hitoshura25/cvefixes huggingface dataset:
CVE-2022-0578 (Ruby, published 2022-05-16T15:15Z)
Description: value: Code Injection in GitHub repository publify/publify prior to 9.2.8.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/publify/publify
Files changed:
publify_core/app/models/feedback.rb
publify_core/spec/models/comment_spec.rb
Commit message: Do not allow images in comments


Vulnerable code:
    helper.sanitize(helper.auto_link(html))

Fixed code:
  def self.allowed_tags
    @allowed_tags ||= Rails::Html::SafeListSanitizer.allowed_tags - ["img"]
  end

    helper.sanitize(helper.auto_link(html), tags: self.class.allowed_tags)
    context "with a comment containing some html" do
      let(:comment) do
        described_class.new do |c|
          c.body = "Test <b>foo</b> <img src=\"https://eviloverlord.com/getmyip.jpg\">"
          c.author = "Bob"
          c.article = build_stubbed(:article, blog: blog)
        end
      end

      ["", "textile", "markdown", "smartypants", "markdown smartypants"].each do |filter|
        it "rejects images but not formatting with filter '#{filter}'" do
          blog.comment_text_filter = filter

          html = comment.html(:body)

          ActiveSupport::Deprecation.silence do
            expect(html).not_to match(/<img/)
            expect(html).to match(%r{<b>foo</b>})
          end
        end
      end
    end
CVE-2022-1553 (Ruby, published 2022-05-16T15:15Z)
Description: value: Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/publify/publify
Files changed:
publify_core/app/controllers/articles_controller.rb
publify_core/spec/controllers/articles_controller_spec.rb
spec/controllers/articles_controller_spec.rb
Commit message: Do not create article meta description for password-protected articles


Vulnerable code:
        @description = this_blog.article_desc_template.to_title(@article, this_blog, params)
          let(:article) { create(:article, password: "password") }
          it "article alone should be password protected" do

Fixed code:
        if @article.password.blank?
          @description = this_blog.article_desc_template.
            to_title(@article, this_blog, params)
        end

    context "when the article is password protected" do
      render_views

      let!(:blog) { create(:blog, permalink_format: "/%title%.html") }
      let!(:article) do
        create(:article, title: "Secretive", body: "protected foobar", password: "password")
      end

      it "shows a password form for the article" do
        get :redirect, params: { from: "secretive.html" }
        expect(response.body).to have_selector('input[id="article_password"]', count: 1)
      end

      it "does not include the article body anywhere" do
        get :redirect, params: { from: "secretive.html" }
        expect(response.body).not_to include article.body
      end
    end
          let(:article) do
            create(:article, title: "Secretive", body: "protected foobar",
                             password: "password")
          end
          it "shows a password form for the article" do

          it "does not include the article body anywhere" do
            get :redirect, params: { from: from_param }
            expect(response.body).not_to include article.body
          end
CVE-2022-1810 (Ruby, published 2022-05-23T12:16Z)
Description: value: Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/publify/publify
Files changed:
publify_core/app/controllers/admin/content_controller.rb
publify_core/spec/controllers/admin/content_controller_spec.rb
Commit message: Use only the main id parameter to find Article to update


Vulnerable code:
    return unless access_granted?(params[:id])
    id = params[:article][:id] || params[:id]

Fixed code:
    id = params[:id]
    return unless access_granted?(id)

      context "with an owned article and another user's article" do
        let(:article) { create(:article, body: "another *textile* test", user: publisher) }
        let(:other_article) { create(:article, body: "other article") }
        let(:body) { "not the *same* text" }

        before do
          put :update,
              params: { id: article.id,
                        article: { id: other_article.id, body: body } }
        end

        it "ignores the extra id passed in the article parameters" do
          aggregate_failures do
            expect(response).to redirect_to(action: "index")
            expect(article.reload.body).to eq(body)
            expect(other_article.reload.body).not_to eq(body)
          end
        end
      end
CVE-2022-1811 (Ruby, published 2022-05-23T16:16Z)
Description: value: Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/publify/publify
Files changed:
publify_core/app/uploaders/resource_uploader.rb
publify_core/spec/controllers/admin/resources_controller_spec.rb
Commit message: Refuse html files as resources even if declared to be plain text


Vulnerable code:
  before :cache, :check_image_content_type!
  def check_image_content_type!(new_file)
    if image?(new_file)
      magic_type = mime_magic_content_type(new_file)
      if magic_type != new_file.content_type
        raise CarrierWave::IntegrityError, "has MIME type mismatch"
      end
  # NOTE: This method was adapted from MagicMimeBlacklist#extract_content_type
  # from CarrierWave 1.0.0 and SanitizedFile#mime_magic_content_type from CarrierWave 0.11.2
  def mime_magic_content_type(new_file)
    content_type = nil

    File.open(new_file.path) do |fd|
      content_type = Marcel::MimeType.for(fd)
    end
    content_type

Fixed code:
  before :cache, :check_content_type!
  def check_content_type!(new_file)
    detected_type = if image? new_file
                      file_content_content_type(new_file)
                    else
                      file_content_type(new_file)
                    end
    if detected_type != new_file.content_type
      raise CarrierWave::IntegrityError, "has MIME type mismatch"
  def file_content_content_type(new_file)
    Marcel::MimeType.for Pathname.new(new_file.path)
  end
  def file_content_type(new_file)
    Marcel::MimeType.for Pathname.new(new_file.path), name: new_file.filename
    context "when attempting to upload an html file as text/plain" do
      let(:upload) { file_upload("just_some.html", "text/plain") }

      it "does not create a new Resource" do
        expect { post :upload, params: { upload: upload } }.
          not_to change(Resource, :count)
      end

      it "warns the user they can't upload this type of file" do
        post :upload, params: { upload: upload }
        result = assigns(:up)
        expect(result.errors[:upload]).
          to match_array ["has MIME type mismatch", "can't be blank"]
      end

      it "sets the flash to failure" do
        post :upload, params: { upload: upload }
        aggregate_failures do
          expect(flash[:success]).to be_nil
          expect(flash[:warning]).not_to be_nil
        end
      end
    end
CVE-2022-1812 (Ruby, published 2023-01-14T14:15Z)
Description: value: Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/publify/publify
Files changed:
publify_core/app/models/user.rb
publify_core/spec/models/user_spec.rb
Commit message: Validate length of user's name attribute

This attribute is a text column, so it could be very long even in a
MySQL database. Limit it to a generous length.


Vulnerable code:

Fixed code:
  validates :name, length: { maximum: 2048 }
    it "requires name to not be too long" do
      expect(user).to validate_length_of(:name).is_at_most(2048)
    end
CVE-2022-2815 (Ruby, published 2023-01-14T14:15Z)
Description: value: Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-922 \u2014 Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Repository: https://github.com/publify/publify
Files changed:
publify_core/Manifest.txt
publify_core/app/uploaders/resource_uploader.rb
publify_core/spec/controllers/admin/resources_controller_spec.rb
Commit message: Strip EXIF data from resource uploads


Vulnerable code:
  before :cache, :check_content_type!

Fixed code:
lib/publify_core/testing_support/fixtures/testfile.jpg
  before :process, :check_content_type!

  process :fix_exif_rotation, if: :image?
  process :strip, if: :image?
  def strip
    manipulate! do |img|
      img.strip
      img = yield(img) if block_given?
      img
    end
  end

  def fix_exif_rotation
    manipulate! do |img|
      img.auto_orient
      img = yield(img) if block_given?
      img
    end
  end

    context "when uploading an image file with exif data" do
      let(:upload) { file_upload("testfile.jpg", "image/jpeg") }

      it "creates a new Resource" do
        expect { post :upload, params: { upload: upload } }.
          to change(Resource, :count).by(1)
      end

      it "strips EXIF data" do
        post :upload, params: { upload: upload }
        resource = Resource.last
        img = MiniMagick::Image.open resource.upload.file.file
        expect(img.exif).to be_empty
      end

      it "sets the content type correctly" do
        post :upload, params: { upload: upload }
        expect(Resource.last.mime).to eq "image/jpeg"
      end

      it "sets the flash to success" do
        post :upload, params: { upload: upload }
        aggregate_failures do
          expect(flash[:success]).not_to be_nil
          expect(flash[:warning]).to be_nil
        end
      end
    end
CVE-2021-41170 (PHP, published 2021-11-08T19:15Z)
Description: value: neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously. In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible. Version 1.1.1 has addressed this vulnerability. Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-277 \u2014 Insecure Inherited Permissions
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
Repository: https://github.com/sroehrl/neoan3-template
Files changed:
Template.php
TemplateFunctions.php
composer.json
tests/TemplateTest.php
Commit message: SECURITY: allowing for direct injection (Issue #8)


Vulnerable code:
            if(is_callable($value)){
                TemplateFunctions::registerClosure($flatKey,$value);
            } else {
                $content = preg_replace("/$saveOpening\s*$flatKey\s*$saveClosing/", $value, $content);
                $content = TemplateFunctions::tryClosures($flatArray, $content, false);
            }
        $pattern .= "$closureName\(([a-z0-9,\.\s]+)\)";

            $array = Template::flattenArray($array);

    "version": "1.1.0",

            'myFunc' => function ($x) {
                return strtoupper($x);
            },

Fixed code:
            // PATCHED: direct function injection is not allowed anymore
            $content = preg_replace("/$saveOpening\s*$flatKey\s*$saveClosing/", $value, $content);
            $content = TemplateFunctions::tryClosures($flatArray, $content, false);

        $pattern .= "$closureName\(([a-z0-9,\.\s_]+)\)";
        $array = Template::flattenArray($array);
        // important: first try closures
        $array = array_merge(self::$registeredClosures, $array);
    "version": "1.1.1",
        TemplateFunctions::registerClosure('myFunc',function($x){
            return strtoupper($x);
        });
CVE-2021-41170 (PHP, published 2021-11-08T19:15Z)
Description: value: neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously. In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible. Version 1.1.1 has addressed this vulnerability. Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/sroehrl/neoan3-template
Files changed:
Template.php
TemplateFunctions.php
composer.json
tests/TemplateTest.php
Commit message: SECURITY: allowing for direct injection (Issue #8)


Vulnerable code:
            if(is_callable($value)){
                TemplateFunctions::registerClosure($flatKey,$value);
            } else {
                $content = preg_replace("/$saveOpening\s*$flatKey\s*$saveClosing/", $value, $content);
                $content = TemplateFunctions::tryClosures($flatArray, $content, false);
            }
        $pattern .= "$closureName\(([a-z0-9,\.\s]+)\)";

            $array = Template::flattenArray($array);

    "version": "1.1.0",

            'myFunc' => function ($x) {
                return strtoupper($x);
            },

Fixed code:
            // PATCHED: direct function injection is not allowed anymore
            $content = preg_replace("/$saveOpening\s*$flatKey\s*$saveClosing/", $value, $content);
            $content = TemplateFunctions::tryClosures($flatArray, $content, false);

        $pattern .= "$closureName\(([a-z0-9,\.\s_]+)\)";
        $array = Template::flattenArray($array);
        // important: first try closures
        $array = array_merge(self::$registeredClosures, $array);
    "version": "1.1.1",
        TemplateFunctions::registerClosure('myFunc',function($x){
            return strtoupper($x);
        });
CVE-2018-20433 (Java, published 2018-12-24T13:29Z)
Description: value: c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/zhutougg/c3p0
Files changed:
src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java
Commit message: Repair XXE vulnerability at initialization

Vulnerable code:

Fixed code:
	fact.setExpandEntityReferences(false);
CVE-2018-25091 (Python, published 2023-10-15T19:15Z)
Description: value: urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/urllib3/urllib3
Files changed:
CHANGES.rst
CONTRIBUTORS.txt
src/urllib3/poolmanager.py
src/urllib3/util/retry.py
test/test_retry.py
test/with_dummyserver/test_poolmanager.py
Commit message: Remove Authorization headers regardless of case on cross-origin redirects (#1511)




Vulnerable code:
            for header in retries.remove_headers_on_redirect:
                kw['headers'].pop(header, None)
        self.remove_headers_on_redirect = remove_headers_on_redirect
        assert list(retry.remove_headers_on_redirect) == ['Authorization']
        assert list(retry.remove_headers_on_redirect) == ['X-API-Secret']

Fixed code:
* Remove Authorization header regardless of case when redirecting to cross-site. (Issue #1510)

* Katsuhiko YOSHIDA <https://github.com/kyoshidajp>
  * Remove Authorization header regardless of case when redirecting to cross-site

from .packages import six
            headers = list(six.iterkeys(kw['headers']))
            for header in headers:
                if header.lower() in retries.remove_headers_on_redirect:
                    kw['headers'].pop(header, None)
        self.remove_headers_on_redirect = frozenset([
            h.lower() for h in remove_headers_on_redirect])
        assert list(retry.remove_headers_on_redirect) == ['authorization']
        assert list(retry.remove_headers_on_redirect) == ['x-api-secret']
        r = http.request('GET', '%s/redirect' % self.base_url,
                         fields={'target': '%s/headers' % self.base_url_alt},
                         headers={'authorization': 'foo'})

        self.assertEqual(r.status, 200)

        data = json.loads(r.data.decode('utf-8'))

        self.assertNotIn('authorization', data)
        self.assertNotIn('Authorization', data)

        r = http.request('GET', '%s/redirect' % self.base_url,
                         fields={'target': '%s/headers' % self.base_url_alt},
                         headers={'x-api-secret': 'foo',
                                  'authorization': 'bar'},
                         retries=Retry(remove_headers_on_redirect=['X-API-Secret']))

        self.assertEqual(r.status, 200)

        data = json.loads(r.data.decode('utf-8'))

        self.assertNotIn('x-api-secret', data)
        self.assertNotIn('X-API-Secret', data)
        self.assertEqual(data['Authorization'], 'bar')
CVE-2020-26137 (Python, published 2020-09-30T18:15Z)
Description: value: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/urllib3/urllib3
Files changed:
CHANGES.rst
src/urllib3/connection.py
test/with_dummyserver/test_connectionpool.py
Commit message: Raise ValueError if method contains control characters (#1800)



Vulnerable code:

Fixed code:
master (dev)
------------

* Raise ``ValueError`` if control characters are given in
  the ``method`` parameter of ``HTTPConnection.request()`` (Pull #1800)


import re
_CONTAINS_CONTROL_CHAR_RE = re.compile(r"[^-!#$%&'*+.^_`|~0-9a-zA-Z]")

    def putrequest(self, method, url, *args, **kwargs):
        """Send a request to the server"""
        match = _CONTAINS_CONTROL_CHAR_RE.search(method)
        if match:
            raise ValueError(
                "Method cannot contain non-token characters %r (found at least %r)"
                % (method, match.group())
            )

        return _HTTPConnection.putrequest(self, method, url, *args, **kwargs)

    @pytest.mark.parametrize("char", [" ", "\r", "\n", "\x00"])
    def test_invalid_method_not_allowed(self, char):
        with pytest.raises(ValueError):
            with HTTPConnectionPool(self.host, self.port) as pool:
                pool.request("GET" + char, "/")