hitoshura25/cvefixes huggingface dataset:
CVE-2017-1000369 (C, published 2017-06-19T16:29Z)
Description: value: Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
Severity: LOW (CVSS v3 base score: 4)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/Exim/exim
Files changed:
doc/doc-docbook/spec.xfpt
src/src/exim.c
Commit message: Cleanup (prevent repeated use of -p/-oMr to avoid mem leak)


Vulnerable code:
be set by &%-oMr%&.
      else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
      uschar *hn = Ustrchr(argrest, ':');

Fixed code:
be set by &%-oMr%&. Repeated use of this option is not supported.
Repeated use of this option is not supported.
      else if (Ustrcmp(argrest, "Mr") == 0)

        if (received_protocol)
          {
          fprintf(stderr, "received_protocol is set already\n");
          exit(EXIT_FAILURE);
          }
        else received_protocol = argv[++i];
      uschar *hn;

      if (received_protocol)
        {
        fprintf(stderr, "received_protocol is set already\n");
        exit(EXIT_FAILURE);
        }

      hn = Ustrchr(argrest, ':');
CVE-2022-37451 (C, published 2022-08-06T18:15Z)
Description: value: Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-763 \u2014 Release of Invalid Pointer or Reference
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Repository: https://github.com/Exim/exim
Files changed:
src/src/auths/call_pam.c
Commit message: Fix PAM auth.  Bug 2813


Vulnerable code:
      reply[i].resp = CS string_copy_malloc(arg); /* PAM frees resp */

Fixed code:
      reply[i].resp = strdup(CCS arg); /* Use libc malloc, PAM frees resp directly*/
CVE-2022-37452 (C, published 2022-08-07T18:15Z)
Description: value: Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Exim/exim
Files changed:
src/src/host.c
Commit message: Fix host_name_lookup (Close 2747)

Thanks to Nico R for providing a reproducing configuration.

        host_lookup             = *
        message_size_limit      = ${if def:sender_host_name {32M}{32M}}
        acl_smtp_connect        = acl_smtp_connect
        acl_smtp_rcpt           = acl_smtp_rcpt

        begin acl
          acl_smtp_connect:
                warn ratelimit = 256 / 1m / per_conn
                accept

          acl_smtp_rcpt:
                accept hosts = 127.0.0.*

        begin routers
        null:
          driver          = accept
          transport       = null

        begin transports
        null:
          driver          = appendfile
          file            = /dev/null

Tested with

        swaks -f mailbox@example.org -t mailbox@example.org --pipe 'exim -bh 127.0.0.1 -C /opt/exim/etc/exim-bug.conf'

The IP must have a PTR to "localhost." to reproduce it.

(cherry picked from commit 20812729e3e47a193a21d326ecd036d67a8b2724)


Vulnerable code:
    int count = 1;
      int count = 0;

Fixed code:
    int count = 1;  /* need 1 more for terminating NULL */
      int count = 1;  /* need 1 more for terminating NULL */
CVE-2017-9224 (C, published 2017-05-24T15:29Z)
Description: value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regexec.c
Commit message: fix #57 : DATA_ENSURE() check must be before data access


Vulnerable code:
#if 0
#endif
      if (*p != *s++) goto fail;
      DATA_ENSURE(0);
      p++;

Fixed code:
CVE-2017-9225 (Python, published 2017-05-24T15:29Z)
Description: value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/gperf_unfold_key_conv.py
src/unicode_unfold_key.c
Commit message: fix #56 : return invalid result for codepoint 0xFFFFFFFF


Vulnerable code:
    r = re.sub(REG_CODE_CHECK, 'if (code == gcode)', s)
          if (code == gcode)

Fixed code:
    r = re.sub(REG_CODE_CHECK, 'if (code == gcode && wordlist[key].index >= 0)', s)
          if (code == gcode && wordlist[key].index >= 0)
CVE-2017-9226 (C, published 2017-05-24T15:29Z)
Description: value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regparse.c
Commit message: fix #55 : Byte value expressed in octal must be smaller than 256


Vulnerable code:
        if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
        if (num < 0) return ONIGERR_TOO_BIG_NUMBER;

Fixed code:
        if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
        if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
CVE-2017-9226 (C, published 2017-05-24T15:29Z)
Description: value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regparse.c
Commit message: fix #55 : check too big code point value for single byte value in next_state_val()


Vulnerable code:

Fixed code:
      if (*vs > 0xff)
          return ONIGERR_INVALID_CODE_POINT_VALUE;
CVE-2017-9227 (C, published 2017-05-24T15:29Z)
Description: value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regexec.c
Commit message: fix #58 : access to invalid address by reg->dmin value


Vulnerable code:

Fixed code:

      if (q >= end) return 0; /* fail */
CVE-2017-9228 (C, published 2017-05-24T15:29Z)
Description: value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regparse.c
Commit message: fix #60 : invalid state(CCS_VALUE) in parse_char_class()


Vulnerable code:
  *state = CCS_VALUE;

Fixed code:
  if (*state != CCS_START)
    *state = CCS_VALUE;
CVE-2017-9229 (C, published 2017-05-24T15:29Z)
Description: value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regexec.c
Commit message: fix #59 : access to invalid address by reg->dmax value


Vulnerable code:
        *low = p - reg->dmax;
        if (*low > s) {
          *low = onigenc_get_right_adjust_char_head_with_prev(reg->enc, s,
                                          *low, (const UChar** )low_prev);
          if (low_prev && IS_NULL(*low_prev))
            *low_prev = onigenc_get_prev_char_head(reg->enc,
                                                   (pprev ? pprev : s), *low);
          if (low_prev)
            *low_prev = onigenc_get_prev_char_head(reg->enc,
                                                   (pprev ? pprev : str), *low);

Fixed code:
        if (p - str < reg->dmax) {
          *low = (UChar* )str;
          if (low_prev)
            *low_prev = onigenc_get_prev_char_head(reg->enc, str, *low);
          *low = p - reg->dmax;
          if (*low > s) {
            *low = onigenc_get_right_adjust_char_head_with_prev(reg->enc, s,
                                                 *low, (const UChar** )low_prev);
            if (low_prev && IS_NULL(*low_prev))
              *low_prev = onigenc_get_prev_char_head(reg->enc,
                                                     (pprev ? pprev : s), *low);
          }
          else {
            if (low_prev)
              *low_prev = onigenc_get_prev_char_head(reg->enc,
                                                     (pprev ? pprev : str), *low);
          }
CVE-2019-13224 (C, published 2019-07-10T14:15Z)
Description: value: A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regext.c
Commit message: Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()


Vulnerable code:
    r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
                      &cpat, &cpat_end);
    if (r != 0) return r;

Fixed code:
#if 0
#endif
    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
CVE-2019-13225 (C, published 2019-07-10T14:15Z)
Description: value: A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regcomp.c
Commit message: Fix CVE-2019-13225: problem in converting if-then-else pattern to bytecode.


Vulnerable code:
        len += SIZE_OP_JUMP;
      int cond_len, then_len, jump_len;
      jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END;
      if (IS_NOT_NULL(Else)) jump_len += SIZE_OP_JUMP;
        int else_len = compile_length_tree(Else, reg);
        r = add_op(reg, OP_JUMP);
        if (r != 0) return r;
        COP(reg)->jump.addr = else_len + SIZE_INC_OP;

Fixed code:
      len += SIZE_OP_JUMP + SIZE_OP_ATOMIC_END;

      int cond_len, then_len, else_len, jump_len;
      jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END + SIZE_OP_JUMP;
        else_len = compile_length_tree(Else, reg);
        if (else_len < 0) return else_len;
      }
      else
        else_len = 0;
      r = add_op(reg, OP_JUMP);
      if (r != 0) return r;
      COP(reg)->jump.addr = SIZE_OP_ATOMIC_END + else_len + SIZE_INC_OP;

      r = add_op(reg, OP_ATOMIC_END);
      if (r != 0) return r;

      if (IS_NOT_NULL(Else)) {
CVE-2019-16163 (C, published 2019-09-09T17:15Z)
Description: value: Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regparse.c
Commit message: fix #147: Stack Exhaustion Problem caused by some parsing functions in regcomp.c making recursive calls to themselves.


Vulnerable code:
  int r, len, group = 0;

Fixed code:

  int r, len, group;
  unsigned int parse_depth;
  group = 0;
  parse_depth = env->parse_depth;

      parse_depth++;
      if (parse_depth > ParseDepthLimit)
        return ONIGERR_PARSE_DEPTH_LIMIT_OVER;
CVE-2019-19246 (C, published 2019-11-25T17:15Z)
Description: value: Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kkos/oniguruma
Files changed:
src/regexec.c
Commit message: fix heap-buffer-overflow


Vulnerable code:

Fixed code:
      if (t >= tend)    return 0;
CVE-2020-5203 (PHP, published 2020-03-11T14:15Z)
Description: value: In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/bcosca/fatfree-core
Files changed:
base.php
Commit message: ensure misuse of clear() wont open a vulnerability


Vulnerable code:
		$fw=$this->fw;
		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'),
			$fw->compile($str)));
			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func)

Fixed code:
			// Ensure we have no code injection
			$key=preg_replace('/(\)\W*\w+.*$)/','',$key);
		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str)));
			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func)
CVE-2020-5203 (PHP, published 2020-03-11T14:15Z)
Description: value: In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/bcosca/fatfree-core
Files changed:
base.php
Commit message: ensure misuse of clear() wont open a vulnerability


Vulnerable code:
		$fw=$this->fw;
		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'),
			$fw->compile($str)));
			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func)

Fixed code:
			// Ensure we have no code injection
			$key=preg_replace('/(\)\W*\w+.*$)/','',$key);
		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str)));
			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func)
CVE-2020-7754 (JavaScript, published 2020-10-27T15:15Z)
Description: value: This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/npm/npm-user-validate
Files changed:
npm-user-validate.js
test/email.test.js
Commit message: fix: update email validation

PR-URL: https://github.com/isaacs/npm-user-validate/pull/15
Credit: @
Close: #15
Reviewed-by: @isaacs


Vulnerable code:
  if (!em.match(/^.+@.+\..+$/)) {

Fixed code:
    length: 'Email length must be less then or equal to 254 characters long',
  if (em.length > 254) {
    return new Error(requirements.email.length)
  }
  if (!em.match(/^[^@]+@.+\..+$/)) {
test('email is longer then 254 characters', function (t) {
  var str = '@'.repeat(255)
  var err = v(str)
  t.type(err, 'object')
  t.end()
})
CVE-2023-40743 (Java, published 2023-09-05T15:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.

As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from  https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/apache/axis-axis1-java
Files changed:
axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java
Commit message: Filter out unsupported protocols in the client class ServiceFactory


Vulnerable code:

Fixed code:

	    if(name!=null && (name.toUpperCase().indexOf("LDAP")!=-1 || name.toUpperCase().indexOf("RMI")!=-1 || name.toUpperCase().indexOf("JMS")!=-1 || name.toUpperCase().indexOf("JMX")!=-1) || name.toUpperCase().indexOf("JRMP")!=-1 || name.toUpperCase().indexOf("JAVA")!=-1 || name.toUpperCase().indexOf("DNS")!=-1)  {
	        return null;
            }
	            return null;
CVE-2023-43657 (JavaScript, published 2023-09-28T19:15Z)
Description: value: discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/discourse/discourse-encrypt
Files changed:
.discourse-compatibility
assets/javascripts/discourse/initializers/decrypt-topics.js
test/javascripts/acceptance/encrypt-test.js
Commit message: SECURITY: Properly escape encrypted topic titles (#283)



Vulnerable code:
3.1.999: 05ca875fb543350795f6709ab7afcbb6e8f5871b
      topicController.model.set("fancy_title", topicTitle);
async function setupEncryptedTopicPretender(server, { identity } = {}) {
  const encryptedTitle = await encrypt(topicKey, { raw: "Top Secret Title" });

Fixed code:
      topicController.model.set("fancy_title", escapeExpression(topicTitle));
async function setupEncryptedTopicPretender(
  server,
  { identity, topicTitle = "Top Secret Title" } = {}
) {
  const encryptedTitle = await encrypt(topicKey, { raw: topicTitle });
  test("viewing encrypted topic escapes title correctly", async function (assert) {
    globalAssert = assert;

    const title = "Title <a>with some html chars</a>";
    await setupEncryptedTopicPretender(pretender, { topicTitle: title });

    await visit("/t/a-secret-message/42");

    assert
      .dom(".fancy-title")
      .hasText(title, "Title in UI is escaped correctly");
    assert.strictEqual(document.title, `${title} - QUnit Discourse Tests`);
  });