cwielenb/CNCF-Dataset huggingface dataset:
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: sql-error-conditions-collation-mismatch-error-class.md

layout: global title: COLLATION_MISMATCH error class displayTitle: COLLATION_MISMATCH error class license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. <!-- DO NOT EDIT THIS FILE. It was generated automatically by `org.apache.spark.SparkThrowableSuite`. --> Could not determine which collation to use for string functions and operators. This error class has the following derived error classes: Error occurred due to the mismatch between explicit collations: `<explicitTypes>`. Decide on a single explicit collation and remove others. Error occurred due to the mismatch between multiple implicit non-default collations. Use COLLATE function to set the collation explicitly.
Project: FOSSA (Provisioning / Security & Compliance)
File: report.md

The report command downloads a report of the most-recent scan of your FOSSA project. This command is usually run immedately after `fossa analyze` or `fossa test` The report type must be specified to successfully run, for example: ```sh fossa report attribution ``` `fossa report` supports the supported by all commands. `fossa report attribution` - A report that contains information about your dependencies and their authors. For more info about attributions, check the . By default, `fossa report` waits a maximum of 3600 seconds (1 hour) for report contents. To override the default timeout, use, e.g.: ```sh fossa report attribution --timeout 60 ``` Where `60` is the maximum number of seconds to wait for the report to be downloaded. `fossa report` supports customizing the format used to render a report via the `--format` flag. Available options are: `csv` `cyclonedx-json` `cyclonedx-xml` `html` `json` `markdown` `spdx` `spdx-json` `text` For example, to render the report in JSON format, use `fossa report attribution --format json`. In earlier versions of the FOSSA CLI, the `--json` flag was used to denote rendering the report in JSON format. For backwards compatibility, this flag is still supported and takes precedence over the `--format` flag if present. However, it is deprecated, and should be replaced with `--format json` to prevent future changes from breaking this behavior. FOSSA supported a compatibility script that converts FOSSAv2 attribution report output to the same format as that in FOSSAv1. This script was supported until the end of April 2022 and was included in the release assets, under the name `compat-attribution`. After April 2022, it's no longer supported, but can still be found on older releases, for example https://github.com/fossas/fossa-cli/releases/tag/v3.2.12. We strongly recommend not trying to use this script, and instead migrating to the new report format. To use this compatibility script: Download and extract `compat-attribution` for your platform to the same place as the `fossa` binary. Run `fossa report attribution --format json`, piping its output to `compat-attribution`. For example, `fossa report attribution --format json | compat-attribution` Parse the resulting output as you would have from FOSSAv1. All `fossa` commands support the following FOSSA-project-related flags: | Name | Short | Description | | - | -- | | | `--project 'some project'` | `-p` | Override the detected project name | | `--revision 'some revision'` | `-r` | -Override the detected project revision | | `--fossa-api-key 'my-api-key'` | | An alternative to using the `FOSSAAPIKEY` environment variable to specify a FOSSA API key | | `--endpoint 'https://example.com'` | `-e` | Override the FOSSA API server base URL | | `--config /path/to/file` | `-c` | Path to a including filename. By default we look for `.fossa.yml` in base working directory. |
Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: v1.2.1.md

Container order change clashes with readiness probes (https://github.com/dapr/dapr/issues/3304) This is a fix for a regression caused by making Dapr the first container in the pod during injection, which causes a long pod startup delay in cases where apps have readiness probes and has Dapr waiting for the app to respond on a given port. This causes Dapr to detect the app is running only when the failure threshold of the user app is met. You should upgrade to this version if all the following conditions are met: You are using Dapr on Kubernetes Your app has readiness probes Your app configured a `dapr.io/app-port` setting
Project: OAuth2 Proxy (Provisioning / Key Management)
File: behaviour.md

id: behaviour title: Behaviour Any request passing through the proxy (and not matched by `--skip-auth-regex`) is checked for the proxy's session cookie (`--cookie-name`) (or, if allowed, a JWT token - see `--skip-jwt-bearer-tokens`). If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with `Accept: application/json`, in which case 401 Unauthorized is returned) After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration) Notice that the proxy also provides a number of useful .
Project: Trivy (Provisioning / Security & Compliance)
File: pull_request_template.md

Close #XXX [ ] #XXX [ ] #YYY Remove this section if you don't have related PRs. to this repository. in the PR title. [ ] I've added tests that prove my fix is effective or that my feature works. with the relevant information (if needed). [ ] I've added usage information (if the PR introduces new options) [ ] I've included a "before" and "after" example to the description (if the PR is a user interface change).
Project: KICS (Provisioning / Security & Compliance)
File: 140869ea-25f2-40d4-a595-0c0da135114e.md

title: RDS Instance Log Connections Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 140869ea-25f2-40d4-a595-0c0da135114e Query name: RDS Instance Log Connections Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: 'log_connections' parameter should be set to ON for RDS instances<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" parameters = [{ name = "innodblargeprefix" value = "ON" },{ name = "connect_timeout" value = "50" }] } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="14" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" parameters = [{ name = "innodblargeprefix" value = "ON" },{ name = "connect_timeout" value = "50" },{ name = "log_connections" value = "OFF" }] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" } ``` ```tf title="Negative test num. 1 - tf file" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" parameters = [{ name = "innodblargeprefix" value = "ON" },{ name = "connect_timeout" value = "50" },{ name = "log_connections" value = "ON" }] } ```
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: CHANGELOG.md

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by `Decrypt` or `DecryptMulti`. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting. This release makes some breaking changes in order to more thoroughly address the vulnerabilities discussed in [Three New Attacks Against JSON Web Tokens][1], "Sign/encrypt confusion", "Billion hash attack", and "Polyglot token". Limit JWT encryption types (exclude password or public key types) (#78) Enforce minimum length for HMAC keys (#85) jwt: match any audience in a list, rather than requiring all audiences (#81) jwt: accept only Compact Serialization (#75) jws: Add expected algorithms for signatures (#74) Require specifying expected algorithms for ParseEncrypted, ParseSigned, ParseDetached, jwt.ParseEncrypted, jwt.ParseSigned, jwt.ParseSignedAndEncrypted (#69, #74) Usually there is a small, known set of appropriate algorithms for a program to use and it's a mistake to allow unexpected algorithms. For instance the "billion hash attack" relies in part on programs accepting the PBES2 encryption algorithm and doing the necessary work even if they weren't specifically configured to allow PBES2. Revert "Strip padding off base64 strings" (#82) The specs require base64url encoding without padding. Minimum supported Go version is now 1.21 ParseSignedCompact, ParseSignedJSON, ParseEncryptedCompact, ParseEncryptedJSON. These allow parsing a specific serialization, as opposed to ParseSigned and ParseEncrypted, which try to automatically detect which serialization was provided. It's common to require a specific serialization for a specific protocol - for instance JWT requires Compact serialization. Limit decompression output size to prevent a DoS. Backport from v4.0.1. DecryptMulti: handle decompression error (#19) jwe/CompactSerialize: improve performance (#67) Increase the default number of PBKDF2 iterations to 600k (#48) Return the proper algorithm for ECDSA keys (#45) Add Thumbprint support for opaque signers (#38) Security issue: an attacker specifying a large "p2c" value can cause JSONWebEncryption.Decrypt and JSONWebEncryption.DecryptMulti to consume large amounts of CPU, causing a DoS. Thanks to Matt Schwager (@mschwager) for the disclosure and to Tom Tervoort for originally publishing the category of attack. https://i.blackhat.com/BH-US-23/Presentations/US-23-Tervoort-Three-New-Attacks-Against-JSON-Web-Tokens.pdf Limit decompression output size to prevent a DoS. Backport from v4.0.1.
Project: YDB (App Definition and Development / Database)
File: sample.md

Building a random sample from the data source specified in `FROM`. `TABLESAMPLE` is part of the SQL standard and works as follows: The operating mode is specified: `BERNOULLI` means "slowly, straightforwardly going through all the data, but in a truly random way". `SYSTEM` uses knowledge about the physical data storage of data to avoid full data scans, but somewhat sacrificing randomness of the sample. The data is split into sufficiently large blocks, and the whole data blocks are sampled. For applied calculations on sufficiently large tables, the result may well be consistent. The size of the random sample is indicated as a percentage after the operating mode, in parentheses. To manage the block size in the `SYSTEM` mode, use the `yt.SamplingIoBlockSize` pragma. Optionally, it can be followed by the `REPEATABLE` keyword and an integer in parentheses to be used as a seed for a pseudorandom number generator. `SAMPLE` is a shorter alias without sophisticated settings and sample size specified as a fraction. It currently corresponds to the `BERNOULLI` mode. {% note info %} In the `BERNOULLI` mode, if the `REPEATABLE` keyword is added, the seed is mixed with the chunk ID for each chunk in the table. That's why sampling from different tables with the same content might produce different results. {% endnote %} Examples: ```yql SELECT * FROM my_table TABLESAMPLE BERNOULLI(1.0) REPEATABLE(123); -- one percent of the table ``` ```yql SELECT * FROM my_table TABLESAMPLE SYSTEM(1.0); -- about one percent of the table ``` ```yql SELECT * FROM my_table SAMPLE 1.0 / 3; -- one-third of the table ```
Project: KICS (Provisioning / Security & Compliance)
File: 801f0c6a-a834-4467-89c6-ddecffb46b5a.md

title: Link JSON Reference Does Not Exists hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 801f0c6a-a834-4467-89c6-ddecffb46b5a Query name: Link JSON Reference Does Not Exists Platform: OpenAPI Severity: <span style="color:#5bc0de">Info</span> Category: Structure and Semantics URL: Link reference should exists on components field<br> ```json title="Positive test num. 1 - json file" hl_lines="26" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "success", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/MyObject" } } } }, "links": { "$ref": "#/components/links/APIWrongRepository" } } } } } }, "components": { "schemas": { "MyObject": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } } }, "links": { "APIRepository": { "operationId": "listVersionsv2" } } } } ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="20" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': description: success content: application/json: schema: type: array items: "$ref": "#/components/schemas/MyObject" links: "$ref": "#/components/links/APIWrongRepository" components: schemas: MyObject: type: object properties: id: type: string name: type: string links: APIRepository: operationId: listVersionsv2 ``` ```json title="Negative test num. 1 - json file" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "success", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/MyObject" } } } }, "links": { "$ref": "#/components/links/APIRepository" } } } } } }, "components": { "schemas": { "MyObject": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } } }, "links": { "APIRepository": { "operationId": "listVersionsv2" } } } } ``` ```yaml title="Negative test num. 2 - yaml file" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': description: success content: application/json: schema: type: array items: "$ref": "#/components/schemas/MyObject" links: "$ref": "#/components/links/APIRepository" components: schemas: MyObject: type: object properties: id: type: string name: type: string links: APIRepository: operationId: listVersionsv2 ```
Project: NeuVector (Provisioning / Security & Compliance)
File: README.md

](https://travis-ci.org/kubernetes-sigs/yaml) kubernetes-sigs/yaml is a permanent fork of . A wrapper around designed to enable a better way of handling YAML when marshaling to and from structs. In short, this library first converts YAML to JSON using go-yaml and then uses `json.Marshal` and `json.Unmarshal` to convert to or from the struct. This means that it effectively reuses the JSON struct tags as well as the custom JSON methods `MarshalJSON` and `UnmarshalJSON` unlike go-yaml. For a detailed overview of the rationale behind this method, . This package uses and therefore supports . Caveat #1: When using `yaml.Marshal` and `yaml.Unmarshal`, binary data should NOT be preceded with the `!!binary` YAML tag. If you do, go-yaml will convert the binary data from base64 to native binary data, which is not compatible with JSON. You can still use binary in your YAML files though - just store them without the `!!binary` tag and decode the base64 in your code (e.g. in the custom JSON methods `MarshalJSON` and `UnmarshalJSON`). This also has the benefit that your YAML and your JSON binary data will be decoded exactly the same way. As an example: ``` BAD: exampleKey: !!binary gIGC GOOD: exampleKey: gIGC ... and decode the base64 data in your code. ``` Caveat #2: When using `YAMLToJSON` directly, maps with keys that are maps will result in an error since this is not supported by JSON. This error will occur in `Unmarshal` as well since you can't unmarshal map keys anyways since struct fields can't be keys. To install, run: ``` $ go get sigs.k8s.io/yaml ``` And import using: ``` import "sigs.k8s.io/yaml" ``` Usage is very similar to the JSON library: ```go package main import ( "fmt" "sigs.k8s.io/yaml" ) type Person struct { Name string `json:"name"` // Affects YAML field names too. Age int `json:"age"` } func main() { // Marshal a Person struct to YAML. p := Person{"John", 30} y, err := yaml.Marshal(p) if err != nil { fmt.Printf("err: %v\n", err) return } fmt.Println(string(y)) /* Output: age: 30 name: John */ // Unmarshal the YAML back into a Person struct. var p2 Person err = yaml.Unmarshal(y, &p2) if err != nil { fmt.Printf("err: %v\n", err) return } fmt.Println(p2) /* Output: {John 30} */ } ``` `yaml.YAMLToJSON` and `yaml.JSONToYAML` methods are also available: ```go package main import ( "fmt" "sigs.k8s.io/yaml" ) func main() { j := []byte(`{"name": "John", "age": 30}`) y, err := yaml.JSONToYAML(j) if err != nil { fmt.Printf("err: %v\n", err) return } fmt.Println(string(y)) /* Output: age: 30 name: John */ j2, err := yaml.YAMLToJSON(y) if err != nil { fmt.Printf("err: %v\n", err) return } fmt.Println(string(j2)) /* Output: {"age":30,"name":"John"} */ } ```
Project: ClickHouse (App Definition and Development / Database)
File: v23.3.8.21-lts.md

sidebar_position: 1 sidebar_label: 2023 Fix backward compatibility for IP types hashing in aggregate functions (). Fix segfault in MathUnary (). Fix for moving 'IN' conditions to PREWHERE (). Fix reading from empty column in `parseSipHashKey` (). Check refcount in `RemoveManyObjectStorageOperation::finalize` instead of `execute` (). Allow parametric UDFs (). Decoupled commits from for backports (). Fix MergeTreeMarksLoader segfaulting if marks file is longer than expected ().
Project: NeuVector (Provisioning / Security & Compliance)
File: CommandLines.md

In neuvector/ directory ``` make fleet ``` In neuvector/ parent directory ``` cp neuvector/Makefile . make ctrl_image make enf_image ``` CTRLPATHDEBUG Enable control path debug. Default ```0``` DISABLEPACKETCAPTURE Disable packet capture CTRLPERSISTCONFIG Enable save and restore persisted configuratons. FEDSERVERPORT Federation master server port NVPLATFORMINFO Allow user to special container port information E.g. NVPLATFORMINFO=platform=tuniu;if-eth0=global E.g. NVPLATFORMINFO=platform=Docker -- bypass the container-based platform detection E.g. NVPLATFORMINFO=platform=Kubernetes:GKE -- specify platform and flavor at the same time CONTAINERNETTYPE Options are 'default' and 'macvlan' NVSYSTEMGROUPS Specify the services that match the filters as system contaienr. NVSYSTEMGROUPS=ucp-*;node SCANNERDOCKERURL Special the docker socket. Used to scan images that are not in the registry. Eg. unix:///var/run/docker.sock, tcp://10.1.2.3:2376 MANAGER_SSL Expose HTTP instead of HTTPS for client connection. MANAGER_SSL=off `docker run -itd --privileged --name neuvector.controller -e CLUSTERJOINADDR=$controller_ip -p 18301:18301 -p 18301:18301/udp -p 18300:18300 -p 18400:18400 -p 10443:10443 -v /var/neuvector:/var/neuvector -v /var/run/docker.sock:/var/run/docker.sock -v /proc:/host/proc:ro -v /sys/fs/cgroup/:/host/cgroup/:ro neuvector/controller ` `docker run -itd --privileged --name neuvector.enforcer -e CLUSTERJOINADDR=$controller_ip --pid=host -p 18301:18301 -p 18301:18301/udp -p 18401:18401 -v /var/neuvector:/var/neuvector -v /var/run/docker.sock:/var/run/docker.sock -v /proc:/host/proc:ro -v /sys/fs/cgroup/:/host/cgroup/:ro neuvector/enforcer ` `docker run -itd --name neuvector.manager -e CTRLSERVERIP=$controller_ip -p 8443:8443 neuvector/manager ` `docker run --name neuvector.scanner --rm -e CLUSTERJOINADDR=$controller_ip neuvector/scanner ` `docker run --name neuvector.scanner --rm -e SCANNERREPOSITORY=ubuntu -e SCANNERTAG=16.04 -e -v /var/run/docker.sock:/var/run/docker.sock -v /var/neuvector:/var/neuvector neuvector/scanner `
Project: KICS (Provisioning / Security & Compliance)
File: 316278b3-87ac-444c-8f8f-a733a28da60f.md

title: AmazonMQ Broker Encryption Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 316278b3-87ac-444c-8f8f-a733a28da60f Query name: AmazonMQ Broker Encryption Disabled Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: AmazonMQ Broker should have Encryption Options defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Description: "Create a basic ActiveMQ broker" Resources: BasicBroker: Type: "AWS::AmazonMQ::Broker" Properties: AutoMinorVersionUpgrade: "false" BrokerName: MyBasicBroker DeploymentMode: SINGLE_INSTANCE EngineType: ActiveMQ EngineVersion: "5.15.0" HostInstanceType: mq.t2.micro PubliclyAccessible: "true" Users: ConsoleAccess: "true" Groups: MyGroup Password: Ref: "BrokerPassword" Username: Ref: "BrokerUsername" ``` ```json title="Positive test num. 2 - json file" hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a basic ActiveMQ broker", "Resources": { "BasicBroker": { "Type": "AWS::AmazonMQ::Broker", "Properties": { "HostInstanceType": "mq.t2.micro", "PubliclyAccessible": "true", "Users": [ { "ConsoleAccess": "true", "Groups": [ "MyGroup" ], "Password": { "Ref": "BrokerPassword" }, "Username": { "Ref": "BrokerUsername" } } ], "AutoMinorVersionUpgrade": "false", "BrokerName": "MyBasicBroker", "DeploymentMode": "SINGLE_INSTANCE", "EngineType": "ActiveMQ", "EngineVersion": "5.15.0" } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: "Create a basic ActiveMQ broker" Resources: BasicBroker: Type: "AWS::AmazonMQ::Broker" Properties: AutoMinorVersionUpgrade: "false" BrokerName: MyBasicBroker DeploymentMode: SINGLE_INSTANCE EncryptionOptions: UseAwsOwnedKey: true EngineType: ActiveMQ EngineVersion: "5.15.0" HostInstanceType: mq.t2.micro PubliclyAccessible: "true" Users: ConsoleAccess: "true" Groups: MyGroup Password: Ref: "BrokerPassword" Username: Ref: "BrokerUsername" ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a basic ActiveMQ broker", "Resources": { "BasicBroker": { "Type": "AWS::AmazonMQ::Broker", "Properties": { "BrokerName": "MyBasicBroker", "DeploymentMode": "SINGLE_INSTANCE", "EncryptionOptions": { "UseAwsOwnedKey": true }, "EngineType": "ActiveMQ", "EngineVersion": "5.15.0", "HostInstanceType": "mq.t2.micro", "Users": [ { "ConsoleAccess": "true", "Groups": [ "MyGroup" ], "Password": { "Ref": "BrokerPassword" }, "Username": { "Ref": "BrokerUsername" } } ], "AutoMinorVersionUpgrade": "false", "PubliclyAccessible": "true" } } } } ```