hitoshura25/cvefixes huggingface dataset:
CVE-2022-31060 (Ruby, published 2022-06-14T21:15Z)
Description: value: Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable banners.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse
Files changed:
app/controllers/application_controller.rb
spec/requests/application_controller_spec.rb
Commit message: SECURITY: banner-info (#17071)



Vulnerable code:

Fixed code:
    return "{}" if !current_user && SiteSetting.login_required?

  describe "#banner_json" do
    let(:admin) { Fabricate(:admin) }
    let(:user) { Fabricate(:user) }
    fab!(:banner_topic) { Fabricate(:banner_topic) }
    fab!(:p1) { Fabricate(:post, topic: banner_topic, raw: "A banner topic") }

    before do
      admin # to skip welcome wizard at home page `/`
    end

    context "login_required" do
      before do
        SiteSetting.login_required = true
      end
      it "does not include banner info for anonymous users" do
        get "/login"

        expect(response.body).to have_tag("div#data-preloaded") do |element|
          json = JSON.parse(element.current_scope.attribute('data-preloaded').value)
          expect(json['banner']).to eq("{}")
        end
      end

      it "includes banner info for logged-in users" do
        sign_in(user)
        get "/"

        expect(response.body).to have_tag("div#data-preloaded") do |element|
          json = JSON.parse(element.current_scope.attribute('data-preloaded').value)
          expect(JSON.parse(json['banner'])["html"]).to eq("<p>A banner topic</p>")
        end
      end
    end

    context "login not required" do
      before do
        SiteSetting.login_required = false
      end
      it "does include banner info for anonymous users" do
        get "/login"

        expect(response.body).to have_tag("div#data-preloaded") do |element|
          json = JSON.parse(element.current_scope.attribute('data-preloaded').value)
          expect(JSON.parse(json['banner'])["html"]).to eq("<p>A banner topic</p>")
        end
      end
    end
  end
CVE-2022-36068 (Ruby, published 2022-09-29T20:15Z)
Description: value: Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/discourse/discourse
Files changed:
app/controllers/admin/themes_controller.rb
config/routes.rb
spec/requests/admin/themes_controller_spec.rb
Commit message: SECURITY: moderator shouldn't be able to import a theme via API (#18418)

* SECURITY: moderator shouldn't be able to import a theme via API.
* DEV: apply `AdminConstraint` for all the "themes" routes.

Co-authored-by: Vinoth Kannan <svkn.87@gmail.com>

Vulnerable code:
      resources :themes, constraints: AdminConstraint.new

      post "themes/import" => "themes#import"
      post "themes/upload_asset" => "themes#upload_asset"
      post "themes/generate_key_pair" => "themes#generate_key_pair"
      get "themes/:id/preview" => "themes#preview"
      put "themes/:id/setting" => "themes#update_single_setting"

Fixed code:
  before_action :ensure_admin
      resources :themes, constraints: AdminConstraint.new do
        member do
          get "preview" => "themes#preview"
          put "setting" => "themes#update_single_setting"
        end
        collection do
          post "import" => "themes#import"
          post "upload_asset" => "themes#upload_asset"
          post "generate_key_pair" => "themes#generate_key_pair"
        end
      end
    it 'should not be able to import a theme by moderator' do
      sign_in(Fabricate(:moderator))

      post "/admin/themes/import.json", params: { theme: theme_json_file }
      expect(response.status).to eq(404)
    end
CVE-2022-39226 (Ruby, published 2022-09-29T20:15Z)
Description: value: Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/discourse/discourse
Files changed:
app/models/user_profile.rb
db/migrate/20220920044310_enforce_user_profile_max_limits.rb
spec/models/user_profile_spec.rb
Commit message: SECURITY: Limit user profile field length (#18302)

Adds limits to location and website fields at model and DB level
to match the bio_raw field limits. A limit cannot be added at the
DB level for bio_raw because it is a postgres text field.

Co-authored-by: Alan Guo Xiang Tan <gxtan1990@gmail.com>

Vulnerable code:
  validates :website, url: true, allow_blank: true, if: :validate_website?
  validates :location, watched_words: true
#  location                     :string
#  website                      :string

Fixed code:
  validates :website, url: true, length: { maximum: 3000 }, allow_blank: true, if: :validate_website?
  validates :location, length: { maximum: 3000 }, watched_words: true
#  location                     :string(3000)
#  website                      :string(3000)
# frozen_string_literal: true

class EnforceUserProfileMaxLimits < ActiveRecord::Migration[7.0]
  def change
    execute "UPDATE user_profiles SET location = LEFT(location, 3000) WHERE location IS NOT NULL"
    execute "UPDATE user_profiles SET website = LEFT(website, 3000) WHERE website IS NOT NULL"

    change_column :user_profiles, :location, :string, limit: 3000
    change_column :user_profiles, :website, :string, limit: 3000
  end
end
      context "when it is > 3000 characters" do
        before { profile.location = "a" * 3500 }

        it "is not valid" do
          expect(profile.valid?).to eq(false)
          expect(profile.errors.full_messages).to include(/Location is too long \(maximum is 3000 characters\)/)
        end
      end

      context "when it is > 3000 characters" do
        before { profile.bio_raw = "a" * 3500 }

        it "is not valid" do
          expect(profile.valid?).to eq(false)
          expect(profile.errors.full_messages).to include(/About Me is too long \(maximum is 3000 characters\)/)
        end
      end


      it "does not allow > 3000 characters" do
        user_profile.website = "a" * 3500
        expect(user_profile).to_not be_valid
      end
CVE-2022-39232 (JavaScript, published 2022-09-29T21:15Z)
Description: value: Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/discourse/discourse
Files changed:
app/assets/javascripts/discourse/app/widgets/post-cooked.js
app/assets/javascripts/discourse/tests/integration/components/widgets/post-cooked-test.js
app/assets/javascripts/discourse/tests/unit/lib/pretty-text-test.js
Commit message: SECURITY: Handle incomplete quote bbcode (#18311)



Vulnerable code:
        if (e.classList.contains("quote-post-not-found")) {
          return (e.querySelector(".title").innerHTML = e.dataset.username);

Fixed code:
        if (e.classList.contains("quote-post-not-found") && $title.length) {
          e.querySelector(".title").innerHTML = e.dataset.username;
          return;
import { module, test } from "qunit";
import { setupRenderingTest } from "discourse/tests/helpers/component-test";
import { render } from "@ember/test-helpers";
import { query } from "discourse/tests/helpers/qunit-helpers";
import { hbs } from "ember-cli-htmlbars";

module("Integration | Component | Widget | post-cooked", function (hooks) {
  setupRenderingTest(hooks);

  test("quotes with no username and no valid topic", async function (assert) {
    this.set("args", {
      cooked: `<aside class=\"quote no-group quote-post-not-found\" data-post=\"1\" data-topic=\"123456\">\n<blockquote>\n<p>abcd</p>\n</blockquote>\n</aside>\n<p>Testing the issue</p>`,
    });

    await render(
      hbs`<MountWidget @widget="post-cooked" @args={{this.args}} />`
    );

    assert.strictEqual(query("blockquote").innerText, "abcd");
  });
});
  test("Incomplete quotes", function (assert) {
    assert.cookedOptions(
      '[quote=", post: 1"]\na quote\n[/quote]',
      { topicId: 2 },
      `<aside class=\"quote no-group\" data-post=\"1\">
<blockquote>
<p>a quote</p>
</blockquote>
</aside>`,
      "works with missing username"
    );
  });
CVE-2022-46150 (Ruby, published 2022-11-29T18:15Z)
Description: value: Discourse is an open-source discussion platform. Prior to version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branches, unauthorized users may learn of the existence of hidden tags and that they have been applied to topics that they have access to. This issue is patched in version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branches. As a workaround, use the `disable_email` site setting to disable all emails to non-staff users.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/discourse/discourse
Files changed:
app/mailers/user_notifications.rb
spec/mailers/user_notifications_spec.rb
Commit message: SECURITY: Filter tags in user notifications for visibility (#19239)



Vulnerable code:

      tags = Tag.joins(:topic_tags)
        .where("topic_tags.topic_id = ?", post.topic_id)
        .limit(3)
        .pluck(:name)
    let(:topic) { Fabricate(:topic, category: category, tags: [tag1, tag2], title: "Super cool topic") }

Fixed code:
      tags =
        DiscourseTagging
          .visible_tags(Guardian.new(user))
          .joins(:topic_tags)
          .where("topic_tags.topic_id = ?", post.topic_id)
          .limit(3)
          .pluck(:name)

    let(:hidden_tag) { Fabricate(:tag, name: "hidden") }
    let!(:hidden_tag_group) do
      Fabricate(:tag_group, permissions: { "staff" => 1 }, tag_names: [hidden_tag.name])
    end

    let(:topic) { Fabricate(:topic, category: category, tags: [tag1, tag2, hidden_tag], title: "Super cool topic") }
      expect(mail.subject.scan(/#{tag1.name}/).count).to eq(1)
      expect(mail.subject.scan(/#{hidden_tag.name}/).count).to eq(0)
CVE-2023-22453 (Ruby, published 2023-01-05T20:15Z)
Description: value: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/discourse/discourse
Files changed:
app/controllers/users_controller.rb
spec/requests/users_controller_spec.rb
Commit message: SECURITY: Don't expose user post counts to users who can't see the topic (#19728)

Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>

Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>
Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>

Vulnerable code:
      if topic_id != 0

Fixed code:
      if topic_id != 0 && guardian.can_see?(Topic.find_by_id(topic_id))
        it "doesn't include the post count when the signed in user doesn't have access" do
          c = Fabricate(:category, read_restricted: true)
          topic.update(category_id: c.id)
          expect(Guardian.new(user1).can_see?(topic)).to eq(false)
          get "/u/#{admin.username}.json", params: { include_post_count_for: topic.id }
          topic_post_count = response.parsed_body.dig("user", "topic_post_count")
          expect(topic_post_count).to eq(nil)
        end
CVE-2023-22454 (JavaScript, published 2023-01-05T20:15Z)
Description: value: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has the "require moderator approval of all new topics" setting set. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. A patch is available in versions 2.8.14 and 3.0.0.beta16.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/discourse/discourse
Files changed:
app/assets/javascripts/discourse/app/routes/user-activity-pending.js
Commit message: SECURITY: Sanitize PendingPost titles before rendering to prevent XSS (#19726)

Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>

Vulnerable code:
    return this.store.findAll("pending-post", {
      username: this.username,
    });

Fixed code:
import { emojiUnescape } from "discourse/lib/text";
import { escapeExpression } from "discourse/lib/utilities";
    return this.store
      .findAll("pending-post", {
        username: this.username,
      })
      .then((pendingPosts) => {
        for (let pendingPost of pendingPosts.content) {
          pendingPost.title = emojiUnescape(
            escapeExpression(pendingPost.title)
          );
        }

        return pendingPosts;
      });
CVE-2023-22455 (JavaScript, published 2023-01-05T21:15Z)
Description: value: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, tag descriptions, which can be updated by moderators, can be used for cross-site scripting attacks. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. Versions 2.8.14 and 3.0.0.beta16 contain a patch.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/discourse/discourse
Files changed:
app/assets/javascripts/discourse/app/lib/render-tag.js
Commit message: SECURITY: escape quotes in tag description when rendering (#19730)

Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>

Vulnerable code:
    (params.description ? ' title="' + params.description + '" ' : "") +

Fixed code:
import { escape } from "pretty-text/sanitizer";
    (params.description ? ' title="' + escape(params.description) + '" ' : "") +
CVE-2023-23616 (Ruby, published 2023-01-28T00:15Z)
Description: value: Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to flood the database with a large amount of data. However it is unlikely this could be used as part of a DoS attack, as the paths reading back the reasons are only available to administrators. Starting in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, a limit of 280 characters has been introduced for membership requests.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/discourse/discourse
Files changed:
app/assets/javascripts/discourse/app/templates/modal/request-group-membership-form.hbs
app/models/group_request.rb
spec/models/group_request_spec.rb
spec/requests/groups_controller_spec.rb
Commit message: SECURITY: Limit the character count of group membership requests (#19993)

When creating a group membership request, there is no character
limit on the 'reason' field. This can be potentially be used by
an attacker to create enormous amount of data in the database.

Co-authored-by: Ted Johansson <ted@discourse.org>

Vulnerable code:
      <ExpandingTextArea @value={{this.reason}} />

Fixed code:
      <ExpandingTextArea @value={{this.reason}} @maxlength="280" />
  REASON_CHARACTER_LIMIT = 280


  validates :reason, length: { maximum: REASON_CHARACTER_LIMIT }
# frozen_string_literal: true

RSpec.describe GroupRequest do
  it { is_expected.to belong_to :user }
  it { is_expected.to belong_to :group }

  it do
    is_expected.to validate_length_of(:reason).is_at_most(described_class::REASON_CHARACTER_LIMIT)
  end
end
    it "limits the character count of the reason" do
      sign_in(user)

      post "/groups/#{group.name}/request_membership.json",
           params: {
             reason: "x" * (GroupRequest::REASON_CHARACTER_LIMIT + 1),
           }

      expect(response.status).to eq(422)
      expect(response.parsed_body["errors"]).to contain_exactly(
        "Reason is too long (maximum is 280 characters)",
      )
    end
CVE-2023-23620 (Ruby, published 2023-01-28T00:15Z)
Description: value: Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/discourse/discourse
Files changed:
app/controllers/tags_controller.rb
spec/requests/tags_controller_spec.rb
Commit message: SECURITY: only show restricted tag lists to authorized users (#20004)

Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>

Vulnerable code:
  before_action :ensure_visible, only: %i[show info]

Fixed code:
  before_action :ensure_visible, only: [:show, :info, *show_methods]

        it "returns a 404 when tag is restricted" do
          tag_group = Fabricate(:tag_group, permissions: { "staff" => 1 }, tag_names: ["test"])

          get "/tag/test/l/latest.json"
          expect(response.status).to eq(404)

          sign_in(admin)

          get "/tag/test/l/latest.json"
          expect(response.status).to eq(200)
        end


    it "returns a 404 if tag is restricted" do
      tag_group = Fabricate(:tag_group, permissions: { "staff" => 1 }, tag_names: ["test"])

      get "/tag/test/l/top.json"
      expect(response.status).to eq(404)

      sign_in(admin)

      get "/tag/test/l/top.json"
      expect(response.status).to eq(200)
    end
CVE-2023-23621 (Ruby, published 2023-01-28T00:15Z)
Description: value: Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/discourse/discourse
Files changed:
lib/mobile_detection.rb
Commit message: SECURITY: Prevent ReDoS in user agent parsing (#20002)

Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>

Vulnerable code:
    user_agent.match?(MODERN_MOBILE_REGEX)

Fixed code:
  USER_AGENT_MAX_LENGTH = 400

    user_agent[0...USER_AGENT_MAX_LENGTH].match?(MODERN_MOBILE_REGEX)