hitoshura25/cvefixes huggingface dataset:
CVE-2021-44512 (C, published 2021-12-07T03:15Z)
Description: value: World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/tmate-io/tmate-ssh-server
Files changed:
tmate-main.c
Commit message: Harden /tmp/tmate directory

Suggested by Matthias Gerstner


Vulnerable code:
	if ((mkdir(TMATE_WORKDIR, 0701)             < 0 && errno != EEXIST) ||
	    (mkdir(TMATE_WORKDIR "/sessions", 0703) < 0 && errno != EEXIST) ||
	/* The websocket server needs to access the /session dir to rename sockets */
	if ((chmod(TMATE_WORKDIR, 0701)             < 0) ||
	    (chmod(TMATE_WORKDIR "/sessions", 0703) < 0) ||

Fixed code:
static int check_owned_directory_mode(const char *path, mode_t expected_mode)
{
	struct stat stat;
	if (lstat(path, &stat))
		return -1;

	if (!S_ISDIR(stat.st_mode))
		return -1;

	if (stat.st_uid != getuid())
		return -1;

	if ((stat.st_mode & 07777) != expected_mode)
		return -1;

	return 0;
}

	if ((mkdir(TMATE_WORKDIR, 0700)             < 0 && errno != EEXIST) ||
	    (mkdir(TMATE_WORKDIR "/sessions", 0700) < 0 && errno != EEXIST) ||
	if ((chmod(TMATE_WORKDIR, 0700)             < 0) ||
	    (chmod(TMATE_WORKDIR "/sessions", 0700) < 0) ||
	if (check_owned_directory_mode(TMATE_WORKDIR, 0700) ||
	    check_owned_directory_mode(TMATE_WORKDIR "/sessions", 0700) ||
	    check_owned_directory_mode(TMATE_WORKDIR "/jail", 0700))
		tmate_fatal(TMATE_WORKDIR " and subdirectories has incorrect ownership/mode. "
			    "Try deleting " TMATE_WORKDIR " and try again");
CVE-2021-44513 (C, published 2021-12-07T03:15Z)
Description: value: Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/tmate-io/tmate-ssh-server
Files changed:
tmate-main.c
Commit message: Harden /tmp/tmate directory

Suggested by Matthias Gerstner


Vulnerable code:
	if ((mkdir(TMATE_WORKDIR, 0701)             < 0 && errno != EEXIST) ||
	    (mkdir(TMATE_WORKDIR "/sessions", 0703) < 0 && errno != EEXIST) ||
	/* The websocket server needs to access the /session dir to rename sockets */
	if ((chmod(TMATE_WORKDIR, 0701)             < 0) ||
	    (chmod(TMATE_WORKDIR "/sessions", 0703) < 0) ||

Fixed code:
static int check_owned_directory_mode(const char *path, mode_t expected_mode)
{
	struct stat stat;
	if (lstat(path, &stat))
		return -1;

	if (!S_ISDIR(stat.st_mode))
		return -1;

	if (stat.st_uid != getuid())
		return -1;

	if ((stat.st_mode & 07777) != expected_mode)
		return -1;

	return 0;
}

	if ((mkdir(TMATE_WORKDIR, 0700)             < 0 && errno != EEXIST) ||
	    (mkdir(TMATE_WORKDIR "/sessions", 0700) < 0 && errno != EEXIST) ||
	if ((chmod(TMATE_WORKDIR, 0700)             < 0) ||
	    (chmod(TMATE_WORKDIR "/sessions", 0700) < 0) ||
	if (check_owned_directory_mode(TMATE_WORKDIR, 0700) ||
	    check_owned_directory_mode(TMATE_WORKDIR "/sessions", 0700) ||
	    check_owned_directory_mode(TMATE_WORKDIR "/jail", 0700))
		tmate_fatal(TMATE_WORKDIR " and subdirectories has incorrect ownership/mode. "
			    "Try deleting " TMATE_WORKDIR " and try again");
CVE-2022-23596 (Java, published 2022-02-01T12:15Z)
Description: value: Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/junrar/junrar
Files changed:
src/main/java/com/github/junrar/Archive.java
src/test/java/com/github/junrar/AbnormalFilesTest.java
Commit message: fix: invalid subheader type would throw npe and make the extract loop

closes #73


Vulnerable code:
                            switch (subHead.getSubType()) {
            Arguments.of("abnormal/mainHeaderNull.rar", BadRarArchiveException.class)

Fixed code:
import com.github.junrar.rarfile.SubBlockHeaderType;
                            SubBlockHeaderType subType = subHead.getSubType();
                            if (subType == null) break;
                            switch (subType) {
            Arguments.of("abnormal/mainHeaderNull.rar", BadRarArchiveException.class),
            Arguments.of("abnormal/loop.rar", CorruptHeaderException.class)
CVE-2014-9906 (C, published 2016-08-19T21:59Z)
Description: value: Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/perl5-dbi/DBD-mysql
Files changed:
dbdimp.c
Commit message: fix use-after-free crash in RT #97625


Vulnerable code:
  if (!result)
    do_error(dbh, mysql_errno(imp_dbh->pmysql),
            mysql_error(imp_dbh->pmysql) ,mysql_sqlstate(imp_dbh->pmysql));

Fixed code:
  int	fresh = 0;
     fresh = 1;
  if (fresh && !result) {
      /* Prevent leaks, but do not free in case of a reconnect. See #97625 */
      do_error(dbh, mysql_errno(imp_dbh->pmysql),
              mysql_error(imp_dbh->pmysql) ,mysql_sqlstate(imp_dbh->pmysql));
      imp_dbh->pmysql = NULL;
  }
    if(imp_dbh->pmysql)
        do_error(dbh, mysql_errno(imp_dbh->pmysql),
                mysql_error(imp_dbh->pmysql) ,mysql_sqlstate(imp_dbh->pmysql));
CVE-2015-8949 (Unknown, published 2016-08-19T21:59Z)
Description: value: Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/perl5-dbi/DBD-mysql
Files changed:
Commit message: Merge pull request #45 from hannob/master

Fix use after free error.

Vulnerable code:

Fixed code:
CVE-2016-1246 (C, published 2016-10-05T16:59Z)
Description: value: Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/perl5-dbi/DBD-mysql
Files changed:
dbdimp.c
Commit message: Do not use unsafe sprintf w/variable length input

This can cause a  buffer overflow to occur when reporting error
message about validation of (untrusted) user input parameters.


Vulnerable code:
  char err_msg[64];
      sprintf(err_msg,
              param_num, neatsvpv(value,0));

Fixed code:
  char *err_msg;
      err_msg = SvPVX(sv_2mortal(newSVpvf(
              param_num, neatsvpv(value,0))));
CVE-2016-1251 (Other, published 2016-11-29T20:59Z)
Description: value: There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/perl5-dbi/DBD-mysql
Files changed:
dbdimp.c
t/40server_prepare_crash.t
Commit message: Fix use-after-free for repeated fetchrow_arrayref calls when mysql_server_prepare=1

Function dbd_st_fetch() via Renew() can reallocate output buffer for
mysql_stmt_fetch() call. But it does not update pointer to that buffer in
imp_sth->stmt structure initialized by mysql_stmt_bind_result() function.
That leads to use-after-free in any mysql function which access
imp_sth->stmt structure (e.g. mysql_stmt_fetch()).

This patch fix this problem and properly updates pointer in imp_sth->stmt
structure after Renew() call.

Test 40server_prepare_crash.t is extended to check for that use-after-free
crash.


Vulnerable code:
plan tests => 17;
ok $dbh->do("CREATE TEMPORARY TABLE t (i INTEGER NOT NULL, n TEXT)");
ok my $sth = $dbh->prepare("SELECT * FROM t WHERE i=? AND n=?");

Fixed code:
          imp_sth->stmt->bind[i].buffer_length = fbh->length;
          imp_sth->stmt->bind[i].buffer = (char *)fbh->data;
plan tests => 39;
my $sth;
ok $dbh->do("CREATE TEMPORARY TABLE t (i INTEGER NOT NULL, n LONGBLOB)");

ok $sth = $dbh->prepare("INSERT INTO t(i, n) VALUES(?, ?)");
ok $sth->execute(1, "x" x 10);
ok $sth->execute(2, "x" x 100);
ok $sth->execute(3, "x" x 1000);
ok $sth->execute(4, "x" x 10000);
ok $sth->execute(5, "x" x 100000);
ok $sth->execute(6, "x" x 1000000);
ok $sth->finish();

ok $sth = $dbh->prepare("SELECT * FROM t WHERE i=? AND n=?");
my $test;
ok $sth = $dbh->prepare("SELECT i,n FROM t WHERE i = ?");

ok $sth->execute(1);
ok $sth->fetchrow_arrayref();

ok $sth->execute(2);
$test = map { $_ } 'a';
ok $sth->fetchrow_arrayref();

ok $sth->execute(3);
$test = map { $_ } 'b' x 10000000; # try to reuse released memory
ok $sth->fetchrow_arrayref();

ok $sth->execute(4);
$test = map { $_ } 'cd' x 10000000; # try to reuse of released memory
ok $sth->fetchrow_arrayref();

ok $sth->execute(5);
$test = map { $_ } 'efg' x 10000000; # try to reuse of released memory
ok $sth->fetchrow_arrayref();

ok $sth->execute(6);
$test = map { $_ } 'hijk' x 10000000; # try to reuse of released memory
ok $sth->fetchrow_arrayref();

ok $sth->finish();
CVE-2018-7663 (PHP, published 2018-03-05T07:29Z)
Description: value: An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile (resources/views/layouts/app.blade.php) allows for server-side template injection of arbitrary JavaScript.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/voten-co/voten
Files changed:
app/Http/helpers.php
resources/views/layouts/app.blade.php
Commit message: adds and uses strToHex helper


Vulnerable code:
        bio: `{!! Auth::user()->bio !!}`,

Fixed code:

if (!function_exists('strToHex')) {
    /**
     * Converts timestamp to ISO8601 format.
     *
     * @param string $string
     *
     * @return string
     */
    function strToHex($string) {
        $hex = bin2hex($string);
        $hex = chunk_split($hex, 2, "\\x");
        $hex = "\\x" . substr($hex, 0, -2);

        return $hex;
    }
}
        bio: '{!! strToHex(Auth::user()->bio) !!}',
CVE-2022-31135 (C++, published 2022-07-07T18:15Z)
Description: value: Akashi is an open source server implementation of the Attorney Online video game based on the Ace Attorney universe. Affected versions of Akashi are subject to a denial of service attack. An attacker can use a specially crafted evidence packet to make an illegal modification, causing a server crash. This can be used to mount a denial-of-service exploit. Users are advised to upgrade. There is no known workaround for this issue.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-129 \u2014 Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Repository: https://github.com/AttorneyOnline/akashi
Files changed:
core/src/packets.cpp
Commit message: Fix out of bounds crash on evidence

Vulnerable code:
    if (is_int && idx <= area->evidence().size() && idx >= 0) {
    if (is_int && idx <= area->evidence().size() && idx >= 0) {

Fixed code:
    if (is_int && idx < area->evidence().size() && idx >= 0) {
    if (is_int && idx < area->evidence().size() && idx >= 0) {
CVE-2020-21665 (PHP, published 2020-11-17T15:15Z)
Description: value: In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/karsonzhang/fastadmin
Files changed:
application/admin/controller/Ajax.php
application/common/controller/Backend.php
application/index/controller/User.php
Commit message: 修复邮箱验证码错误
修复排序表名安全检测
修复Selectpage编辑时分页大小错误


Vulnerable code:
                if ($type == 'content')
                if ($type == 'template')
                if ($type == 'addons')
                    $captchaResult = Ems::check($mobile, $captcha, 'register');

Fixed code:
use think\Validate;
        if (!Validate::is($table, "alphaDash")) {
            $this->error();
        }
                if ($type == 'content') {
                }
                if ($type == 'template') {
                }
                if ($type == 'addons') {
                }
            $pagesize = null;
                    $captchaResult = Ems::check($email, $captcha, 'register');
CVE-2010-1630 (PHP, published 2010-05-19T22:30Z)
Description: value: Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances related to a "global announcement."
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/phpbb/phpbb3
Files changed:
phpBB/docs/CHANGELOG.html
phpBB/posting.php
Commit message: Only use forum id supplied for posting if global announcement detected. (Reported by nickvergessen)

git-svn-id: file:///svn/phpbb/branches/phpBB-3_0_0@9499 89ea8834-ac86-4346-8a33-228a782c2dd0


Vulnerable code:
		<li>[Fix] Fix race condition for updating post/topic/etc. counter. (reported by BartVB)</li>
		<li>[Fix] Fix bug in postgresql db layer for LIMIT ALL clauses (reported by JRSweets)</li>
		<li>[Fix] Make sure additional information for accessibility is always exposed to screen readers (Bug #44335 - patch by MarcoZ)</li>
		<li>[Change] Add IN_PHPBB check to generated cache files. (reported by bantu)</li>
		<li>[Change] Performance improvements for native fulltext search (patch by Paul)</li>
		<li>[Change] Changed jumpto() JS function to be more fail-safe. (But #27635 - patch by peterkclee)</li>

Fixed code:
		<li>[Fix] Fix race condition for updating post/topic/etc. counter. (Reported by BartVB)</li>
		<li>[Fix] Fix bug in postgresql db layer for LIMIT ALL clauses (Reported by JRSweets)</li>
		<li>[Fix] Make sure additional information for accessibility is always exposed to screen readers (Bug #44335 - Patch by MarcoZ)</li>
		<li>[Change] Add IN_PHPBB check to generated cache files. (Reported by bantu)</li>
		<li>[Change] Performance improvements for native fulltext search (Patch by Paul)</li>
		<li>[Change] Changed jumpto() JS function to be more fail-safe. (But #27635 - Patch by peterkclee)</li>
		<li>[Sec] Only use forum id supplied for posting if global announcement detected. (Reported by nickvergessen)</li>
		// Force forum id
		$sql = 'SELECT forum_id
			FROM ' . TOPICS_TABLE . '
			WHERE topic_id = ' . $topic_id;
		$result = $db->sql_query($sql);
		$f_id = (int) $db->sql_fetchfield('forum_id');
		$db->sql_freeresult($result);

		$forum_id = (!$f_id) ? $forum_id : $f_id;

		// Force forum id
		$sql = 'SELECT forum_id
			FROM ' . POSTS_TABLE . '
			WHERE post_id = ' . $post_id;
		$result = $db->sql_query($sql);
		$f_id = (int) $db->sql_fetchfield('forum_id');
		$db->sql_freeresult($result);

		$forum_id = (!$f_id) ? $forum_id : $f_id;
CVE-2023-34105 (C++, published 2023-06-12T17:15Z)
Description: value: SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-server` server is vulnerable to a drive-by command injection. An attacker may send a request to the `/api/v1/snapshots` endpoint containing any commands to be executed as part of the body of the POST request. This issue may lead to Remote Code Execution (RCE). Versions 5.0.157, 5.0-b1, and 6.0.48 contain a fix.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/ossrs/srs
Files changed:
trunk/doc/CHANGELOG.md
trunk/research/api-server/server.go
trunk/src/core/srs_core_version5.hpp
trunk/src/core/srs_core_version6.hpp
Commit message: Fix command injection in api-server for HTTP callback. v5.0.157, v6.0.48


Vulnerable code:
	param := fmt.Sprintf("%v -i %v -vf fps=1 -vcodec png -f image2 -an -y -vframes %v -y %v", ffmpegPath, inputUrl, v.vframes, normalPicPath)
	log.Println(fmt.Sprintf("start snapshot, cmd param=%v", param))
	cmd := exec.CommandContext(timeoutCtx, "/bin/bash", "-c", param)
#define VERSION_REVISION    156
#define VERSION_REVISION    47

Fixed code:
* v6.0, 2023-06-05, Fix command injection in demonstration api-server for HTTP callback. v6.0.48
* v5.0, 2023-06-05, Fix command injection in demonstration api-server for HTTP callback. v5.0.157
	params := []string{
		"-i", inputUrl,
		"-vf", "fps=1",
		"-vcodec", "png",
		"-f", "image2",
		"-an",
		"-vframes", strconv.Itoa(v.vframes),
		"-y", normalPicPath,
	}
	log.Println(fmt.Sprintf("start snapshot, cmd param=%v %v", ffmpegPath, strings.Join(params, " ")))
	cmd := exec.CommandContext(timeoutCtx, ffmpegPath, params...)
#define VERSION_REVISION    157
#define VERSION_REVISION    48
CVE-2022-2583 (Go, published 2022-12-27T22:15Z)
Description: value: A race condition can cause incorrect HTTP request routing.
Severity: nan (CVSS v3 base score: 3.7)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/ntbosscher/gobase
Files changed:
auth/httpauth/main.go
Commit message: fix race condition in httpauth where the incorrect handler could be called for some calls


Vulnerable code:
	server := middleware(config)
	router.Use(func(h http.Handler) http.Handler {
		server.next = h
		return server
func middleware(config Config) *server {
	next                     http.Handler
const defaultLoginEndpoint = "/api/auth/login"
const defaultRefreshEndpoint = "/api/auth/refresh"
const defaultLogoutEndpoint = "/api/auth/logout"
const defaultRegisterEndpoint = "/api/auth/register"


Fixed code:
const defaultLoginEndpoint = "/api/auth/login"
const defaultRefreshEndpoint = "/api/auth/refresh"
const defaultLogoutEndpoint = "/api/auth/logout"
const defaultRegisterEndpoint = "/api/auth/register"

	server := newServer(config)
	router.Use(func(handler http.Handler) http.Handler {
		return cloneServer(server, handler)
func cloneServer(src *server, next http.Handler) *server {
	clone := &server{}
	*clone = *src
	clone.next = next
	return clone
}

func newServer(config Config) *server {
	next http.Handler
CVE-2019-19576 (PHP, published 2019-12-04T18:15Z)
Description: value: class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/verot/class.upload.php
Files changed:
src/class.upload.php
Commit message: blacklist .phar extension


Vulnerable code:
                    || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js)$/i', $this->file_src_name)

Fixed code:
                    || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js|phar)$/i', $this->file_src_name)