hitoshura25/cvefixes huggingface dataset:
CVE-2019-17673 (PHP, published 2019-10-17T13:15Z)
Description: value: WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/rest-api.php
wp-includes/version.php
Commit message: REST API: Send a Vary: Origin header on GET requests.

Add this header on all GET requests to prevent cached requests.

Props darthhexx, davidbinda, nickdaugherty, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46478


git-svn-id: http://core.svn.wordpress.org/trunk@46276 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '5.3-beta3-46477';

Fixed code:
	} else if ( 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
		header( 'Vary: Origin' );
$wp_version = '5.3-beta3-46478';
CVE-2019-17675 (PHP, published 2019-10-17T13:15Z)
Description: value: WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/pluggable.php
wp-includes/version.php
Commit message: Administration: Ensure that admin referer nonce is valid.

Coding standards, ensure that nonce is valid with identical, rather then equal operator.

Props vortfu, xknown, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46477


git-svn-id: http://core.svn.wordpress.org/trunk@46275 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
		if ( -1 == $action ) {
		if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) {
$wp_version = '5.3-beta3-46476';

Fixed code:
		if ( -1 === $action ) {
		if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) {
$wp_version = '5.3-beta3-46477';
CVE-2019-17675 (PHP, published 2019-10-17T13:15Z)
Description: value: WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/pluggable.php
wp-includes/version.php
Commit message: Administration: Ensure that admin referer nonce is valid.

Coding standards, ensure that nonce is valid with identical, rather then equal operator.

Props vortfu, xknown, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46477


git-svn-id: http://core.svn.wordpress.org/trunk@46275 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
		if ( -1 == $action ) {
		if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) {
$wp_version = '5.3-beta3-46476';

Fixed code:
		if ( -1 === $action ) {
		if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) {
$wp_version = '5.3-beta3-46477';
CVE-2019-9787 (PHP, published 2019-03-14T16:29Z)
Description: value: WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/ajax-actions.php
wp-includes/comment.php
wp-includes/version.php
Commit message: Comments: Improve comment content filtering.
Built from https://develop.svn.wordpress.org/trunk@44842


git-svn-id: http://core.svn.wordpress.org/trunk@44674 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '5.2-alpha-44833';

Fixed code:
				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
				add_filter( 'pre_comment_content', 'wp_filter_kses' );
				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
				add_filter( 'pre_comment_content', 'wp_filter_kses' );
$wp_version = '5.2-alpha-44842';
CVE-2022-29858 (PHP, published 2022-06-28T22:15Z)
Description: value: Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/silverstripe/silverstripe-assets
Files changed:
src/Shortcodes/ImageShortcodeProvider.php
tests/php/Shortcodes/ImageShortcodeProviderTest.php
Commit message: [CVE-2022-29858] Read grant config for regenerate_shortcode


Vulnerable code:
            $args['src'] = $record->getURL();

Fixed code:
        $allowSessionGrant = static::config()->allow_session_grant;

            $args['src'] = $record->getURL($allowSessionGrant);
use SilverStripe\Assets\FilenameParsing\ParsedFileID;
use SilverStripe\Assets\Storage\AssetStore;
use SilverStripe\Assets\Shortcodes\FileShortcodeProvider;
use SilverStripe\Core\Injector\Injector;
use SilverStripe\Security\InheritedPermissions;
use SilverStripe\Security\Member;

    public function testRegenerateShortcode()
    {
        $assetStore = Injector::inst()->get(AssetStore::class);
        $member = Member::create();
        $member->write();
        // Logout first to throw away the existing session which may have image grants.
        $this->logOut();
        $this->logInAs($member);
        // image is in protected asset store
        $image = $this->objFromFixture(Image::class, 'imageWithTitle');
        $image->CanViewType = InheritedPermissions::ONLY_THESE_USERS;
        $image->write();
        $url = $image->getUrl(false);
        $args = [
            'id' => $image->ID,
            'src' => $url,
            'width' => '550',
            'height' => '366',
            'class' => 'leftAlone ss-htmleditorfield-file image',
        ];
        $shortHash = substr($image->getHash(), 0, 10);
        $expected = implode(' ', [
            '[image id="' . $image->ID . '" src="/assets/folder/' . $shortHash . '/test-image.png" width="550"',
            'height="366" class="leftAlone ss-htmleditorfield-file image"]'
        ]);
        $parsedFileID = new ParsedFileID($image->getFilename(), $image->getHash());
        $html = ImageShortcodeProvider::regenerate_shortcode($args, '', '', 'image');
        $this->assertSame($expected, $html);
        $this->assertFalse($assetStore->isGranted($parsedFileID));
        Config::modify()->set(FileShortcodeProvider::class, 'allow_session_grant', true);
        $html = ImageShortcodeProvider::regenerate_shortcode($args, '', '', 'image');
        $this->assertSame($expected, $html);
        $this->assertTrue($assetStore->isGranted($parsedFileID));
    }
CVE-2024-22400 (PHP, published 2024-01-18T20:15Z)
Description: value: Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version 5.1.5, 5.2.5, or 6.0.1. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/nextcloud/user_saml
Files changed:
lib/Controller/SAMLController.php
tests/unit/Controller/SAMLControllerTest.php
Commit message: refactor(Controller): read parameter only once

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>


Vulnerable code:
		ICrypto $crypto
				$returnUrl = $this->request->getParam('originalUrl', $this->urlGenerator->linkToRouteAbsolute('user_saml.SAML.login'));
					'OriginalUrl' => $this->request->getParam('originalUrl', ''),
				$ssoUrl = $this->request->getParam('originalUrl', '');
			$this->crypto

Fixed code:
use OCP\Security\ITrustedDomainHelper;
	private ITrustedDomainHelper $trustedDomainHelper;
		ICrypto $crypto,
		ITrustedDomainHelper $trustedDomainHelper
		$this->trustedDomainHelper = $trustedDomainHelper;
		$originalUrl = (string)$this->request->getParam('originalUrl', '');
		if (!$this->trustedDomainHelper->isTrustedUrl($originalUrl)) {
			$originalUrl = '';
		}


				$returnUrl = $originalUrl ?: $this->urlGenerator->linkToRouteAbsolute('user_saml.SAML.login');
					'OriginalUrl' => $originalUrl,
				$ssoUrl = $originalUrl;
use OCP\Security\ITrustedDomainHelper;
	private ITrustedDomainHelper|MockObject $trustedDomainController;
		$this->trustedDomainController = $this->createMock(ITrustedDomainHelper::class);
			$this->crypto,
			$this->trustedDomainController
CVE-2022-31055 (Other, published 2022-06-13T16:15Z)
Description: value: kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark them as `public: false` and use `kctf chal debug port-forward` to connect.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/google/kctf
Files changed:
dist/bin/kctf-cluster
Commit message: Fix src ranges (#371)

* only delete the deployment on ip range update

* fix the allowed_ips update

Vulnerable code:
  "${KCTF_BIN}/kubectl" delete -f "${KCTF_CTF_DIR}/kctf/resources/operator.yaml" || return
    "${KCTF_BIN}/yq" eval "(((.|select(has(\"spec\"))).spec|select(has(\"template\"))).template.spec.containers[0].env[] | select(.name == \"ALLOWED_IPS\")).value = \"${RANGES}\"" "${KCTF_CTF_DIR}/kctf/resources/operator.yaml" \
      | "${KCTF_BIN}/yq" eval "(((.|select(has(\"spec\"))).spec|select(has(\"template\"))).template.spec.containers[0].env[] | select(.name == \"SECURITY_POLICY\")).value = \"${POLICY_NAME}\"" - \

Fixed code:
  "${KCTF_BIN}/yq" eval "select(.kind == \"Deployment\")" "${KCTF_CTF_DIR}/kctf/resources/operator.yaml" \
    | "${KCTF_BIN}/kubectl" delete -f - || return
    "${KCTF_BIN}/yq" eval "(select(.kind == \"Deployment\").spec.template.spec.containers[] | select(.name == \"manager\").env[] | select(.name == \"ALLOWED_IPS\").value) |= \"${RANGES}\"" "${KCTF_CTF_DIR}/kctf/resources/operator.yaml" \
      | "${KCTF_BIN}/yq" eval "(select(.kind == \"Deployment\").spec.template.spec.containers[] | select(.name == \"manager\").env[] | select(.name == \"SECURITY_POLICY\").value) |= \"${POLICY_NAME}\"" - \
CVE-2020-15262 (JavaScript, published 2020-10-19T20:15Z)
Description: value: In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
Severity: MEDIUM (CVSS v3 base score: 3.7)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/waysact/webpack-subresource-integrity
Files changed:
examples/dynamic-modified/README.md
examples/dynamic-modified/corrupt.js
examples/dynamic-modified/index.js
examples/dynamic-modified/test.js
examples/dynamic-modified/webpack.config.js
jmtp.js
package.json
Commit message: Fix hash lookup for dynamic chunks

Closes #131


Vulnerable code:
  function addAttribute(mainTemplate, elName, source, chunk) {
      elName + '.integrity = __webpack_require__.sriHashes[' + (chunk ? `'${chunk.id}'` : 'chunkId') + '];',
  "version": "1.5.0",

Fixed code:
# With a modified dynamically loaded chunk #hwp

Ensure that when a chunk is modified, it fails to load.
console.log('this should never load');
import("./corrupt").then(function error() {
  console.log('error');
}).catch(function ok() {
  console.log('ok');
});
var webpackVersionComponents = require('webpack/package.json').version.split(
  '.'
);
var webpackVersionMajor = Number(webpackVersionComponents[0]);

var defaultCheck = require("../../test/defaultCheck");
var fs = require('fs');

module.exports.skip = function skip() {
  return webpackVersionMajor < 2;
};

module.exports.check = function check(stats, url, browser) {
  const otherAsset = Object.keys(stats.compilation.assets).find(key => key !== 'index.js' && key.endsWith(".js"));
  fs.writeFileSync('dist/' + otherAsset, 'xxx');

  return defaultCheck(stats, url, browser);
};
var SriPlugin = require('webpack-subresource-integrity');
var HtmlWebpackPlugin = require('html-webpack-plugin');

module.exports = {
  entry: {
    index: './index.js'
  },
  output: {
    crossOriginLoading: 'anonymous'
  },
  plugins: [
    new SriPlugin({
      hashFuncNames: ['sha256', 'sha384'],
      enabled: true
    }),
    new HtmlWebpackPlugin()
  ]
};
var webpackVersionComponents = require('webpack/package.json').version.split(
  '.'
);
var webpackVersionMajor = Number(webpackVersionComponents[0]);
  function addAttribute(mainTemplate, elName, source) {

      elName + '.integrity = __webpack_require__.sriHashes[' +
        ((webpackVersionMajor >= 5 && elName === 'script') ? 'key.match(/^chunk-([0-9]+)$/)[1]' : 'chunkId') +
        '];',
  "version": "1.5.1",
CVE-2020-15259 (Unknown, published 2020-11-06T20:15Z)
Description: value: ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions <=5.0.12. If you do not have ad-ldap-connector admin console enabled or do not visit any other public URL while on the machine it is installed on, you are not affected. The issue is fixed in version 5.0.13.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/auth0/ad-ldap-connector
Files changed:
Commit message: Merge pull request from GHSA-vx5q-cp9v-427v

add CSRF protection in admin api's

Vulnerable code:

Fixed code:
CVE-2022-31103 (TypeScript, published 2022-06-27T23:15Z)
Description: value: lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`. This package is depended on by [react-letter](https://github.com/mat-sz/react-letter), therefore everyone using react-letter is also at risk. The problem has been patched in version 1.0.2.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/mat-sz/lettersanitizer
Files changed:
__tests__/sanitize.test.ts
src/index.ts
Commit message: filter out unsupported at-rules


Vulnerable code:
      } else if ('cssRules' in rule) {

Fixed code:

  it('removes @keyframes rules from CSS', () => {
    expect(
      sanitize(
        `<style>@keyframes test {
          0% {
              transform: rotate(0deg);
          }

          100% {
              transform: rotate(360deg);
          }
        }</style>`,
        '',
        { noWrapper: true, preserveCssPriority: false }
      )
    ).toBe(`<style></style>`);
  });

  it('removes @supports rules from CSS', () => {
    expect(
      sanitize(
        `<style>@supports (display: grid) {
            div {
              display: grid;
            }
          }</style>`,
        '',
        { noWrapper: true, preserveCssPriority: false }
      )
    ).toBe(`<style></style>`);
  });

  it('removes @font-face rules from CSS', () => {
    expect(
      sanitize(
        `<style>@font-face {
            font-family: "Open Sans";
            src: url("/fonts/OpenSans-Regular-webfont.woff2") format("woff2"),
                 url("/fonts/OpenSans-Regular-webfont.woff") format("woff");
          }</style>`,
        '',
        { noWrapper: true, preserveCssPriority: false }
      )
    ).toBe(`<style></style>`);
  });

  it('removes @import rules from CSS', () => {
    expect(
      sanitize(`<style>@import 'custom.css';</style>`, '', {
        noWrapper: true,
        preserveCssPriority: false,
      })
    ).toBe(`<style></style>`);
  });
      } else if ('cssRules' in rule && 'media' in rule) {
        // According to https://www.caniemail.com/,
        // out of all at-rules, Gmail only supports @media.
CVE-2019-25051 (C++, published 2021-07-20T07:15Z)
Description: value: objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gnuaspell/aspell
Files changed:
common/objstack.hpp
Commit message: objstack: assert that the alloc size will fit within a chunk
to prevent a buffer overflow

Bug found using OSS-Fuze.


Vulnerable code:
    if (bottom > top) {new_chunk(); tmp = bottom; bottom += size;}
    if (bottom > top) {new_chunk(); goto loop;}
    if (top < bottom) {new_chunk(); top -= size;}
    if (top < bottom) {new_chunk(); goto loop;}

Fixed code:
#include <stddef.h>
  bool will_overflow(size_t sz) const {
    return offsetof(Node,data) + sz > chunk_size;
  }
  void check_size(size_t sz) {
    assert(!will_overflow(sz));
  }
    if (bottom > top) {check_size(size); new_chunk(); tmp = bottom; bottom += size;}
    if (bottom > top) {check_size(size); new_chunk(); goto loop;}
    if (top < bottom) {check_size(size); new_chunk(); top -= size;}
    if (top < bottom) {check_size(size); new_chunk(); goto loop;}
      check_size(size);
      check_size(size);
      check_size(size);
CVE-2022-0496 (C++, published 2022-08-29T15:15Z)
Description: value: A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import().
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/openscad/openscad
Files changed:
src/dxfdata.cc
Commit message: add safety to line lookups in DXF import, fixes #4037

Add safety (test for, and continue past, bad indices).
Report warnings about bad indices
Add variables just to make the array indices easier to read and debug.


Vulnerable code:
				if (grid.eq(ref_point[0], ref_point[1], this->points[lines[k].idx[0]][0], this->points[lines[k].idx[0]][1])) {
				if (grid.eq(ref_point[0], ref_point[1], this->points[lines[k].idx[1]][0], this->points[lines[k].idx[1]][1])) {
				if (grid.eq(ref_point[0], ref_point[1], this->points[lines[k].idx[0]][0], this->points[lines[k].idx[0]][1])) {
					if (grid.eq(ref_point[0], ref_point[1], this->points[lines[k].idx[1]][0], this->points[lines[k].idx[1]][1])) {

Fixed code:
                    if (k < 0 || k >= lines.size()) {
                        LOG(message_group::Warning,Location::NONE,"",
                            "Bad DXF line index in %1$s.",QuotedString(boostfs_uncomplete(filename, fs::current_path()).generic_string()));
                        continue;
                    }
                if (k < 0 || k >= lines.size()) {
                    LOG(message_group::Warning,Location::NONE,"",
                        "Bad DXF line index in %1$s.",QuotedString(boostfs_uncomplete(filename, fs::current_path()).generic_string()));
                    continue;
                }
                auto idk0 = lines[k].idx[0];    // make it easier to read and debug
                auto idk1 = lines[k].idx[1];
				if (grid.eq(ref_point[0], ref_point[1], this->points[idk0][0], this->points[idk0][1])) {
				if (grid.eq(ref_point[0], ref_point[1], this->points[idk1][0], this->points[idk1][1])) {
                if (k < 0 || k >= lines.size()) {
                    LOG(message_group::Warning,Location::NONE,"",
                        "Bad DXF line index in %1$s.",QuotedString(boostfs_uncomplete(filename, fs::current_path()).generic_string()));
                    continue;
                }
                auto idk0 = lines[k].idx[0];    // make it easier to read and debug
                auto idk1 = lines[k].idx[1];
				if (grid.eq(ref_point[0], ref_point[1], this->points[idk0][0], this->points[idk0][1])) {
                if (grid.eq(ref_point[0], ref_point[1], this->points[idk1][0], this->points[idk1][1])) {
CVE-2015-10030 (PHP, published 2023-01-08T10:15Z)
Description: value: A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php. The manipulation of the argument dir leads to pathname traversal. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as d22337d453a2a14194cdb02bf12cdf9d9f827aa7. It is recommended to upgrade the affected component. VDB-217642 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/SUKOHI/Surpass
Files changed:
README.md
src/Sukohi/Surpass/Surpass.php
Commit message: Some code added to protect from directory traversal attack.


Vulnerable code:
        $this->_dir = $dir;

Fixed code:
	
	
*Note: method dir('dir_name') can no longer receive "/" and "." to protect from directory traversal attack.
        $this->_dir = str_replace(["\0", '/', '.'], '', $dir);