CVE-2023-4876 (Kotlin, published 2023-09-10T01:15Z)
Description: value: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/hamza417/inure
Files changed:
app/src/main/assets/html/changelogs.html
app/src/main/java/app/simple/inure/adapters/ui/AdapterTags.kt
Commit message: Build92

  - Fixed tags crashing


Vulnerable code:
<h4>User Interface</h4>
    <li>Added Open Source logo on the apps that are FOSS in nature or was FOSS somewhere in the
        past.
        <br>
        <small>This will use F-Droid and IzzyOnDroid repo data to identify and validate in runtime
               if the app is FOSS or not. Any other repo isn't supported and likely won't be
               supported in the future.</small>
    </li>
    <li>Added self app updater for auto downloading latest update builds.
        <br>
        <small>For GitHub releases only, Play releases are Play Store dependent and Play API is not
               open source.</small>
    </li>
    <li>Updated <b>Home</b> panel UI to make it consistent with the app's design language.</li>
    <li>Added <b>Tags</b> to assign indefinite tags to any app and create a personalized app groups.
    </li>
    <li>Added <i>Tags</i> filter in <b>Search</b> panel.
        <br>
        <small>Use <b>#</b> before any keyword to enable tag search mode.</small>
    </li>
    <li>Added <i>Tags</i> strip in <b>Search</b> panel.</li>
<h4>Bug Fixes</h4>
<ul>
    <li>Fixed an issue that's crashing the app info loader for non-installed apps.</li>
    <li>Fixed a few random crashes.</li>
    <li>Fixed no data issue in <b>Uses Features</b> panel.</li>
</ul>
<h4>Improvement</h4>
<ul>
    <li>Improved layouts and animations for Arabic locale.</li>
    <li>Updated <b>Shortcuts</b> panel interface.</li>
    <li>Some improvements in animations framework.</li>
    <li>Further improvements in communication between bottom menu and fast scroller.</li>
</ul>
<h4>Removed</h4>
<ul>
    <li>Removed <b>Dex Classes</b> for non-installed apps.</li>
</ul>
<h4>Changes</h4>
<ul>
    <li>Put a limit on search for up to 3 characters to prevent unnecessary search triggers.</li>
</ul>
<br>
<br>
                holder.tag.text = tags[position - 1].tag
                holder.recyclerView.adapter = AdapterTaggedIcons(tags[position - 1].packages.split(","))
                holder.date.text = tags[position - 1].dateAdded.toDate()
                    tagsCallback.onTagClicked(tags[position - 1])
                    tagsCallback.onTagLongClicked(tags[position - 1])

Fixed code:
<h4>Bug Fixes</h4>
    <li>Fixed <b>Tags</b> crashing on opening after a tag is deleted.</li>
<br>
<br>
<div class="wrap-collapsible">
    <input class="toggle" id="build_91" type="checkbox">
    <label class="lbl-toggle" for="build_91">Build91</label>
    <div class="collapsible-content">
        <div class="content-inner">
            <h4>User Interface</h4>
            <ul>
                <li>Added Open Source logo on the apps that are FOSS in nature or was FOSS somewhere
                    in the
                    past.
                    <br>
                    <small>This will use F-Droid and IzzyOnDroid repo data to identify and validate
                           in runtime
                           if the app is FOSS or not. Any other repo isn't supported and likely
                           won't be
                           supported in the future.</small>
                </li>
                <li>Added self app updater for auto downloading latest update builds.
                    <br>
                    <small>For GitHub releases only, Play releases are Play Store dependent and Play
                           API is not
                           open source.</small>
                </li>
                <li>Updated <b>Home</b> panel UI to make it consistent with the app's design
                    language.
                </li>
                <li>Added <b>Tags</b> to assign indefinite tags to any app and create a personalized
                    app groups.
                </li>
                <li>Added <i>Tags</i> filter in <b>Search</b> panel.
                    <br>
                    <small>Use <b>#</b> before any keyword to enable tag search mode.</small>
                </li>
                <li>Added <i>Tags</i> strip in <b>Search</b> panel.</li>
            </ul>
            <h4>Bug Fixes</h4>
            <ul>
                <li>Fixed an issue that's crashing the app info loader for non-installed apps.</li>
                <li>Fixed a few random crashes.</li>
                <li>Fixed no data issue in <b>Uses Features</b> panel.</li>
            </ul>
            <h4>Improvement</h4>
            <ul>
                <li>Improved layouts and animations for Arabic locale.</li>
                <li>Updated <b>Shortcuts</b> panel interface.</li>
                <li>Some improvements in animations framework.</li>
                <li>Further improvements in communication between bottom menu and fast scroller.
                </li>
            </ul>
            <h4>Removed</h4>
            <ul>
                <li>Removed <b>Dex Classes</b> for non-installed apps.</li>
            </ul>
            <h4>Changes</h4>

            <ul>
                <li>Put a limit on search for up to 3 characters to prevent unnecessary search
                    triggers.
                </li>
            </ul>
        </div>
    </div>
</div>
                holder.tag.text = tags[holder.bindingAdapterPosition.minus(1)].tag
                holder.recyclerView.adapter = AdapterTaggedIcons(tags[holder.bindingAdapterPosition.minus(1)].packages.split(","))
                holder.date.text = tags[holder.bindingAdapterPosition.minus(1)].dateAdded.toDate()
                    tagsCallback.onTagClicked(tags[holder.bindingAdapterPosition.minus(1)])
                    tagsCallback.onTagLongClicked(tags[holder.bindingAdapterPosition.minus(1)])