Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-16405: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-09-03T19:29Z
Repository: https://gitlab.com/mayan-edms/mayan-edms
Language: Other
Files changed: HISTORY.rst, mayan/apps/appearance/templates/appearance/base_plain.html
Commit date: 2018-08-16 18:46:10 -0400
Commit message: Avoid setting window.location directly to avoid exploit of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report and solution. Closes GitLab issue #494.

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>

Diff: diff --git a/HISTORY.rst b/HISTORY.rst
index c882ceae3..4d4e14628 100644
--- a/HISTORY.rst
+++ b/HISTORY.rst
@@ -34,10 +34,13 @@
   the Wiki: wiki.mayan-edms.com
 - Appearance app: Add support for hiding a links icon. Hide all object menu
   links' icons.
 - Documents app: Hide the title link of documents in the trash.
 - Workflow app: Define a redirection after workflow actions are edited.
+- Appearance app: avoid setting window.location directly to avoid exploit
+  of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report
+  and solution. Closes GitLab issue #494.
 
 3.0.1 (2018-07-08)
 =================
 - Pin javascript libraries to specific versions to avoid using 
   potentianlly broken updates automatically. GitLab issue #486.
diff --git a/mayan/apps/appearance/templates/appearance/base_plain.html b/mayan/apps/appearance/templates/appearance/base_plain.html
index b797b15a4..f6f1da6e7 100644
--- a/mayan/apps/appearance/templates/appearance/base_plain.html
+++ b/mayan/apps/appearance/templates/appearance/base_plain.html
@@ -32,11 +32,11 @@
                 // Detect if we are inside of an AJAX content container
                 // and break free as this is supposed to be a top level
                 // template.
                 var currentHash = window.location.hash;
                 if (currentHash.length) {
-                    window.location = currentHash.substring(1);
+                    window.location.pathname = currentHash.substring(1);
                 }
 
                 function waitForJQuery(func) {
                     if (window.jQuery) {
                         func();

Vulnerable code:                     window.location = currentHash.substring(1);
Fixed code: - Appearance app: avoid setting window.location directly to avoid exploit
  of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report
  and solution. Closes GitLab issue #494.
                    window.location.pathname = currentHash.substring(1);
CVE-2018-16406: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-09-03T19:29Z
Repository: https://gitlab.com/mayan-edms/mayan-edms
Language: Other
Files changed: HISTORY.rst, mayan/apps/cabinets/widgets.py
Commit date: 2018-08-16 19:26:37 -0400
Commit message: Cabinets app: Escape cabinet labels to avoid possible exploit of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report and proposed solutions. Closes GitLab issue #495.

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>

Diff: diff --git a/HISTORY.rst b/HISTORY.rst
index 4d4e14628e..a99b449954 100644
--- a/HISTORY.rst
+++ b/HISTORY.rst
@@ -37,10 +37,13 @@
 - Documents app: Hide the title link of documents in the trash.
 - Workflow app: Define a redirection after workflow actions are edited.
 - Appearance app: avoid setting window.location directly to avoid exploit
   of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report
   and solution. Closes GitLab issue #494.
+- Cabinets app: Escape cabinet labels to avoid possible exploit of
+  cross site scripting. Thanks to Lokesh (@lokesh1095) for the report
+  and proposed solutions. Closes GitLab issue #495.
 
 3.0.1 (2018-07-08)
 =================
 - Pin javascript libraries to specific versions to avoid using 
   potentianlly broken updates automatically. GitLab issue #486.
diff --git a/mayan/apps/cabinets/widgets.py b/mayan/apps/cabinets/widgets.py
index d36dbc83dc..d7f20c50d1 100644
--- a/mayan/apps/cabinets/widgets.py
+++ b/mayan/apps/cabinets/widgets.py
@@ -1,17 +1,18 @@
 from __future__ import unicode_literals
 
 from django.apps import apps
-from django.utils.html import format_html_join
+from django.utils.html import format_html, format_html_join
 
 from .permissions import permission_cabinet_view
 
 
 def jstree_data(node, selected_node):
     result = []
+
     result.append('{')
-    result.append('"text": "{}",'.format(node.label))
+    result.append(format_html('"text": "{}",', node.label))
     result.append(
         '"state": {{ "opened": true, "selected": {} }},'.format(
             'true' if node == selected_node else 'false'
         )
     )

Vulnerable code: from django.utils.html import format_html_join
    result.append('"text": "{}",'.format(node.label))
Fixed code: - Cabinets app: Escape cabinet labels to avoid possible exploit of
  cross site scripting. Thanks to Lokesh (@lokesh1095) for the report
  and proposed solutions. Closes GitLab issue #495.
from django.utils.html import format_html, format_html_join

    result.append(format_html('"text": "{}",', node.label))
CVE-2020-26250: Incorrect Authorization (CWE-863)
value: OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all authenticated users will be allowed. Provider-based restrictions, including deprecated values such as `GitHubOAuthenticator.org_whitelist` are **not** affected. All users of OAuthenticator 0.12.0 and 0.12.1 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users` configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not** affected. If you see a log line like this and expect a specific list of allowed usernames: "[I 2020-11-27 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authenticated user will be allowed." you are likely affected. Updating oauthenticator to 0.12.2 is recommended. A workaround is to replace the deprecated `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...`. If any users have been authorized during this time who should not have been, they must be deleted via the API or admin interface, per the referenced documentation.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.3
Published: 2020-12-01T21:15Z
Repository: https://github.com/jupyterhub/oauthenticator
Language: Unknown
Commit date: 2020-11-30 12:35:25 +0100
Commit message: Merge pull request from GHSA-384w-5v3f-q499

fix conflict with deprecations in jupyterhub 1.2
CVE-2024-29033: Insufficient Information (NVD-CWE-noinfo)
value: OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-20T21:15Z
Repository: https://github.com/jupyterhub/oauthenticator
Language: Unknown
Commit date: 2024-03-20 07:40:59 +0100
Commit message: Merge pull request from GHSA-55m3-44xf-hg4h

GoogleOAuthenticator.hosted_domain: check against hd, not email's domain
CVE-2024-37300: Insufficient Information (NVD-CWE-noinfo)
value: OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. This worked fine prior to JupyterHub 5.0, because `allow_all` did not take precedence over `identity_provider`. Since JupyterHub 5.0, `allow_all` does take precedence over `identity_provider`. On a hub with the same config, now all users will be allowed to login, regardless of `identity_provider`. `identity_provider` will basically be ignored. This is a documented change in JupyterHub 5.0, but is likely to catch many users by surprise. OAuthenticator 16.3.1 fixes the issue with JupyterHub 5.0, and does not affect previous versions. As a workaround, do not upgrade to JupyterHub 5.0 when using `GlobusOAuthenticator` in the prior configuration.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-12T16:15Z
Repository: https://github.com/jupyterhub/oauthenticator
Language: Unknown
Commit date: 2024-06-11 15:23:56 -0700
Commit message: Merge pull request from GHSA-gprj-3p75-f996

globus: apply identity_provider restriction in `check_blocked_users`
CVE-2018-7652: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-03-04T01:29Z
Repository: https://github.com/dotse/zonemaster-gui
Language: Perl
Files changed: lib/Zonemaster/GUI/Dancer/Export.pm
Commit date: 2018-02-19 14:49:47 +0100
Commit message: Escape HTML

Diff: diff --git a/lib/Zonemaster/GUI/Dancer/Export.pm b/lib/Zonemaster/GUI/Dancer/Export.pm
index 2f7bbff..a26278a 100644
--- a/lib/Zonemaster/GUI/Dancer/Export.pm
+++ b/lib/Zonemaster/GUI/Dancer/Export.pm
@@ -29,11 +29,11 @@ any [ 'get', 'post' ] => '/export' => sub {
 			if ( $previous_module ne $result->{module} ) {
 				push( @test_results, { is_module => 1, message => $result->{module} } );
 				$previous_module = $result->{module};
 			}
 
-			push( @test_results, { is_module => 0, message => $result->{message}, class => "alert alert-$result->{level}" } );
+			push( @test_results, { is_module => 0, message => HTML::Entities::encode($result->{message}), class => "alert alert-$result->{level}" } );
 		}
 
 		my $template_params;
 		$template_params->{test_results}  = \@test_results;
 		template 'export', $template_params, { layout => undef };

Vulnerable code: 			push( @test_results, { is_module => 0, message => $result->{message}, class => "alert alert-$result->{level}" } );
Fixed code: 			push( @test_results, { is_module => 0, message => HTML::Entities::encode($result->{message}), class => "alert alert-$result->{level}" } );
CVE-2024-35180: Insufficient Information (NVD-CWE-noinfo)
value: OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-21T13:15Z
Repository: https://github.com/ome/omero-web
Language: Python
Files changed: omeroweb/webgateway/views.py
Commit date: 2024-05-21 13:23:18 +0200
Commit message: Check that the JSONP callback is a valid function

Diff: diff --git a/omeroweb/webgateway/views.py b/omeroweb/webgateway/views.py
index 228d8a124d..2b25b9a092 100644
--- a/omeroweb/webgateway/views.py
+++ b/omeroweb/webgateway/views.py
@@ -100,10 +100,18 @@ def index(request):
 
 def _safestr(s):
     return str(s).encode("utf-8")
 
 
+# Regular expression that represents the characters in ASCII that are
+# allowed in a valid JavaScript variable name.  Function names adhere to
+# the same rules.
+# See:
+#   https://stackoverflow.com/questions/1661197/what-characters-are-valid-for-javascript-variable-names
+VALID_JS_VARIABLE = re.compile(r"^[a-zA-Z_$][0-9a-zA-Z_$]*$")
+
+
 class UserProxy(object):
     """
     Represents the current user of the connection, with methods delegating to
     the connection itself.
     """
@@ -1441,10 +1449,12 @@ def jsonp(f):
                 return rv
             if isinstance(rv, HttpResponse):
                 return rv
             c = request.GET.get("callback", None)
             if c is not None and not kwargs.get("_internal", False):
+                if not VALID_JS_VARIABLE.match(c):
+                    return HttpResponseBadRequest("Invalid callback")
                 rv = json.dumps(rv)
                 rv = "%s(%s)" % (c, rv)
                 # mimetype for JSONP is application/javascript
                 return HttpJavascriptResponse(rv)
             if kwargs.get("_internal", False):

Fixed code: # Regular expression that represents the characters in ASCII that are
# allowed in a valid JavaScript variable name.  Function names adhere to
# the same rules.
# See:
#   https://stackoverflow.com/questions/1661197/what-characters-are-valid-for-javascript-variable-names
VALID_JS_VARIABLE = re.compile(r"^[a-zA-Z_$][0-9a-zA-Z_$]*$")


                if not VALID_JS_VARIABLE.match(c):
                    return HttpResponseBadRequest("Invalid callback")
CVE-2024-27088: Insufficient Information (NVD-CWE-noinfo)
value: es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-26T17:15Z
Repository: https://github.com/medikoo/es5-ext
Language: JavaScript
Files changed: function/#/copy.js
Commit date: 2024-02-19 17:38:29 +0100
Commit message: fix: Do not rely on problematic regex

Addresses #201

Diff: diff --git a/function/#/copy.js b/function/#/copy.js
index 81ae783..897207b 100644
--- a/function/#/copy.js
+++ b/function/#/copy.js
@@ -1,21 +1,22 @@
 "use strict";
 
 var mixin         = require("../../object/mixin")
-  , validFunction = require("../valid-function")
-  , re            = /^\s*function\s*([\0-')-\uffff]+)*\s*\(([\0-(*-\uffff]*)\)\s*\{/;
+  , validFunction = require("../valid-function");
 
 module.exports = function () {
-	var match = String(validFunction(this)).match(re), fn;
+	validFunction(this);
 
+	var args = [];
+	for (var i = 0; i < this.length; ++i) args.push("arg" + (i + 1));
 	// eslint-disable-next-line no-new-func
-	fn = new Function(
+	var fn = new Function(
 		"fn",
 		"return function " +
-			match[1].trim() +
+			(this.name || "") +
 			"(" +
-			match[2] +
+			args.join(", ") +
 			") { return fn.apply(this, arguments); };"
 	)(this);
 	try { mixin(fn, this); }
 	catch (ignore) {}
 	return fn;

Vulnerable code:   , validFunction = require("../valid-function")
  , re            = /^\s*function\s*([\0-')-\uffff]+)*\s*\(([\0-(*-\uffff]*)\)\s*\{/;
	var match = String(validFunction(this)).match(re), fn;
	fn = new Function(
			match[1].trim() +
			match[2] +
Fixed code:   , validFunction = require("../valid-function");
	validFunction(this);
	var args = [];
	for (var i = 0; i < this.length; ++i) args.push("arg" + (i + 1));
	var fn = new Function(
			(this.name || "") +
			args.join(", ") +
CVE-2021-4287: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 is able to address this issue. The name of the patch is fa0c0bd59b8588814756942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 6.5
Published: 2022-12-27T11:15Z
Repository: https://github.com/ReFirmLabs/binwalk
Language: Unknown
Commit date: 2021-09-10 13:46:40 -0400
Commit message: Merge pull request #556 from ReFirmLabs/unpriv_user_exec

Symlink directory traversal security fix
CVE-2020-36828: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in DiscuzX up to 3.4-20200818. It has been classified as problematic. Affected is the function show_next_step of the file upload/install/include/install_function.php. The manipulation of the argument uchidden leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.4-20210119 is able to address this issue. The name of the patch is 4a9673624f46f7609486778ded9653733020c567. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258612.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-03-31T09:15Z
Repository: https://github.com/codersclub/DiscuzX
Language: PHP
Files changed: upload/install/include/install_function.php
Commit date: 2020-01-09 12:00:45 +0800
Commit message: !187 修复 install.php中uchidden参数的XSS漏洞
* 修复install.php中uchidden参数的XSS漏洞
* 修复install.php中uchidden参数的XSS漏洞
Diff: diff --git a/upload/install/include/install_function.php b/upload/install/include/install_function.php
index 32ecb1a..fe07b7d 100644
--- a/upload/install/include/install_function.php
+++ b/upload/install/include/install_function.php
@@ -346,10 +346,20 @@ function show_env_result(&$env_items, &$dirfile_items, &$func_items, &$filesock_
 
 }
 
 function show_next_step($step, $error_code) {
 	global $uchidden;
+
+	if(!empty($uchidden)) {
+		$uc_info_transfer = unserialize(urldecode($uchidden));
+		if(!isset($uc_info_transfer['ucapi']) && !isset($uc_info_transfer['ucfounderpw'])){
+			$uchidden = '';
+		} else {
+			$uchidden = dhtmlspecialchars($uchidden);
+		}
+	}
+
 	echo "<form action=\"index.php\" method=\"post\">\n";
 	echo "<input type=\"hidden\" name=\"step\" value=\"$step\" />";
 	if(isset($GLOBALS['hidden'])) {
 		echo $GLOBALS['hidden'];
 	}

Fixed code: 
	if(!empty($uchidden)) {
		$uc_info_transfer = unserialize(urldecode($uchidden));
		if(!isset($uc_info_transfer['ucapi']) && !isset($uc_info_transfer['ucfounderpw'])){
			$uchidden = '';
		} else {
			$uchidden = dhtmlspecialchars($uchidden);
		}
	}
CVE-2013-7381: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-02-12T15:15Z
Repository: https://github.com/mytrile/node-libnotify
Language: Unknown
Commit date: 2013-05-14 12:46:34 -0700
Commit message: Merge pull request #4 from nealpoole/exec-fix

Replacing call to exec with execFile.
CVE-2023-39976: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2023-08-08T06:15Z
Repository: https://github.com/ClusterLabs/libqb
Language: C
Files changed: lib/log_blackbox.c, tests/check_log.c
Commit date: 2023-07-20 07:19:01 +0100
Commit message: log: fix potential overflow with long log messages (#490)

qb_vsnprintf_serialize was called with 'max_size' as the
limiting number for the length of the formatted log
message. But the buffer also needs to contain the
log header (given by 'actual_size'), so we now pass
't->max_line_length' as the maximum length of the
formatted log message to limit space to the actual 
bytes left

Also added error checks to the blackbox calls at
the end of the test, as these now provide a proper
test that the BB is functioning. Before they were
masking failures.
Diff: diff --git a/lib/log_blackbox.c b/lib/log_blackbox.c
index 3e30504..8519a48 100644
--- a/lib/log_blackbox.c
+++ b/lib/log_blackbox.c
@@ -108,12 +108,12 @@ _blackbox_vlogger(int32_t target,
 	/* log message length */
 	msg_len_pt = chunk;
 	chunk += sizeof(uint32_t);
 
 	/* log message */
-	msg_len = qb_vsnprintf_serialize(chunk, max_size, cs->format, ap);
-	if (msg_len >= max_size) {
+	msg_len = qb_vsnprintf_serialize(chunk, t->max_line_length, cs->format, ap);
+	if (msg_len >= t->max_line_length) {
 	    chunk = msg_len_pt + sizeof(uint32_t); /* Reset */
 
 	    /* Leave this at QB_LOG_MAX_LEN so as not to overflow the blackbox */
 	    msg_len = qb_vsnprintf_serialize(chunk, QB_LOG_MAX_LEN,
 		"Log message too long to be stored in the blackbox.  "\
diff --git a/tests/check_log.c b/tests/check_log.c
index 039a4bb..e5abf40 100644
--- a/tests/check_log.c
+++ b/tests/check_log.c
@@ -830,12 +830,14 @@ START_TEST(test_log_long_msg)
 		}
 		buffer[lpc%600] = 0;
 		qb_log(LOG_INFO, "Message %d %d - %s", lpc, lpc%600, buffer);
 	}
 
-        qb_log_blackbox_write_to_file("blackbox.dump");
-        qb_log_blackbox_print_from_file("blackbox.dump");
+        rc = qb_log_blackbox_write_to_file("blackbox.dump");
+	ck_assert_int_gt(rc, 0);
+        rc = qb_log_blackbox_print_from_file("blackbox.dump");
+	ck_assert_int_le(rc, 0);
 	unlink("blackbox.dump");
 	qb_log_fini();
 }
 END_TEST
 

Vulnerable code: 	msg_len = qb_vsnprintf_serialize(chunk, max_size, cs->format, ap);
	if (msg_len >= max_size) {
        qb_log_blackbox_write_to_file("blackbox.dump");
        qb_log_blackbox_print_from_file("blackbox.dump");
Fixed code: 	msg_len = qb_vsnprintf_serialize(chunk, t->max_line_length, cs->format, ap);
	if (msg_len >= t->max_line_length) {
        rc = qb_log_blackbox_write_to_file("blackbox.dump");
	ck_assert_int_gt(rc, 0);
        rc = qb_log_blackbox_print_from_file("blackbox.dump");
	ck_assert_int_le(rc, 0);
CVE-2013-4701: Insufficient Information (NVD-CWE-noinfo)
value: Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2013-08-21T16:55Z
Repository: https://github.com/openid/php-openid
Language: PHP
Files changed: Auth/Yadis/XML.php
Commit date: 2013-08-11 18:41:28 -0700
Commit message: disable external XML entities and libxml errors

thanks to Kousuke Ebihara for the report and patch.

Diff: diff --git a/Auth/Yadis/XML.php b/Auth/Yadis/XML.php
index cf1f5c4..bb13775 100644
--- a/Auth/Yadis/XML.php
+++ b/Auth/Yadis/XML.php
@@ -232,11 +232,18 @@ class Auth_Yadis_dom extends Auth_Yadis_XMLParser {
 
         if (!$this->doc) {
             return false;
         }
 
-        if (!@$this->doc->loadXML($xml_string)) {
+        // disable external entities and libxml errors
+        $loader = libxml_disable_entity_loader(true);
+        $errors = libxml_use_internal_errors(true);
+        $parse_result = @$this->doc->loadXML($xml_string);
+        libxml_disable_entity_loader($loader);
+        libxml_use_internal_errors($errors);
+
+        if (!$parse_result) {
             return false;
         }
 
         $this->xpath = new DOMXPath($this->doc);
 

Vulnerable code:         if (!@$this->doc->loadXML($xml_string)) {
Fixed code:         // disable external entities and libxml errors
        $loader = libxml_disable_entity_loader(true);
        $errors = libxml_use_internal_errors(true);
        $parse_result = @$this->doc->loadXML($xml_string);
        libxml_disable_entity_loader($loader);
        libxml_use_internal_errors($errors);

        if (!$parse_result) {
CVE-2021-28379: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2021-03-15T06:15Z
Repository: https://github.com/myvesta/vesta
Language: PHP
Files changed: web/upload/UploadHandler.php
Commit date: 2021-03-14 20:49:14 +0100
Commit message: Preventing uploads from other origin

Credits to:  Fady Othman, Security Consultant # ZINAD IT
Diff: diff --git a/web/upload/UploadHandler.php b/web/upload/UploadHandler.php
index 64004c91..b77749ab 100755
--- a/web/upload/UploadHandler.php
+++ b/web/upload/UploadHandler.php
@@ -1,9 +1,16 @@
 <?php
 
 //session_start();
 
+$hostname = exec('hostname');
+$port = $_SERVER['SERVER_PORT'];
+$expected_http_origin="https://".$hostname.":".$port;
+if ($_SERVER['HTTP_ORIGIN'] != $expected_http_origin) {
+    die ("Nope.");
+}
+
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Check login_as feature
 $user = $_SESSION['user'];
 if (($_SESSION['user'] == 'admin') && (!empty($_SESSION['look']))) {

Fixed code: $hostname = exec('hostname');
$port = $_SERVER['SERVER_PORT'];
$expected_http_origin="https://".$hostname.":".$port;
if ($_SERVER['HTTP_ORIGIN'] != $expected_http_origin) {
    die ("Nope.");
}
CVE-2021-46850: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 7.2
Published: 2022-10-24T14:15Z
Repository: https://github.com/myvesta/vesta
Language: Other
Files changed: bin/v-activate-vesta-license
Commit date: 2021-03-15 13:55:11 +0100
Commit message: Checking licence format

Credits to:  @numanturle Numan Türle
Diff: diff --git a/bin/v-activate-vesta-license b/bin/v-activate-vesta-license
index 28a5bf161..8d9ebd20c 100755
--- a/bin/v-activate-vesta-license
+++ b/bin/v-activate-vesta-license
@@ -25,11 +25,11 @@ source $VESTA/conf/vesta.conf
 #                    Verifications                         #
 #----------------------------------------------------------#
 
 # Checking arg number
 check_args '2' "$#" 'MODULE LICENSE'
-
+is_user_format_valid "$license" "license"
 
 #----------------------------------------------------------#
 #                       Action                             #
 #----------------------------------------------------------#
 

Fixed code: is_user_format_valid "$license" "license"
CVE-2018-1002206: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.5
Published: 2018-07-25T17:29Z
Repository: https://github.com/adamhathcock/sharpcompress
Language: Unknown
Commit date: 2018-05-02 22:51:02 +0100
Commit message: Merge pull request #374 from odinn1984/feat/fail_on_outside_target_files

fix: prevent extracting archived files outside of target path
CVE-2014-125091: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 6d7168cbf12d1c183bacc5cd5678f6f5b0d518d2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222268.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-03-04T22:15Z
Repository: https://github.com/wp-plugins/cp-polls
Language: PHP
Files changed: cp-admin-int-message-list.inc.php
Commit date: 2014-11-23 20:27:25 +0000
Commit message: Update to avoid sql vulnerabilities.

git-svn-id: https://plugins.svn.wordpress.org/cp-polls/trunk@1031343 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/cp-admin-int-message-list.inc.php b/cp-admin-int-message-list.inc.php
index f31b2ee..4d1b832 100644
--- a/cp-admin-int-message-list.inc.php
+++ b/cp-admin-int-message-list.inc.php
@@ -12,11 +12,11 @@ global $wpdb;
 
 $message = "";
 
 if (isset($_GET['lu']) && $_GET['lu'] != '')
 {
-    $wpdb->query('UPDATE `'.$wpdb->prefix.$this->table_messages.'` SET paid='.esc_sql($_GET["status"]).' WHERE id='.$_GET['lu']);           
+    $wpdb->query('UPDATE `'.$wpdb->prefix.$this->table_messages.'` SET paid='.esc_sql($_GET["status"]).' WHERE id='.intval($_GET['lu']));           
     $message = "Item updated";        
 }
 else if (isset($_GET['ld']) && $_GET['ld'] != '')
 {
     $wpdb->query('DELETE FROM `'.$wpdb->prefix.$this->table_messages.'` WHERE id='.$_GET['ld']);       

Vulnerable code:     $wpdb->query('UPDATE `'.$wpdb->prefix.$this->table_messages.'` SET paid='.esc_sql($_GET["status"]).' WHERE id='.$_GET['lu']);           
Fixed code:     $wpdb->query('UPDATE `'.$wpdb->prefix.$this->table_messages.'` SET paid='.esc_sql($_GET["status"]).' WHERE id='.intval($_GET['lu']));
CVE-2021-21354: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox release process." In Pollbot before version 1.4.4 there is an open redirection vulnerability in the path of "https://pollbot.services.mozilla.com/". An attacker can redirect anyone to malicious sites. To Reproduce type in this URL: "https://pollbot.services.mozilla.com//evil.com/". Affected versions will redirect to that website when you inject a payload like "//evil.com/". This is fixed in version 1.4.4.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2021-03-08T19:15Z
Repository: https://github.com/mozilla/PollBot
Language: Python
Files changed: pollbot/middlewares.py, tests/test_views.py
Commit date: 2021-02-26 11:26:15 +0100
Commit message: Remove leading slashes in 404 redirections

When reaching http://server//page/ the server should not redirect to ``/page`` instead of ``//page``.

Diff: diff --git a/pollbot/middlewares.py b/pollbot/middlewares.py
index 1c5d381..249cb80 100644
--- a/pollbot/middlewares.py
+++ b/pollbot/middlewares.py
@@ -59,11 +59,11 @@ async def handle_any(request, response):
 
 
 async def handle_404(request, response):
     if 'json' not in response.headers['Content-Type']:
         if request.path.endswith('/'):
-            return web.HTTPFound(request.path.rstrip('/'))
+            return web.HTTPFound('/' + request.path.strip('/'))
         return web.json_response({
             "status": 404,
             "message": "Page '{}' not found".format(request.path)
         }, status=404)
     return response
diff --git a/tests/test_views.py b/tests/test_views.py
index 6b262fe..baeb56a 100644
--- a/tests/test_views.py
+++ b/tests/test_views.py
@@ -59,10 +59,15 @@ async def test_v1_redirects_to_v1_slash(cli):
 async def test_redirects_trailing_slashes(cli):
     resp = await check_response(cli, "/v1/firefox/54.0/", status=302, allow_redirects=False)
     assert resp.headers['Location'] == "/v1/firefox/54.0"
 
 
+async def test_redirects_strip_leading_slashes(cli):
+    resp = await check_response(cli, "//page/", status=302, allow_redirects=False)
+    assert resp.headers['Location'] == "/page"
+
+
 async def check_yaml_resource(cli, url, filename, **kwargs):
     with open(os.path.join(HERE, "..", "pollbot", filename)) as stream:
         content = yaml.safe_load(stream)
     resp = await cli.get(url, headers={"Host": "127.0.0.1"})
     content.update(**kwargs)

Vulnerable code:             return web.HTTPFound(request.path.rstrip('/'))
Fixed code:             return web.HTTPFound('/' + request.path.strip('/'))
async def test_redirects_strip_leading_slashes(cli):
    resp = await check_response(cli, "//page/", status=302, allow_redirects=False)
    assert resp.headers['Location'] == "/page"
CVE-2024-31457: Insufficient Information (NVD-CWE-noinfo)
value: gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -> Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-09T18:15Z
Repository: https://github.com/flipped-aurora/gin-vue-admin
Language: Go
Files changed: server/api/v1/system/sys_auto_code.go
Commit date: 2024-04-09 18:09:09 +0800
Commit message: fixed:修复GHSA-gv3w-m57p-3wc4

Diff: diff --git a/server/api/v1/system/sys_auto_code.go b/server/api/v1/system/sys_auto_code.go
index 3ca49a96..0711cdd8 100644
--- a/server/api/v1/system/sys_auto_code.go
+++ b/server/api/v1/system/sys_auto_code.go
@@ -3,10 +3,11 @@ package system
 import (
 	"errors"
 	"fmt"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/flipped-aurora/gin-vue-admin/server/global"
 	"github.com/flipped-aurora/gin-vue-admin/server/model/common/response"
 	"github.com/flipped-aurora/gin-vue-admin/server/model/system"
@@ -251,10 +252,15 @@ func (autoApi *AutoCodeApi) AutoPlug(c *gin.Context) {
 	err := c.ShouldBindJSON(&a)
 	if err != nil {
 		response.FailWithMessage(err.Error(), c)
 		return
 	}
+	if strings.Contains(a.PlugName, string(filepath.Separator)) {
+		response.FailWithMessage("插件名称不能包含"+string(filepath.Separator), c)
+		return
+	}
+
 	a.Snake = strings.ToLower(a.PlugName)
 	a.NeedModel = a.HasRequest || a.HasResponse
 	err = autoCodeService.CreatePlug(a)
 	if err != nil {
 		global.GVA_LOG.Error("预览失败!", zap.Error(err))

Fixed code: 	"path/filepath"
	if strings.Contains(a.PlugName, string(filepath.Separator)) {
		response.FailWithMessage("插件名称不能包含"+string(filepath.Separator), c)
		return
	}
CVE-2014-3990: Improper Restriction of XML External Entity Reference (CWE-611)
value: The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2018-03-20T21:29Z
Repository: https://github.com/opencart-ce/opencart-ce
Language: PHP
Files changed: upload/system/library/cart.php
Commit date: 2014-06-05 16:57:00 -0500
Commit message: Protection from object injection in cart

https://github.com/opencart/opencart/issues/1534

Diff: diff --git a/upload/system/library/cart.php b/upload/system/library/cart.php
index 689c6ab..bea9721 100644
--- a/upload/system/library/cart.php
+++ b/upload/system/library/cart.php
@@ -263,11 +263,11 @@ class Cart {
 
 		return $this->data;
 	}
 
 	public function add($product_id, $qty = 1, $option = array()) {
-		if (!$option) {
+		if (!$option || !is_array($option)) {
 			$key = (int)$product_id;
 		} else {
 			$key = (int)$product_id . ':' . base64_encode(serialize($option));
 		}
 
@@ -281,11 +281,11 @@ class Cart {
 
 		$this->data = array();
 	}
 
 	public function update($key, $qty) {
-		if ((int)$qty && ((int)$qty > 0)) {
+		if ((int)$qty && ((int)$qty > 0) && isset($this->session->data['cart'][$key])) {
 			$this->session->data['cart'][$key] = (int)$qty;
 		} else {
 			$this->remove($key);
 		}
 

Vulnerable code: 		if (!$option) {
		if ((int)$qty && ((int)$qty > 0)) {
Fixed code: 		if (!$option || !is_array($option)) {
		if ((int)$qty && ((int)$qty > 0) && isset($this->session->data['cart'][$key])) {
CVE-2014-3990: Server-Side Request Forgery (SSRF) (CWE-918)
value: The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 9.8
Published: 2018-03-20T21:29Z
Repository: https://github.com/opencart-ce/opencart-ce
Language: PHP
Files changed: upload/system/library/cart.php
Commit date: 2014-06-05 16:57:00 -0500
Commit message: Protection from object injection in cart

https://github.com/opencart/opencart/issues/1534

Diff: diff --git a/upload/system/library/cart.php b/upload/system/library/cart.php
index 689c6ab..bea9721 100644
--- a/upload/system/library/cart.php
+++ b/upload/system/library/cart.php
@@ -263,11 +263,11 @@ class Cart {
 
 		return $this->data;
 	}
 
 	public function add($product_id, $qty = 1, $option = array()) {
-		if (!$option) {
+		if (!$option || !is_array($option)) {
 			$key = (int)$product_id;
 		} else {
 			$key = (int)$product_id . ':' . base64_encode(serialize($option));
 		}
 
@@ -281,11 +281,11 @@ class Cart {
 
 		$this->data = array();
 	}
 
 	public function update($key, $qty) {
-		if ((int)$qty && ((int)$qty > 0)) {
+		if ((int)$qty && ((int)$qty > 0) && isset($this->session->data['cart'][$key])) {
 			$this->session->data['cart'][$key] = (int)$qty;
 		} else {
 			$this->remove($key);
 		}
 

Vulnerable code: 		if (!$option) {
		if ((int)$qty && ((int)$qty > 0)) {
Fixed code: 		if (!$option || !is_array($option)) {
		if ((int)$qty && ((int)$qty > 0) && isset($this->session->data['cart'][$key])) {
CVE-2013-0807: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the NewSectionPrompt function in include/tool/editing_page.php in gpEasy CMS 3.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the section parameter in a new_section action to index.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-03-28T15:55Z
Repository: https://github.com/oyejorge/gpEasy-CMS
Language: PHP
Files changed: include/tool/editing_page.php
Commit date: 2013-01-02 12:07:30 -0700
Commit message: new_section vulnerability fixed

Diff: diff --git a/include/tool/editing_page.php b/include/tool/editing_page.php
index 20a3551..f5dc3f1 100755
--- a/include/tool/editing_page.php
+++ b/include/tool/editing_page.php
@@ -449,11 +449,10 @@ class editing_page extends display{
 	 *
 	 */
 	function NewSectionPrompt(){
 		global $langmessage;
 
-
 		ob_start();
 		echo '<div class="inline_box">';
 		echo '<form method="post" action="'.common::GetUrl($this->title).'">';
 		echo '<h2>'.$langmessage['new_section_about'].'</h2>';
 
@@ -479,11 +478,11 @@ class editing_page extends display{
 
 		echo '</table>';
 
 		echo '<p>';
 		echo '<input type="hidden" name="last_mod" value="'.$this->fileModTime.'" />';
-		echo '<input type="hidden" name="section" value="'.$_GET['section'].'" />';
+		echo '<input type="hidden" name="section" value="'.htmlspecialchars($_GET['section']).'" />';
 		echo '<input type="hidden" name="cmd" value="add_section" />';
 		echo '<input type="submit" name="" value="'.$langmessage['save'].'" class="gpsubmit"/>';
 		echo ' <input type="button" name="" value="'.$langmessage['cancel'].'" class="admin_box_close gpcancel" />';
 		echo '</p>';
 

Vulnerable code: 
		echo '<input type="hidden" name="section" value="'.$_GET['section'].'" />';
Fixed code: 		echo '<input type="hidden" name="section" value="'.htmlspecialchars($_GET['section']).'" />';
CVE-2024-39899: Insufficient Information (NVD-CWE-noinfo)
value: PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-09T19:15Z
Repository: https://github.com/PrivateBin/PrivateBin
Language: Unknown
Commit date: 2024-07-09 20:33:54 +0200
Commit message: Merge branch 'shorten-non-self-url'

Diff: diff --cc CHANGELOG.md
index c97f7b4c,7ba2cb97..eb0392a4
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@@ -1,14 -1,14 +1,15 @@@
  # PrivateBin version history
  
  ## 1.7.4 (not yet released)
  * CHANGED: Saving markdown pastes uses `.md` extension instead of `.txt` (#1293)
  * CHANGED: Enable strict type checking in PHP (#1350)
 +* CHANGED: Various tweaks of the `bootstrap5` template, suggested by the community
  * FIXED: Reset password input field on creation of new paste (#1194)
  * FIXED: Allow database schema upgrade to skip versions (#1343)
  * FIXED: `bootstrap5` dark mode toggle unset on dark browser preference (#1340)
+ * FIXED: Prevent bypassing YOURLS proxy URL filter, allowing to shorten non-self URLs
  
  ## 1.7.3 (2024-05-13)
  * CHANGED: Various tweaks of the `bootstrap5` template, suggested by the community
  * CHANGED: Upgrading libraries to: DOMpurify 3.1.3
  * FIXED: Selected expiration not being applied, when using bootstrap template (#1309)
CVE-2022-24437: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 9.8
Published: 2022-05-01T16:15Z
Repository: https://github.com/feross/git-pull-or-clone
Language: JavaScript
Files changed: index.js
Commit date: 2022-04-06 13:13:53 +0300
Commit message: fix: fix command injection vector

Diff: diff --git a/index.js b/index.js
index c38c84d..aa40114 100644
--- a/index.js
+++ b/index.js
@@ -26,11 +26,11 @@ function gitPullOrClone (url, outPath, opts, cb) {
   })
 
   function gitClone () {
     // --depth implies --single-branch
     const flag = depth < Infinity ? '--depth=' + depth : '--single-branch'
-    const args = ['clone', flag, url, outPath]
+    const args = ['clone', flag, '--', url, outPath]
     debug('git ' + args.join(' '))
     spawn('git', args, {}, function (err) {
       if (err) err.message += ' (git clone) (' + url + ')'
       cb(err)
     })

Vulnerable code:     const args = ['clone', flag, url, outPath]
Fixed code:     const args = ['clone', flag, '--', url, outPath]