hitoshura25/cvefixes huggingface dataset:
CVE-2022-25978 (Other, published 2023-02-15T05:15Z)
Description: value: All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme. 
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
server/resource.go
web/src/components/CreateResourceDialog.tsx
Commit message: chore: validate external link (#1069)



Vulnerable code:
		c.Response().Writer.WriteHeader(http.StatusOK)
		c.Response().Writer.Header().Set("Content-Type", resource.Type)
		c.Response().Writer.Header().Set(echo.HeaderContentSecurityPolicy, "default-src 'self'")
		if _, err := c.Response().Writer.Write(resource.Blob); err != nil {
			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to write resource blob").SetInternal(err)
		}
		return nil
			return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to fetch resource ID: %v", resourceID)).SetInternal(err)
		resourceType := strings.ToLower(resource.Type)
		if strings.HasPrefix(resourceType, "text") || (strings.HasPrefix(resourceType, "application") && resourceType != "application/pdf") {
			resourceType = echo.MIMETextPlain
		}
		if strings.HasPrefix(resourceType, "video") || strings.HasPrefix(resourceType, "audio") {
              placeholder="File link"

Fixed code:
		// Only allow those external links with http prefix.
		if resourceCreate.ExternalLink != "" && !strings.HasPrefix(resourceCreate.ExternalLink, "http") {
			return echo.NewHTTPError(http.StatusBadRequest, "Invalid external link")
		}
		return c.Stream(http.StatusOK, resource.Type, bytes.NewReader(resource.Blob))
			return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to find resource by ID: %v", resourceID)).SetInternal(err)
		resourceType := strings.ToLower(resource.Type)
		if strings.HasPrefix(resourceType, "text") {
			resourceType = echo.MIMETextPlainCharsetUTF8
		} else if strings.HasPrefix(resourceType, "video") || strings.HasPrefix(resourceType, "audio") {
              placeholder="https://the.link.to/your/resource"
CVE-2022-4609 (Go, published 2022-12-19T12:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
server/resource.go
Commit message: chore: restrict the html file (#749)

* restrict the html file

* replace spaces with table

* remove space

Vulnerable code:

Fixed code:
	"strings"
		if strings.HasSuffix(filename, ".html") {
			return echo.NewHTTPError(http.StatusBadRequest, "html file is not allowed")
		}
CVE-2022-4684 (Go, published 2022-12-23T12:15Z)
Description: value: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/usememos/memos
Files changed:
api/memo.go
api/resource.go
api/shortcut.go
api/user.go
Commit message: fix: disable decode patch id (#831)



Vulnerable code:
	ID int
	ID int
	ID int
	ID int

Fixed code:
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4686 (Go, published 2022-12-23T12:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/usememos/memos
Files changed:
api/memo.go
api/resource.go
api/shortcut.go
api/user.go
Commit message: fix: disable decode patch id (#831)



Vulnerable code:
	ID int
	ID int
	ID int
	ID int

Fixed code:
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4687 (Go, published 2022-12-23T12:15Z)
Description: value: Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/usememos/memos
Files changed:
api/memo.go
api/resource.go
api/shortcut.go
api/user.go
Commit message: fix: disable decode patch id (#831)



Vulnerable code:
	ID int
	ID int
	ID int
	ID int

Fixed code:
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4688 (Go, published 2022-12-23T12:15Z)
Description: value: Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/usememos/memos
Files changed:
api/memo.go
api/resource.go
api/shortcut.go
api/user.go
Commit message: fix: disable decode patch id (#831)



Vulnerable code:
	ID int
	ID int
	ID int
	ID int

Fixed code:
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4689 (Go, published 2022-12-23T12:15Z)
Description: value: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/usememos/memos
Files changed:
api/memo.go
api/resource.go
api/shortcut.go
api/user.go
Commit message: fix: disable decode patch id (#831)



Vulnerable code:
	ID int
	ID int
	ID int
	ID int

Fixed code:
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
	ID int `json:"-"`
CVE-2022-4690 (Go, published 2022-12-23T12:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
server/resource.go
server/server.go
Commit message: feat: add secure middleware (#832)



Vulnerable code:
	"strings"
		if strings.HasPrefix(resource.Type, echo.MIMETextHTML) {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}

Fixed code:
		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		ContentSecurityPolicy: "default-src 'self'",
	}))
CVE-2022-4691 (Go, published 2022-12-27T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
server/resource.go
server/server.go
Commit message: feat: add secure middleware (#832)



Vulnerable code:
	"strings"
		if strings.HasPrefix(resource.Type, echo.MIMETextHTML) {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}

Fixed code:
		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		ContentSecurityPolicy: "default-src 'self'",
	}))
CVE-2022-4692 (Go, published 2022-12-23T20:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
server/resource.go
server/server.go
Commit message: feat: add secure middleware (#832)



Vulnerable code:
	"strings"
		if strings.HasPrefix(resource.Type, echo.MIMETextHTML) {
			c.Response().Writer.Header().Set("Content-Type", echo.MIMETextPlain)
		} else {
			c.Response().Writer.Header().Set("Content-Type", resource.Type)
		}

Fixed code:
		c.Response().Writer.Header().Set("Content-Type", resource.Type)
	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
		ContentSecurityPolicy: "default-src 'self'",
	}))
CVE-2022-4694 (TypeScript, published 2022-12-27T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
web/src/components/SearchBar.tsx
web/src/labs/highlighter/index.ts
web/src/labs/marked/parser/Bold.ts
web/src/labs/marked/parser/BoldEmphasis.ts
web/src/labs/marked/parser/Emphasis.ts
web/src/labs/marked/parser/Link.ts
Commit message: chore: add escape to prevent XSS (#833)



Vulnerable code:
  }, [locationStore.getState().query.text]);
const escapeRegExp = (str: string): string => {
  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
};
  keyword = escapeRegExp(keyword);
  wrap.innerHTML = html;
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [InlineCode, BoldEmphasis, Emphasis, Bold]);

Fixed code:
  }, [locationStore.state.query.text]);
import { escape } from "lodash";
  keyword = escape(keyword);
  wrap.innerHTML = escape(html);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
  const parsedContent = marked(escape(matchResult[1]), [], [InlineCode, BoldEmphasis, Emphasis, Bold]);
CVE-2022-4695 (TypeScript, published 2022-12-27T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
web/src/components/SearchBar.tsx
web/src/labs/highlighter/index.ts
web/src/labs/marked/parser/Bold.ts
web/src/labs/marked/parser/BoldEmphasis.ts
web/src/labs/marked/parser/Emphasis.ts
web/src/labs/marked/parser/Link.ts
Commit message: chore: add escape to prevent XSS (#833)



Vulnerable code:
  }, [locationStore.getState().query.text]);
const escapeRegExp = (str: string): string => {
  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
};
  keyword = escapeRegExp(keyword);
  wrap.innerHTML = html;
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [InlineCode, BoldEmphasis, Emphasis, Bold]);

Fixed code:
  }, [locationStore.state.query.text]);
import { escape } from "lodash";
  keyword = escape(keyword);
  wrap.innerHTML = escape(html);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
  const parsedContent = marked(escape(matchResult[1]), [], [InlineCode, BoldEmphasis, Emphasis, Bold]);
CVE-2022-4734 (Go, published 2022-12-27T15:15Z)
Description: value: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.


Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/usememos/memos
Files changed:
server/system.go
Commit message: chore: hide host user email (#856)



Vulnerable code:

Fixed code:
			hostUser.Email = ""
CVE-2022-4839 (TypeScript, published 2022-12-29T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
web/src/labs/marked/index.ts
web/src/labs/marked/parser/Bold.ts
web/src/labs/marked/parser/BoldEmphasis.ts
web/src/labs/marked/parser/Emphasis.ts
web/src/labs/marked/parser/Link.ts
web/src/labs/marked/parser/Strikethrough.ts
Commit message: chore: fix XSS in renderer (#875)

chore: fix xss in renderer

Vulnerable code:
      return prefixStr + matchedInlineParser.renderer(matchedStr) + marked(suffixStr, [], inlineParsers);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
  const parsedContent = marked(escape(matchResult[1]), [], [InlineCode, BoldEmphasis, Emphasis, Bold]);
import { marked } from "..";
  const parsedContent = marked(matchResult[1], [], []);
  return `<del>${parsedContent}</del>`;

Fixed code:
      return marked(prefixStr, [], inlineParsers) + matchedInlineParser.renderer(matchedStr) + marked(suffixStr, [], inlineParsers);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [InlineCode, BoldEmphasis, Emphasis, Bold]);
import { escape } from "lodash";
  return `<del>${escape(matchResult[1])}</del>`;
CVE-2022-4840 (TypeScript, published 2022-12-29T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
web/src/labs/marked/index.ts
web/src/labs/marked/parser/Bold.ts
web/src/labs/marked/parser/BoldEmphasis.ts
web/src/labs/marked/parser/Emphasis.ts
web/src/labs/marked/parser/Link.ts
web/src/labs/marked/parser/Strikethrough.ts
Commit message: chore: fix XSS in renderer (#875)

chore: fix xss in renderer

Vulnerable code:
      return prefixStr + matchedInlineParser.renderer(matchedStr) + marked(suffixStr, [], inlineParsers);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
  const parsedContent = marked(escape(matchResult[1]), [], [InlineCode, BoldEmphasis, Emphasis, Bold]);
import { marked } from "..";
  const parsedContent = marked(matchResult[1], [], []);
  return `<del>${parsedContent}</del>`;

Fixed code:
      return marked(prefixStr, [], inlineParsers) + matchedInlineParser.renderer(matchedStr) + marked(suffixStr, [], inlineParsers);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [InlineCode, BoldEmphasis, Emphasis, Bold]);
import { escape } from "lodash";
  return `<del>${escape(matchResult[1])}</del>`;
CVE-2022-4841 (TypeScript, published 2022-12-29T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/usememos/memos
Files changed:
web/src/labs/marked/index.ts
web/src/labs/marked/parser/Bold.ts
web/src/labs/marked/parser/BoldEmphasis.ts
web/src/labs/marked/parser/Emphasis.ts
web/src/labs/marked/parser/Link.ts
web/src/labs/marked/parser/Strikethrough.ts
Commit message: chore: fix XSS in renderer (#875)

chore: fix xss in renderer

Vulnerable code:
      return prefixStr + matchedInlineParser.renderer(matchedStr) + marked(suffixStr, [], inlineParsers);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
import { escape } from "lodash";
  const parsedContent = marked(escape(matchResult[1]), [], [Link]);
  const parsedContent = marked(escape(matchResult[1]), [], [InlineCode, BoldEmphasis, Emphasis, Bold]);
import { marked } from "..";
  const parsedContent = marked(matchResult[1], [], []);
  return `<del>${parsedContent}</del>`;

Fixed code:
      return marked(prefixStr, [], inlineParsers) + matchedInlineParser.renderer(matchedStr) + marked(suffixStr, [], inlineParsers);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [Link]);
  const parsedContent = marked(matchResult[1], [], [InlineCode, BoldEmphasis, Emphasis, Bold]);
import { escape } from "lodash";
  return `<del>${escape(matchResult[1])}</del>`;
CVE-2022-4844 (Go, published 2022-12-29T18:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/usememos/memos
Files changed:
server/acl.go
server/server.go
Commit message: chore: fix CSRF (#876)



Vulnerable code:

Fixed code:
		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4845 (Go, published 2022-12-29T18:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/usememos/memos
Files changed:
server/acl.go
server/server.go
Commit message: chore: fix CSRF (#876)



Vulnerable code:

Fixed code:
		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4846 (Go, published 2022-12-29T18:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/usememos/memos
Files changed:
server/acl.go
server/server.go
Commit message: chore: fix CSRF (#876)



Vulnerable code:

Fixed code:
		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4847 (Go, published 2022-12-29T18:15Z)
Description: value: Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-941 \u2014 Incorrectly Specified Destination in a Communication Channel
The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
Repository: https://github.com/usememos/memos
Files changed:
server/acl.go
server/server.go
Commit message: chore: fix CSRF (#876)



Vulnerable code:

Fixed code:
		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))
CVE-2022-4848 (Go, published 2022-12-29T18:15Z)
Description: value: Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
Severity: nan (CVSS v3 base score: 5.7)
Weakness: CWE-940 \u2014 Improper Verification of Source of a Communication Channel
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Repository: https://github.com/usememos/memos
Files changed:
server/acl.go
server/server.go
Commit message: chore: fix CSRF (#876)



Vulnerable code:

Fixed code:
		SameSite: http.SameSiteStrictMode,
	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TokenLookup: "cookie:_csrf",
	}))