin with.
Diff: diff --git a/includes/RequestWiki/Handler/RestWikiRequest.php b/includes/RequestWiki/Handler/RestWikiRequest.php
index e003697..f9184b5 100644
--- a/includes/RequestWiki/Handler/RestWikiRequest.php
+++ b/includes/RequestWiki/Handler/RestWikiRequest.php
@@ -66,11 +66,11 @@ class RestWikiRequest extends SimpleHandler {
 			 *
 			 * Require both (createwiki) and the required permission to prevent suppressed requests from
 			 * being revealed to local suppressors/sysops
 			 */
 
-			if ( $wikiRequestVisibility !== 'read' && $this->getAuthority()->isAllowed( 'read' ) ) {
+			if ( $wikiRequestVisibility !== 'read' ) {
 				if ( !$this->getAuthority()->isAllowedAll( 'createwiki', $wikiRequestVisibility ) ) {
 					// User does not have permission to view this request
 					return $this->getResponseFactory()->createHttpError( 404, ['message' => 'Request not found'] );
 				}
 			}
diff --git a/includes/RequestWiki/RequestWikiRequestViewer.php b/includes/RequestWiki/RequestWikiRequestViewer.php
index 6b738ff..5a67d06 100644
--- a/includes/RequestWiki/RequestWikiRequestViewer.php
+++ b/includes/RequestWiki/RequestWikiRequestViewer.php
@@ -42,11 +42,11 @@ class RequestWikiRequestViewer {
 
 		// if request isn't found, it doesn't exist
 		// but if we can't view the request, it also doesn't exist
 		$permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
 
-		if ( $visibilityConds[$request->visibility] !== 'read' && $permissionManager->userHasRight( $userR, 'read' ) ) {
+		if ( $visibilityConds[$request->visibility] !== 'read' ) {
 			if ( !$permissionManager->userHasAllRights( $userR, 'createwiki', $visibilityConds[$request->visibility] ) ) {
 				$context->getOutput()->addHTML( Html::errorBox( wfMessage( 'requestwiki-unknown' )->escaped() ) );
 
 				return [];
 			}

Vulnerable code: 			if ( $wikiRequestVisibility !== 'read' && $this->getAuthority()->isAllowed( 'read' ) ) {
		if ( $visibilityConds[$request->visibility] !== 'read' && $permissionManager->userHasRight( $userR, 'read' ) ) {
Fixed code: 			if ( $wikiRequestVisibility !== 'read' ) {
		if ( $visibilityConds[$request->visibility] !== 'read' ) {
CVE-2017-7418: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 5.5
Published: 2017-04-04T17:59Z
Repository: https://github.com/proftpd/proftpd
Language: Unknown
Commit date: 2017-03-05 16:53:52 -0800
Commit message: Merge pull request #444 from proftpd/auth-symlinks-anywhere-in-chroot

Walk the entire DefaultRoot path, checking for symlinks of any compon…
CVE-2023-36814: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2023-07-03T17:15Z
Repository: https://github.com/zopefoundation/Products.CMFCore
Language: Unknown
Commit date: 2023-07-03 09:51:32 +0000
Commit message: Merge pull request from GHSA-4hpj-8rhv-9x87

Improve handling of PortalFolder filter input.
CVE-2016-10522: Cross-Site Request Forgery (CSRF) (CWE-352)
value: rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2018-07-05T16:29Z
Repository: https://github.com/sferik/rails_admin
Language: Ruby
Files changed: app/controllers/rails_admin/application_controller.rb, spec/integration/rails_admin_spec.rb
Commit date: 2016-12-25 13:50:29 +0900
Commit message: [Security] Fixes CSRF vulnerability, introduced by 53eef4fe2ec0953381f4e3197c885adc0423dd49

Reported by SourceClear, Inc.

Diff: diff --git a/app/controllers/rails_admin/application_controller.rb b/app/controllers/rails_admin/application_controller.rb
index d933063f..ed7fee5c 100644
--- a/app/controllers/rails_admin/application_controller.rb
+++ b/app/controllers/rails_admin/application_controller.rb
@@ -9,10 +9,12 @@ module RailsAdmin
 
   class ActionNotAllowed < ::StandardError
   end
 
   class ApplicationController < Config.parent_controller.constantize
+    protect_from_forgery with: :exception
+
     before_action :_authenticate!
     before_action :_authorize!
     before_action :_audit!
 
     helper_method :_current_user, :_get_plugin_name
diff --git a/spec/integration/rails_admin_spec.rb b/spec/integration/rails_admin_spec.rb
index 32406fdc..07e3d296 100644
--- a/spec/integration/rails_admin_spec.rb
+++ b/spec/integration/rails_admin_spec.rb
@@ -146,6 +146,19 @@ describe RailsAdmin, type: :request do
     it 'has label-danger class on log out link' do
       visit dashboard_path
       is_expected.to have_selector('.label-danger')
     end
   end
+
+  describe 'CSRF protection' do
+    before do
+      allow_any_instance_of(ActionController::Base).to receive(:protect_against_forgery?).and_return(true)
+    end
+
+    it 'is enforced' do
+      visit new_path(model_name: 'league')
+      fill_in 'league[name]', with: 'National league'
+      find('input[name="authenticity_token"]', visible: false).set("invalid token")
+      expect { click_button 'Save' }.to raise_error ActionController::InvalidAuthenticityToken
+    end
+  end
 end

Fixed code:     protect_from_forgery with: :exception


  describe 'CSRF protection' do
    before do
      allow_any_instance_of(ActionController::Base).to receive(:protect_against_forgery?).and_return(true)
    end

    it 'is enforced' do
      visit new_path(model_name: 'league')
      fill_in 'league[name]', with: 'National league'
      find('input[name="authenticity_token"]', visible: false).set("invalid token")
      expect { click_button 'Save' }.to raise_error ActionController::InvalidAuthenticityToken
    end
  end