hitoshura25/cvefixes huggingface dataset:
CVE-2022-0639 (JavaScript, published 2022-02-17T18:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/unshiftio/url-parse
Files changed:
index.js
test/test.js
Commit message: [fix] Readd the empty userinfo to `url.href` (#226)

If the userinfo is present but empty, the parsed host is also empty, and
`url.pathname` is not `'/'`, then readd the empty userinfo to `url.href`,
otherwise the original invalid URL might be transformed into a valid one
with `url.pathname` as host.

Vulnerable code:

Fixed code:
  } else if (
    url.protocol !== 'file:' &&
    isSpecial(url.protocol) &&
    !url.host &&
    url.pathname !== '/'
  ) {
    //
    // Add back the empty userinfo, otherwise the original invalid URL
    // might be transformed into a valid one with `url.pathname` as host.
    //
    result += '@';

    it('adds @ to href if auth and host are empty', function () {
      var parsed, i = 0;
      var urls = [
        'http:@/127.0.0.1',
        'http::@/127.0.0.1',
        'http:/@/127.0.0.1',
        'http:/:@/127.0.0.1',
        'http://@/127.0.0.1',
        'http://:@/127.0.0.1',
        'http:///@/127.0.0.1',
        'http:///:@/127.0.0.1'
      ];

      for (; i < urls.length; i++) {
        parsed = parse(urls[i]);

        assume(parsed.protocol).equals('http:');
        assume(parsed.auth).equals('');
        assume(parsed.username).equals('');
        assume(parsed.password).equals('');
        assume(parsed.host).equals('');
        assume(parsed.hostname).equals('');
        assume(parsed.pathname).equals('/127.0.0.1');
        assume(parsed.origin).equals('null');
        assume(parsed.href).equals('http://@/127.0.0.1');
        assume(parsed.toString()).equals('http://@/127.0.0.1');
      }

      urls = [
        'http:@/',
        'http:@',
        'http::@/',
        'http::@',
        'http:/@/',
        'http:/@',
        'http:/:@/',
        'http:/:@',
        'http://@/',
        'http://@',
        'http://:@/',
        'http://:@'
      ];

      for (i = 0; i < urls.length; i++) {
        parsed = parse(urls[i]);

        assume(parsed.protocol).equals('http:');
        assume(parsed.auth).equals('');
        assume(parsed.username).equals('');
        assume(parsed.password).equals('');
        assume(parsed.host).equals('');
        assume(parsed.hostname).equals('');
        assume(parsed.pathname).equals('/');
        assume(parsed.origin).equals('null');
        assume(parsed.href).equals('http:///');
        assume(parsed.toString()).equals('http:///');
      }
    });
CVE-2022-0686 (JavaScript, published 2022-02-20T13:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/unshiftio/url-parse
Files changed:
index.js
test/test.js
Commit message: [fix] Handle the case where the port is specified but empty


Vulnerable code:
  [/:(\d+)$/, 'port', undefined, 1],    // RegExp the back.
    !url.host &&
  result += url.host + url.pathname;

Fixed code:
  [/:(\d*)$/, 'port', undefined, 1],    // RegExp the back.
    , host = url.host
    !host &&
  //
  // Trailing colon is removed from `url.host` when it is parsed. If it still
  // ends with a colon, then add back the trailing colon that was removed. This
  // prevents an invalid URL from being transformed into a valid one.
  //
  if (host[host.length - 1] === ':') host += ':';
  result += host + url.pathname;
  it('handles the case where the port is specified but empty', function () {
    var parsed = parse('http://example.com:');

    assume(parsed.protocol).equals('http:');
    assume(parsed.port).equals('');
    assume(parsed.host).equals('example.com');
    assume(parsed.hostname).equals('example.com');
    assume(parsed.pathname).equals('/');
    assume(parsed.origin).equals('http://example.com');
    assume(parsed.href).equals('http://example.com/');

    parsed = parse('http://example.com::');

    assume(parsed.protocol).equals('http:');
    assume(parsed.port).equals('');
    assume(parsed.host).equals('example.com:');
    assume(parsed.hostname).equals('example.com:');
    assume(parsed.pathname).equals('/');
    assume(parsed.origin).equals('http://example.com:');
    assume(parsed.href).equals('http://example.com::/');
  });
CVE-2022-0691 (JavaScript, published 2022-02-21T09:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/unshiftio/url-parse
Files changed:
index.js
test/test.js
Commit message: [fix] Strip all control characters from the beginning of the URL


Vulnerable code:
  , whitespace = /^[ \f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
    it('removes whitespace on the left', function () {
      assume(parse.trimLeft('  lol')).equals('lol');

Fixed code:
  , whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
    it('removes control characters on the left', function () {
      var i = 0;
      var prefix = ''

      for (; i < 33; i++) {
        prefix = String.fromCharCode(i);
        assume(parse.trimLeft(prefix + prefix +'lol')).equals('lol');
      }
CVE-2013-7222 (Other, published 2014-01-02T14:59Z)
Description: value: config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/fatfreecrm/fat_free_crm
Files changed:
config/initializers/secret_token.rb
lib/tasks/ffcrm/secret.rake
Commit message: Strengthen case to generate unique secret token.


Vulnerable code:
# Your secret key for verifying the integrity of signed cookies.
# PLEASE NOTE: This secret token must be changed in your fork of Fat Free CRM.
# This problem is mitigated when running Fat Free CRM as a Rails Engine.
  FatFreeCRM::Application.config.secret_token = '51aa366864a80316a85cff0d3762347f4ae3d029d548bef034d56e82b1a2ffac5353ee6719d9b64e4354e2a0b1a901679f46a851c360a2ea377188e4b196b6b6'

Fixed code:

# Your secret key is used for verifying the integrity of signed cookies.

# You can use `rake secret` to generate a secure secret key.
# Make sure your secret_key_base is kept private
# if you're sharing your code publicly.
  if Rails.env == 'test'
    FatFreeCRM::Application.config.secret_token = '51aa366864a80316a85cff0d3762347f4ae3d029d548bef034d56e82b1a2ffac5353ee6719d9b64e4354e2a0b1a901679f46a851c360a2ea377188e4b196b6b6'
  else
    raise "Please run 'rake ffcrm:secret' to generate a secret token."
  end
# Copyright (c) 2008-2013 Michael Dvorkin and contributors.
#
# Fat Free CRM is freely distributable under the terms of MIT license.
# See MIT-LICENSE file or http://www.opensource.org/licenses/mit-license.php
#------------------------------------------------------------------------------

namespace :ffcrm do

  desc "Generate a secret token for Rails to use."
  task :secret do
    require 'securerandom'
    secret = SecureRandom.hex(64)
    filename = File.join(Rails.root, 'config', 'initializers', 'secret_token.rb')
    File.open(filename, 'w'){|f| f.puts "FatFreeCRM::Application.config.secret_token = '#{secret}'"}
  end

end
CVE-2013-7223 (Ruby, published 2014-01-02T14:59Z)
Description: value: Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/fatfreecrm/fat_free_crm
Files changed:
app/controllers/application_controller.rb
Commit message: Ensure requests are protected.


Vulnerable code:

Fixed code:
  protect_from_forgery
CVE-2013-7224 (Ruby, published 2014-01-02T14:59Z)
Description: value: Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/fatfreecrm/fat_free_crm
Files changed:
app/models/users/user.rb
config/routes.rb
spec/models/users/user_spec.rb
spec/routing/users_routing_spec.rb
Commit message: Add custom serializers for xml and json.


Vulnerable code:
  resources :users, :id => /\d+/ do
    it "recognizes and generates #index" do
      { :get => "/users" }.should route_to(:controller => "users", :action => "index")
    it "recognizes and generates #destroy" do
      { :delete => "/users/1" }.should route_to(:controller => "users", :action => "destroy", :id => "1")


Fixed code:
  def to_json(options = nil)
    [name].to_json
  end

  def to_xml(options = nil)
    [name].to_xml
  end

  resources :users, :id => /\d+/, :except => [:index, :destroy] do

  describe "serialization" do

    let(:user) { FactoryGirl.build(:user) }

    it "to json" do
      expect(user.to_json).to eql([user.name].to_json)
    end

    it "to xml" do
      expect(user.to_xml).to eql([user.name].to_xml)
    end

  end
    it "doesn't recognize #index" do
      { :get => "/users" }.should_not be_routable
    it "doesn't recognize #destroy" do
      { :delete => "/users/1" }.should_not be_routable
CVE-2013-7225 (Ruby, published 2014-01-02T14:59Z)
Description: value: Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/fatfreecrm/fat_free_crm
Files changed:
app/controllers/home_controller.rb
spec/controllers/home_controller_spec.rb
Commit message: Refactor activity_user to remove possible SQL injection points.


Vulnerable code:
              "(upper(first_name) LIKE upper('%#{first}%') AND upper(last_name) LIKE upper('%#{last}%'))"
            }.join(" OR ")
            "upper(first_name) LIKE upper('%#{user}%') OR upper(last_name) LIKE upper('%#{user}%')"
          User.where(name_query).first
      User.should_receive(:where).with("upper(first_name) LIKE upper('%Billy%') OR upper(last_name) LIKE upper('%Billy%')").and_return([@user])
      User.should_receive(:where).with("(upper(first_name) LIKE upper('%Billy%') AND upper(last_name) LIKE upper('%Elliot%')) OR (upper(first_name) LIKE upper('%Elliot%') AND upper(last_name) LIKE upper('%Billy%'))").and_return([@user])

Fixed code:
  # TODO: this is ugly, ugly code. It's being security patched now but urgently
  # needs refactoring to use user id instead. Permuations based on name or email
  # yield incorrect results.
              User.where(:first_name => first, :last_name => last)
            }.map(&:to_a).flatten.first
            [User.where(:first_name => user), User.where(:last_name => user)].map(&:to_a).flatten.first
      User.should_receive(:where).with(:first_name => 'Billy').and_return([@user])
      User.should_receive(:where).with(:last_name => 'Billy').and_return([@user])
      User.should_receive(:where).with(:first_name => 'Billy', :last_name => "Elliot").and_return([@user])
      User.should_receive(:where).with(:first_name => 'Elliot', :last_name => "Billy").and_return([@user])
CVE-2013-7249 (Ruby, published 2014-01-02T14:59Z)
Description: value: Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/fatfreecrm/fat_free_crm
Files changed:
app/models/users/user.rb
config/routes.rb
spec/models/users/user_spec.rb
spec/routing/users_routing_spec.rb
Commit message: Add custom serializers for xml and json.


Vulnerable code:
  resources :users, :id => /\d+/ do
    it "recognizes and generates #index" do
      { :get => "/users" }.should route_to(:controller => "users", :action => "index")
    it "recognizes and generates #destroy" do
      { :delete => "/users/1" }.should route_to(:controller => "users", :action => "destroy", :id => "1")


Fixed code:
  def to_json(options = nil)
    [name].to_json
  end

  def to_xml(options = nil)
    [name].to_xml
  end

  resources :users, :id => /\d+/, :except => [:index, :destroy] do

  describe "serialization" do

    let(:user) { FactoryGirl.build(:user) }

    it "to json" do
      expect(user.to_json).to eql([user.name].to_json)
    end

    it "to xml" do
      expect(user.to_xml).to eql([user.name].to_xml)
    end

  end
    it "doesn't recognize #index" do
      { :get => "/users" }.should_not be_routable
    it "doesn't recognize #destroy" do
      { :delete => "/users/1" }.should_not be_routable
CVE-2014-5441 (Other, published 2014-09-12T14:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fatfreecrm/fat_free_crm
Files changed:
app/views/layouts/application.html.haml
Commit message: json_escape user input


Vulnerable code:
        #{User.all.map{|u| "\"#{u.full_name} (@#{u.username})\"" }.join(",\n")}

Fixed code:
        #{User.all.map{|u| "\"#{j u.full_name} (@#{j u.username})\"" }.join(",\n")}
CVE-2018-20975 (Ruby, published 2019-08-20T13:15Z)
Description: value: Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fatfreecrm/fat_free_crm
Files changed:
app/helpers/tags_helper.rb
Commit message: Context-sensitive XSS bugfix.


Vulnerable code:
      out << link_to_function(tag, "crm.search_tagged('#{query}', '#{model.class.to_s.tableize}')", title: tag)

Fixed code:
      out << link_to_function(tag, "crm.search_tagged('#{escape_javascript(query)}', '#{model.class.to_s.tableize}')", title: tag)
CVE-2022-39281 (Unknown, published 2022-10-08T01:15Z)
Description: value: fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/fatfreecrm/fat_free_crm
Files changed:
Commit message: Merge pull request from GHSA-p75c-5x3h-cxcg

CVE-2022-39281 mitigations

Vulnerable code:

Fixed code:
CVE-2015-10005 (JavaScript, published 2022-12-27T09:15Z)
Description: value: A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/markdown-it/markdown-it
Files changed:
lib/common/html_re.js
Commit message: cdata regexp fix


Vulnerable code:
var cdata       = /<!\[CDATA\[([^\]]+|\][^\]]|\]\][^>])*\]\]>/;

Fixed code:
var cdata       = /<!\[CDATA\[[\s\S]*?\]\]>/;
CVE-2015-3295 (JavaScript, published 2017-06-07T21:29Z)
Description: value: markdown-it before 4.1.0 does not block data: URLs.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/markdown-it/markdown-it
Files changed:
lib/index.js
test/fixtures/markdown-it/xss.txt
Commit message: Disabled data URIs (allow only some whitelisted images)


Vulnerable code:

var BAD_PROTOCOLS    = [ 'vbscript', 'javascript', 'file' ];
  //
  var str = url.trim().toLowerCase();
  if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(str.split(':')[0]) >= 0) {

Fixed code:
////////////////////////////////////////////////////////////////////////////////
//
// This validator does not pretent to functionality of full weight sanitizers.
// It's a tradeoff between default security, simplicity and usability.
// If you need different setup - override validator method as you wish. Or
// replace it with dummy function and use external sanitizer.
//

var BAD_PROTOCOLS      = [ 'vbscript', 'javascript', 'file', 'data' ];
var ALLOWED_DATA_MIMES = [
  'data:image/gif',
  'data:image/png',
  'data:image/jpeg',
  'data:image/webp'
];
  var str      = url.trim().toLowerCase(),
      protocol = str.split(':')[0];

  if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(protocol) >= 0) {
    if (protocol === 'data' && ALLOWED_DATA_MIMES.indexOf(str.split(';')[0]) >= 0) {
      return true;
    }

////////////////////////////////////////////////////////////////////////////////


Should not allow data-uri except some whitelisted mimes
.
![](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
.
<p><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" alt=""></p>
.

.
[xss link](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
.
<p>[xss link](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)</p>
.
CVE-2022-21670 (JavaScript, published 2022-01-10T21:15Z)
Description: value: markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/markdown-it/markdown-it
Files changed:
CHANGELOG.md
lib/rules_inline/newline.js
test/pathological.js
Commit message: Fix possible ReDOS in newline rule.

Co-authored-by: MakeNowJust <make.just.on@gmail.com>


Vulnerable code:
  var pmax, max, pos = state.pos;
        state.pending = state.pending.replace(/ +$/, '');

Fixed code:
## [12.3.2] - 2022-01-08
### Security
- Fix possible ReDOS in newline rule. Thanks to @MakeNowJust.

[12.3.2]: https://github.com/markdown-it/markdown-it/compare/12.3.1...12.3.2
  var pmax, max, ws, pos = state.pos;
        // Find whitespaces tail of pending chars.
        ws = pmax - 1;
        while (ws >= 1 && state.pending.charCodeAt(ws - 1) === 0x20) ws--;

        state.pending = state.pending.slice(0, ws);

    it('hardbreak whitespaces pattern', async () => {
      await test_pattern('x' + ' '.repeat(150000) + 'x  \nx');
    });
CVE-2020-36659 (Perl, published 2023-01-27T05:15Z)
Description: value: In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/LemonLDAPNG/Apache-Session-Browseable
Files changed:
lib/Apache/Session/Browseable/Store/LDAP.pm
Commit message: Add ldapVerify option for SSL cert validation


Vulnerable code:
        $h{cafile} = $self->{args}->{caFile} if ( $self->{args}->{caFile} );
        $h{capath} = $self->{args}->{caPath} if ( $self->{args}->{caPath} );

Fixed code:
    # Compatibility
    my $caFile = $self->{args}->{ldapCAFile} || $self->{args}->{caFile};
    my $caPath = $self->{args}->{ldapCAPath} || $self->{args}->{caPath};

        verify => $self->{args}->{ldapVerify} || "require",
	( $caFile ? ( cafile => $caFile ) : () ),
	( $caPath ? ( capath => $caPath ) : () ),


        $h{verify} = $self->{args}->{ldapVerify} || "require";
        $h{cafile} = $caFile if ( $caFile );
        $h{capath} = $caPath if ( $caPath );