hitoshura25/cvefixes huggingface dataset:
CVE-2022-4849 (Go, published 2022-12-29T18:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/usememos/memos
Files changed:
server/acl.go
server/server.go
Commit message: chore: fix CSRF (#876)



Vulnerable code:

Fixed code:
		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4850 (Go, published 2022-12-29T18:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/usememos/memos
Files changed:
server/acl.go
server/server.go
Commit message: chore: fix CSRF (#876)



Vulnerable code:

Fixed code:
		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4865 (TypeScript, published 2022-12-31T09:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
web/src/labs/marked/parser/Bold.ts
web/src/labs/marked/parser/BoldEmphasis.ts
web/src/labs/marked/parser/Emphasis.ts
web/src/labs/marked/parser/Link.ts
Commit message: chore: fix XSS in renderer (#880)



Vulnerable code:
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [InlineCode, BoldEmphasis, Emphasis, Bold]);

Fixed code:
import PlainText from "./PlainText";
  const parsedContent = marked(matchResult[1], [], [Link, PlainText]);
import PlainText from "./PlainText";
  const parsedContent = marked(matchResult[1], [], [Link, PlainText]);
import PlainText from "./PlainText";
  const parsedContent = marked(matchResult[1], [], [Link, PlainText]);
import PlainText from "./PlainText";
  const parsedContent = marked(matchResult[1], [], [InlineCode, BoldEmphasis, Emphasis, Bold, PlainText]);
CVE-2022-4866 (TypeScript, published 2022-12-31T09:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
web/src/labs/marked/parser/Bold.ts
web/src/labs/marked/parser/BoldEmphasis.ts
web/src/labs/marked/parser/Emphasis.ts
web/src/labs/marked/parser/Link.ts
Commit message: chore: fix XSS in renderer (#880)



Vulnerable code:
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [InlineCode, BoldEmphasis, Emphasis, Bold]);

Fixed code:
import PlainText from "./PlainText";
  const parsedContent = marked(matchResult[1], [], [Link, PlainText]);
import PlainText from "./PlainText";
  const parsedContent = marked(matchResult[1], [], [Link, PlainText]);
import PlainText from "./PlainText";
  const parsedContent = marked(matchResult[1], [], [Link, PlainText]);
import PlainText from "./PlainText";
  const parsedContent = marked(matchResult[1], [], [InlineCode, BoldEmphasis, Emphasis, Bold, PlainText]);
CVE-2023-0108 (Go, published 2023-01-07T04:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
server/common.go
server/resource.go
server/server.go
server/version/version.go
server/version/version_test.go
store/db/migration/prod/0.10/00__activity.sql
store/db/migration/prod/LATEST__SCHEMA.sql
web/src/components/EmbedMemoDialog.tsx
Commit message: chore: add skipper for secure (#913)



Vulnerable code:
		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.Secure())
var Version = "0.9.1"
var DevVersion = "0.9.1"

          * Only the public memo supports.

Fixed code:
	"net/http"

func DefaultGetRequestSkipper(c echo.Context) bool {
	return c.Request().Method == http.MethodGet
}

	"strings"
		if strings.HasPrefix(resource.Type, "text") || strings.HasPrefix(resource.Type, "application") {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		Skipper:            DefaultGetRequestSkipper,
		XSSProtection:      "1; mode=block",
		ContentTypeNosniff: "nosniff",
		XFrameOptions:      "SAMEORIGIN",
		HSTSPreloadEnabled: false,
	}))
var Version = "0.10.0"
var DevVersion = "0.10.0"
package version

import "testing"

func TestIsVersionGreaterOrEqualThan(t *testing.T) {
	tests := []struct {
		version string
		target  string
		want    bool
	}{
		{
			version: "0.9.1",
			target:  "0.9.1",
			want:    true,
		},
		{
			version: "0.10.0",
			target:  "0.9.1",
			want:    true,
		},
		{
			version: "0.9.0",
			target:  "0.9.1",
			want:    false,
		},
	}
	for _, test := range tests {
		result := IsVersionGreaterOrEqualThan(test.version, test.target)
		if result != test.want {
			t.Errorf("got result %v, want %v.", result, test.want)
		}
	}
}
-- activity
CREATE TABLE activity (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  creator_id INTEGER NOT NULL,
  created_ts BIGINT NOT NULL DEFAULT (strftime('%s', 'now')),
  type TEXT NOT NULL DEFAULT '',
  level TEXT NOT NULL CHECK (level IN ('INFO', 'WARN', 'ERROR')) DEFAULT 'INFO',
  payload TEXT NOT NULL DEFAULT '{}'
);

-- activity
CREATE TABLE activity (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  creator_id INTEGER NOT NULL,
  created_ts BIGINT NOT NULL DEFAULT (strftime('%s', 'now')),
  type TEXT NOT NULL DEFAULT '',
  level TEXT NOT NULL CHECK (level IN ('INFO', 'WARN', 'ERROR')) DEFAULT 'INFO',
  payload TEXT NOT NULL DEFAULT '{}'
);
          <span className="italic opacity-80">* Only the public memo supports.</span>
CVE-2023-0110 (Go, published 2023-01-07T04:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
server/common.go
server/resource.go
server/server.go
server/version/version.go
server/version/version_test.go
store/db/migration/prod/0.10/00__activity.sql
store/db/migration/prod/LATEST__SCHEMA.sql
web/src/components/EmbedMemoDialog.tsx
Commit message: chore: add skipper for secure (#913)



Vulnerable code:
		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.Secure())
var Version = "0.9.1"
var DevVersion = "0.9.1"

          * Only the public memo supports.

Fixed code:
	"net/http"

func DefaultGetRequestSkipper(c echo.Context) bool {
	return c.Request().Method == http.MethodGet
}

	"strings"
		if strings.HasPrefix(resource.Type, "text") || strings.HasPrefix(resource.Type, "application") {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		Skipper:            DefaultGetRequestSkipper,
		XSSProtection:      "1; mode=block",
		ContentTypeNosniff: "nosniff",
		XFrameOptions:      "SAMEORIGIN",
		HSTSPreloadEnabled: false,
	}))
var Version = "0.10.0"
var DevVersion = "0.10.0"
package version

import "testing"

func TestIsVersionGreaterOrEqualThan(t *testing.T) {
	tests := []struct {
		version string
		target  string
		want    bool
	}{
		{
			version: "0.9.1",
			target:  "0.9.1",
			want:    true,
		},
		{
			version: "0.10.0",
			target:  "0.9.1",
			want:    true,
		},
		{
			version: "0.9.0",
			target:  "0.9.1",
			want:    false,
		},
	}
	for _, test := range tests {
		result := IsVersionGreaterOrEqualThan(test.version, test.target)
		if result != test.want {
			t.Errorf("got result %v, want %v.", result, test.want)
		}
	}
}
-- activity
CREATE TABLE activity (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  creator_id INTEGER NOT NULL,
  created_ts BIGINT NOT NULL DEFAULT (strftime('%s', 'now')),
  type TEXT NOT NULL DEFAULT '',
  level TEXT NOT NULL CHECK (level IN ('INFO', 'WARN', 'ERROR')) DEFAULT 'INFO',
  payload TEXT NOT NULL DEFAULT '{}'
);

-- activity
CREATE TABLE activity (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  creator_id INTEGER NOT NULL,
  created_ts BIGINT NOT NULL DEFAULT (strftime('%s', 'now')),
  type TEXT NOT NULL DEFAULT '',
  level TEXT NOT NULL CHECK (level IN ('INFO', 'WARN', 'ERROR')) DEFAULT 'INFO',
  payload TEXT NOT NULL DEFAULT '{}'
);
          <span className="italic opacity-80">* Only the public memo supports.</span>
CVE-2023-0111 (Go, published 2023-01-07T04:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
server/common.go
server/resource.go
server/server.go
server/version/version.go
server/version/version_test.go
store/db/migration/prod/0.10/00__activity.sql
store/db/migration/prod/LATEST__SCHEMA.sql
web/src/components/EmbedMemoDialog.tsx
Commit message: chore: add skipper for secure (#913)



Vulnerable code:
		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.Secure())
var Version = "0.9.1"
var DevVersion = "0.9.1"

          * Only the public memo supports.

Fixed code:
	"net/http"

func DefaultGetRequestSkipper(c echo.Context) bool {
	return c.Request().Method == http.MethodGet
}

	"strings"
		if strings.HasPrefix(resource.Type, "text") || strings.HasPrefix(resource.Type, "application") {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		Skipper:            DefaultGetRequestSkipper,
		XSSProtection:      "1; mode=block",
		ContentTypeNosniff: "nosniff",
		XFrameOptions:      "SAMEORIGIN",
		HSTSPreloadEnabled: false,
	}))
var Version = "0.10.0"
var DevVersion = "0.10.0"
package version

import "testing"

func TestIsVersionGreaterOrEqualThan(t *testing.T) {
	tests := []struct {
		version string
		target  string
		want    bool
	}{
		{
			version: "0.9.1",
			target:  "0.9.1",
			want:    true,
		},
		{
			version: "0.10.0",
			target:  "0.9.1",
			want:    true,
		},
		{
			version: "0.9.0",
			target:  "0.9.1",
			want:    false,
		},
	}
	for _, test := range tests {
		result := IsVersionGreaterOrEqualThan(test.version, test.target)
		if result != test.want {
			t.Errorf("got result %v, want %v.", result, test.want)
		}
	}
}
-- activity
CREATE TABLE activity (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  creator_id INTEGER NOT NULL,
  created_ts BIGINT NOT NULL DEFAULT (strftime('%s', 'now')),
  type TEXT NOT NULL DEFAULT '',
  level TEXT NOT NULL CHECK (level IN ('INFO', 'WARN', 'ERROR')) DEFAULT 'INFO',
  payload TEXT NOT NULL DEFAULT '{}'
);

-- activity
CREATE TABLE activity (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  creator_id INTEGER NOT NULL,
  created_ts BIGINT NOT NULL DEFAULT (strftime('%s', 'now')),
  type TEXT NOT NULL DEFAULT '',
  level TEXT NOT NULL CHECK (level IN ('INFO', 'WARN', 'ERROR')) DEFAULT 'INFO',
  payload TEXT NOT NULL DEFAULT '{}'
);
          <span className="italic opacity-80">* Only the public memo supports.</span>
CVE-2023-0112 (Go, published 2023-01-07T04:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
server/common.go
server/resource.go
server/server.go
server/version/version.go
server/version/version_test.go
store/db/migration/prod/0.10/00__activity.sql
store/db/migration/prod/LATEST__SCHEMA.sql
web/src/components/EmbedMemoDialog.tsx
Commit message: chore: add skipper for secure (#913)



Vulnerable code:
		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.Secure())
var Version = "0.9.1"
var DevVersion = "0.9.1"

          * Only the public memo supports.

Fixed code:
	"net/http"

func DefaultGetRequestSkipper(c echo.Context) bool {
	return c.Request().Method == http.MethodGet
}

	"strings"
		if strings.HasPrefix(resource.Type, "text") || strings.HasPrefix(resource.Type, "application") {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		Skipper:            DefaultGetRequestSkipper,
		XSSProtection:      "1; mode=block",
		ContentTypeNosniff: "nosniff",
		XFrameOptions:      "SAMEORIGIN",
		HSTSPreloadEnabled: false,
	}))
var Version = "0.10.0"
var DevVersion = "0.10.0"
package version

import "testing"

func TestIsVersionGreaterOrEqualThan(t *testing.T) {
	tests := []struct {
		version string
		target  string
		want    bool
	}{
		{
			version: "0.9.1",
			target:  "0.9.1",
			want:    true,
		},
		{
			version: "0.10.0",
			target:  "0.9.1",
			want:    true,
		},
		{
			version: "0.9.0",
			target:  "0.9.1",
			want:    false,
		},
	}
	for _, test := range tests {
		result := IsVersionGreaterOrEqualThan(test.version, test.target)
		if result != test.want {
			t.Errorf("got result %v, want %v.", result, test.want)
		}
	}
}
-- activity
CREATE TABLE activity (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  creator_id INTEGER NOT NULL,
  created_ts BIGINT NOT NULL DEFAULT (strftime('%s', 'now')),
  type TEXT NOT NULL DEFAULT '',
  level TEXT NOT NULL CHECK (level IN ('INFO', 'WARN', 'ERROR')) DEFAULT 'INFO',
  payload TEXT NOT NULL DEFAULT '{}'
);

-- activity
CREATE TABLE activity (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  creator_id INTEGER NOT NULL,
  created_ts BIGINT NOT NULL DEFAULT (strftime('%s', 'now')),
  type TEXT NOT NULL DEFAULT '',
  level TEXT NOT NULL CHECK (level IN ('INFO', 'WARN', 'ERROR')) DEFAULT 'INFO',
  payload TEXT NOT NULL DEFAULT '{}'
);
          <span className="italic opacity-80">* Only the public memo supports.</span>
CVE-2023-4696 (Go, published 2023-09-01T01:15Z)
Description: value: Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/usememos/memos
Files changed:
server/jwt.go
Commit message: fix: validate access token (#1867)

* fix/to_valid_token

* eslint

* revert

* Update server/jwt.go

---------

Co-authored-by: boojack <stevenlgtm@gmail.com>

Vulnerable code:

Fixed code:

		if !accessToken.Valid {
			return echo.NewHTTPError(http.StatusUnauthorized, "Invalid access token.")
		}
CVE-2023-4697 (Go, published 2023-09-01T01:15Z)
Description: value: Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/usememos/memos
Files changed:
server/jwt.go
Commit message: fix: validate access token (#1867)

* fix/to_valid_token

* eslint

* revert

* Update server/jwt.go

---------

Co-authored-by: boojack <stevenlgtm@gmail.com>

Vulnerable code:

Fixed code:

		if !accessToken.Valid {
			return echo.NewHTTPError(http.StatusUnauthorized, "Invalid access token.")
		}
CVE-2023-4698 (Go, published 2023-09-01T01:15Z)
Description: value: Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/usememos/memos
Files changed:
server/jwt.go
Commit message: fix: validate access token (#1867)

* fix/to_valid_token

* eslint

* revert

* Update server/jwt.go

---------

Co-authored-by: boojack <stevenlgtm@gmail.com>

Vulnerable code:

Fixed code:

		if !accessToken.Valid {
			return echo.NewHTTPError(http.StatusUnauthorized, "Invalid access token.")
		}
CVE-2023-5036 (Other, published 2023-09-18T06:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/usememos/memos
Files changed:
.gitignore
go.mod
go.sum
plugin/http-getter/image.go
Commit message: fix: content sanitization in getimage endpoint (#2241)



Vulnerable code:
	golang.org/x/crypto v0.12.0
	golang.org/x/net v0.14.0
	golang.org/x/sys v0.11.0 // indirect
	golang.org/x/text v0.12.0 // indirect
golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=

Fixed code:
server/dist
	github.com/microcosm-cc/bluemonday v1.0.25
	golang.org/x/crypto v0.13.0
	golang.org/x/net v0.15.0
	github.com/aymerick/douceur v0.2.0 // indirect
	github.com/gorilla/css v1.0.0 // indirect
	golang.org/x/sys v0.12.0 // indirect
	golang.org/x/text v0.13.0 // indirect
github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY=
github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
github.com/microcosm-cc/bluemonday v1.0.25 h1:4NEwSfiJ+Wva0VxN5B8OwMicaJvD8r9tlJWm9rtloEg=
github.com/microcosm-cc/bluemonday v1.0.25/go.mod h1:ZIOjCQp1OrzBBPIJmfX4qDYFuhU02nx4bn030ixfHLE=
golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8=
golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=

	"github.com/microcosm-cc/bluemonday"
	bodyBytes, err = SanitizeContent(bodyBytes)
	if err != nil {
		return nil, err
	}


func SanitizeContent(content []byte) ([]byte, error) {
	bodyString := string(content)

	bm := bluemonday.UGCPolicy()
	return []byte(bm.Sanitize(bodyString)), nil
}
CVE-2021-25925 (Python, published 2021-04-12T14:15Z)
Description: value: in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive information.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/SiCKRAGE/SiCKRAGE
Files changed:
requirements.txt
sickrage/core/webserver/handlers/base.py
Commit message: Added bleach to requirements.txt to clean input data from HTML forms


Vulnerable code:
from tornado import locale

Fixed code:
bleach==3.3.0
import html
import bleach
from tornado import locale, escape

    def get_argument(self, *args, **kwargs):
        value = super(BaseHandler, self).get_argument(*args, **kwargs)

        try:
            return bleach.clean(value)
        except TypeError:
            return value