hitoshura25/cvefixes huggingface dataset:
CVE-2022-23538 (Go, published 2023-01-17T21:15Z)
Description: value: github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularity Enterprise 1.x installation, or third party server implementing this flow. Interaction with Singularity Enterprise 2.x, and Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow. We encourage all users to update. Users who interact with a Singularity Enterprise 1.x installation, using a 3rd party S3 storage service, are advised to revoke and recreate their authentication tokens within Singularity Enterprise. There is no workaround available at this time.
Severity: nan (CVSS v3 base score: 7.6)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/sylabs/scs-library-client
Files changed:
client/pull.go
Commit message: fix: omit credentials for redirected URLs


Vulnerable code:
	if c.AuthToken != "" {
	// Use uri from Location header to download artifact
	return c.multipartDownload(ctx, res.Header.Get("Location"), creds, dst, img.Size, spec, pb)

Fixed code:
	redirectURL, err := url.Parse(res.Header.Get("Location"))
	if err != nil {
		return err
	}

	if c.AuthToken != "" && samehost(c.BaseURL, redirectURL) {
		// Only include credentials if redirected to same host as base URL
	// Use redirect URL to download artifact
	return c.multipartDownload(ctx, redirectURL.String(), creds, dst, img.Size, spec, pb)
}

// samehost returns true if host1 and host2 are, in fact, the same host by
// comparing scheme (https == https) and host, including port.
//
// Hosts will be treated as dissimilar if one host includes domain suffix
// and the other does not, even if the host names match.
func samehost(host1, host2 *url.URL) bool {
	return strings.EqualFold(host1.Scheme, host2.Scheme) && strings.EqualFold(host1.Host, host2.Host)
CVE-2015-6563 (C, published 2015-08-24T01:59Z)
Description: value: The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openssh/openssh-portable
Files changed:
monitor.c
monitor_wrap.c
Commit message: Don't resend username to PAM; it already has it.

Pointed out by Moritz Jodeit; ok dtucker@


Vulnerable code:

	authctxt->user = buffer_get_string(m, NULL);
	buffer_put_cstring(&m, authctxt->user);

Fixed code:
CVE-2015-6564 (C, published 2015-08-24T01:59Z)
Description: value: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/openssh/openssh-portable
Files changed:
monitor.c
Commit message: set sshpam_ctxt to NULL after free

Avoids use-after-free in monitor when privsep child is compromised.
Reported by Moritz Jodeit; ok dtucker@


Vulnerable code:
	return (sshpam_authok == sshpam_ctxt);

Fixed code:
	int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt;
	sshpam_ctxt = sshpam_authok = NULL;
	return r;
CVE-2016-6515 (C, published 2016-08-07T21:59Z)
Description: value: The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openssh/openssh-portable
Files changed:
auth-passwd.c
Commit message: upstream commit

Skip passwords longer than 1k in length so clients can't
easily DoS sshd by sending very long passwords, causing it to spend CPU
hashing them. feedback djm@, ok markus@.

Brought to our attention by tomas.kuthan at oracle.com, shilei-c at
360.cn and coredump at autistici.org

Upstream-ID: d0af7d4a2190b63ba1d38eec502bc4be0be9e333


Vulnerable code:
/* $OpenBSD: auth-passwd.c,v 1.44 2014/07/15 15:54:14 millert Exp $ */

Fixed code:
/* $OpenBSD: auth-passwd.c,v 1.45 2016/07/21 01:39:35 dtucker Exp $ */
#define MAX_PASSWORD_LEN	1024

	if (strlen(password) > MAX_PASSWORD_LEN)
		return 0;
CVE-2016-8858 (C, published 2016-12-09T11:59Z)
Description: value: The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests.  NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/openssh/openssh-portable
Files changed:
kex.c
Commit message: upstream commit

Unregister the KEXINIT handler after message has been
received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause
allocation of up to 128MB -- until the connection is closed. Reported by
shilei-c at 360.cn

Upstream-ID: 43649ae12a27ef94290db16d1a98294588b75c05


Vulnerable code:
/* $OpenBSD: kex.c,v 1.126 2016/09/28 21:44:52 djm Exp $ */

Fixed code:
/* $OpenBSD: kex.c,v 1.127 2016/10/10 19:28:48 markus Exp $ */
	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
CVE-2018-20685 (C, published 2019-01-10T21:29Z)
Description: value: In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
Severity: LOW (CVSS v3 base score: 5.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/openssh/openssh-portable
Files changed:
scp.c
Commit message: upstream: disallow empty incoming filename or ones that refer to the

current directory; based on report/patch from Harry Sintonen

OpenBSD-Commit-ID: f27651b30eaee2df49540ab68d030865c04f6de9


Vulnerable code:
/* $OpenBSD: scp.c,v 1.197 2018/06/01 04:31:48 dtucker Exp $ */
		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {

Fixed code:
/* $OpenBSD: scp.c,v 1.198 2018/11/16 03:03:10 djm Exp $ */
		if (*cp == '\0' || strchr(cp, '/') != NULL ||
		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
CVE-2020-12062 (C, published 2020-06-01T16:15Z)
Description: value: The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openssh/openssh-portable
Files changed:
scp.c
Commit message: upstream: another case where a utimes() failure could make scp send

a desynchronising error; reminded by Aymeric Vincent ok deraadt markus

OpenBSD-Commit-ID: 2ea611d34d8ff6d703a7a8bf858aa5dbfbfa7381


Vulnerable code:
/* $OpenBSD: scp.c,v 1.209 2020/05/01 06:31:42 djm Exp $ */
				if (utimes(vect[0], tv) == -1)
					run_err("%s: set times: %s",
					    vect[0], strerror(errno));

Fixed code:
/* $OpenBSD: scp.c,v 1.210 2020/05/06 20:57:38 djm Exp $ */
				(void) utimes(vect[0], tv);
CVE-2021-28041 (C, published 2021-03-05T21:15Z)
Description: value: ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/openssh/openssh-portable
Files changed:
ssh-agent.c
Commit message: upstream: factor SSH_AGENT_CONSTRAIN_EXTENSION parsing into its own

function and remove an unused variable; ok dtucker@

OpenBSD-Commit-ID: e1a938657fbf7ef0ba5e73b30365734a0cc96559


Vulnerable code:
/* $OpenBSD: ssh-agent.c,v 1.276 2021/02/02 22:35:14 djm Exp $ */
	char *ext_name = NULL;
	struct sshbuf *b = NULL;
			goto err;
				goto err;
				goto err;
				goto err;
				goto err;
				goto err;
				goto err;
				goto err;
			if ((r = sshbuf_get_cstring(m, &ext_name, NULL)) != 0) {
				error_fr(r, "parse constraint extension");
				goto err;
			}
			debug_f("constraint ext %s", ext_name);
			if (strcmp(ext_name, "sk-provider@openssh.com") == 0) {
				if (sk_providerp == NULL) {
					error_f("%s not valid here", ext_name);
					goto err;
				}
				if (*sk_providerp != NULL) {
					error_f("%s already set", ext_name);
					goto err;
				}
				if ((r = sshbuf_get_cstring(m,
				    sk_providerp, NULL)) != 0) {
					error_fr(r, "parse %s", ext_name);
					goto err;
				}
			} else {
				error_f("unsupported constraint \"%s\"",
				    ext_name);
				goto err;
			}
			free(ext_name);
 err:
			free(ext_name);
			sshbuf_free(b);
			return -1;
	return 0;

Fixed code:
/* $OpenBSD: ssh-agent.c,v 1.277 2021/02/12 03:14:18 djm Exp $ */
static int
parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp)
{
	char *ext_name = NULL;
	int r;

	if ((r = sshbuf_get_cstring(m, &ext_name, NULL)) != 0) {
		error_fr(r, "parse constraint extension");
		goto out;
	}
	debug_f("constraint ext %s", ext_name);
	if (strcmp(ext_name, "sk-provider@openssh.com") == 0) {
		if (sk_providerp == NULL) {
			error_f("%s not valid here", ext_name);
			r = SSH_ERR_INVALID_FORMAT;
			goto out;
		}
		if (*sk_providerp != NULL) {
			error_f("%s already set", ext_name);
			r = SSH_ERR_INVALID_FORMAT;
			goto out;
		}
		if ((r = sshbuf_get_cstring(m, sk_providerp, NULL)) != 0) {
			error_fr(r, "parse %s", ext_name);
			goto out;
		}
	} else {
		error_f("unsupported constraint \"%s\"", ext_name);
		r = SSH_ERR_FEATURE_UNSUPPORTED;
		goto out;
	}
	/* success */
	r = 0;
 out:
	free(ext_name);
	return r;
}

			goto out;
				r = SSH_ERR_INVALID_FORMAT;
				goto out;
				goto out;
				r = SSH_ERR_INVALID_FORMAT;
				goto out;
				r = SSH_ERR_INVALID_FORMAT;
				goto out;
				r = SSH_ERR_INVALID_FORMAT;
				goto out;
				goto out;
				goto out;
			if ((r = parse_key_constraint_extension(m,
			    sk_providerp)) != 0)
				goto out; /* error already logged */
			r = SSH_ERR_FEATURE_UNSUPPORTED;
			goto out;
	r = 0;
 out:
	return r;
CVE-2023-25136 (C, published 2023-02-03T06:15Z)
Description: value: OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/openssh/openssh-portable
Files changed:
compat.c
Commit message: upstream: Always return allocated strings from the kex filtering so

that we can free them later.  Fix one leak in compat_kex_proposal.  Based on
github PR#324 from ZoltanFridrich with some simplications by me. ok djm@

OpenBSD-Commit-ID: 9171616da3307612d0ede086fd511142f91246e4


Vulnerable code:
/* $OpenBSD: compat.c,v 1.119 2021/09/10 05:46:09 djm Exp $ */
		return cipher_prop;
		return pkalg_prop;
		return p;

Fixed code:
/* $OpenBSD: compat.c,v 1.120 2022/07/01 03:35:45 dtucker Exp $ */
/* Always returns pointer to allocated memory, caller must free. */
		return xstrdup(cipher_prop);
/* Always returns pointer to allocated memory, caller must free. */
		return xstrdup(pkalg_prop);
/* Always returns pointer to allocated memory, caller must free. */
	char *cp = NULL;

		return xstrdup(p);
		cp = p;
		free(cp);
CVE-2023-51385 (C, published 2023-12-18T19:15Z)
Description: value: In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/openssh/openssh-portable
Files changed:
ssh.c
Commit message: upstream: ban user/hostnames with most shell metacharacters

This makes ssh(1) refuse user or host names provided on the
commandline that contain most shell metacharacters.

Some programs that invoke ssh(1) using untrusted data do not filter
metacharacters in arguments they supply. This could create
interactions with user-specified ProxyCommand and other directives
that allow shell injection attacks to occur.

It's a mistake to invoke ssh(1) with arbitrary untrusted arguments,
but getting this stuff right can be tricky, so this should prevent
most obvious ways of creating risky situations. It however is not
and cannot be perfect: ssh(1) has no practical way of interpreting
what shell quoting rules are in use and how they interact with the
user's specified ProxyCommand.

To allow configurations that use strange user or hostnames to
continue to work, this strictness is applied only to names coming
from the commandline. Names specified using User or Hostname
directives in ssh_config(5) are not affected.

feedback/ok millert@ markus@ dtucker@ deraadt@

OpenBSD-Commit-ID: 3b487348b5964f3e77b6b4d3da4c3b439e94b2d9


Vulnerable code:
/* $OpenBSD: ssh.c,v 1.598 2023/10/12 02:48:43 djm Exp $ */

Fixed code:
/* $OpenBSD: ssh.c,v 1.599 2023/12/18 14:47:44 djm Exp $ */
static int
valid_hostname(const char *s)
{
	size_t i;

	if (*s == '-')
		return 0;
	for (i = 0; s[i] != 0; i++) {
		if (strchr("'`\"$\\;&<>|(){}", s[i]) != NULL ||
		    isspace((u_char)s[i]) || iscntrl((u_char)s[i]))
			return 0;
	}
	return 1;
}

static int
valid_ruser(const char *s)
{
	size_t i;

	if (*s == '-')
		return 0;
	for (i = 0; s[i] != 0; i++) {
		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
			return 0;
		/* Disallow '-' after whitespace */
		if (isspace((u_char)s[i]) && s[i + 1] == '-')
			return 0;
		/* Disallow \ in last position */
		if (s[i] == '\\' && s[i + 1] == '\0')
			return 0;
	}
	return 1;
}

	if (!valid_hostname(host))
		fatal("hostname contains invalid characters");
	if (options.user != NULL && !valid_ruser(options.user))
		fatal("remote username contains invalid characters");
CVE-2023-2848 (PHP, published 2023-09-14T12:15Z)
Description: value: Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/movim/movim
Files changed:
src/Movim/Daemon/Core.php
Commit message: Compare the Origin as a fallback of the Sec-Fetch-Site header is not present


Vulnerable code:
            || (is_array($secFetchSiteHeader) && !empty($secFetchSiteHeader) && $secFetchSiteHeader[0] == 'same-origin');

Fixed code:
        $sameOrigin = (is_array($secFetchSiteHeader) && !empty($secFetchSiteHeader))
            ? $secFetchSiteHeader[0] == 'same-origin'
            : parse_url($conn->httpRequest->getHeader('Origin')[0], PHP_URL_HOST) == parse_url($this->baseuri, PHP_URL_HOST);

            || $sameOrigin;
CVE-2023-5835 (PHP, published 2023-10-28T14:15Z)
Description: value: A vulnerability classified as problematic was found in hu60t hu60wap6. Affected by this vulnerability is the function markdown of the file src/class/ubbparser.php. The manipulation leads to cross site scripting. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named a1cd9f12d7687243bfcb7ce295665acb83b9174e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-243775.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hu60t/hu60wap6
Files changed:
src/class/ubbparser.php
Commit message: UBB解析：修复4个空格或一个tab开头的markdown代码块解析时的XSS漏洞

案例：

<div class="topic-actions" data-v-38b8ba66="">
  <!-- 打赏按钮 -->
  <form method="POST" action="reward.php" data-v-38b8ba66="">
    <input type="hidden" name="post\_id" value="<?php echo $postId; ?>" data-v-38b8ba66="">
    <input type="number" name="reward\_points" placeholder="请输入打赏积分数量" data-v-38b8ba66="">
    <button type="submit" data-v-38b8ba66="">打赏</button>
  </form>
</div>

旧版会让<input>直接以HTML显示出来，因为ubbparser认为它是代码块所以没有进行HTML转义，而Parsedown不认为它是代码块，因为<input>前面没有空行隔开。


Vulnerable code:
            '!^(^|.*?\n+)((?:\t|    )[^\n]*(?:\n+(?:\t|    )[^\n]*)*)(\n+.*|$)$!is' => array(array(1, 3), 'mdpre', array(2)),

Fixed code:
            // 注意如果代码块前面有任何内容，就必须至少有一个空行隔开，否则Parsedown不认为它是代码块
            '!^(^(?:\s*\n)*|.*?(?:\s*\n){2,})((?:\t|    )[^\n]*(?:\n+(?:\t|    )[^\n]*)*)(\n+.*|$)$!is' => array(array(1, 3), 'mdpre', array(2)),
CVE-2021-23346 (JavaScript, published 2021-03-04T17:15Z)
Description: value: This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/HenrikJoreteg/html-parse-stringify
Files changed:
README.md
src/parse.js
test/parse.js
Commit message: fixing reported ReDoS


Vulnerable code:
const tagRE = /<[a-zA-Z\-\!\/](?:"[^"]*"['"]*|'[^']*'['"]*|[^'">])*>/g

Fixed code:
- `2.0.1` Addressing a reported regular expression denial of service issue reported by [Sam Sanoop](https://twitter.com/snoopysecurity) of [Snyk](https://snyk.io/) THANK YOU!. The issue was that sending certain input would cause one of the regular expressions we used to lock up and not finish, freezing the process. See the test that was added for details. To be clear, this lib wasn't meant for parsing non-well formed HTML. But, better safe than sorry! So we're fixing it.
const tagRE = /<[a-zA-Z\-\!\/](?:"[^"]*"|'[^']*'|[^'">])*>/g

test('ReDoS vulnerability reported by Sam Sanoop of Snyk', function (t) {
  const start = Date.now()
  // reported problematic string
  HTML.parse(
    "<!''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''!"
  )
  // other variant
  HTML.parse(
    '<!""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""!'
  )
  const duration = Date.now() - start

  t.ok(duration < 100, 'should not hang')
  t.end()
})
CVE-2024-28823 (HTML, published 2024-03-11T05:15Z)
Description: value: Amazon AWS aws-js-s3-explorer (aka AWS JavaScript S3 Explorer) 1.0.0 allows XSS via a crafted S3 bucket name to index.html.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/awslabs/aws-js-s3-explorer
Files changed:
index.html
Commit message: Fixes #118

Escape the text input from bootbox prompt.

Related: [bootbox/issues/661](https://github.com/bootboxjs/bootbox/issues/661)

Vulnerable code:
                    Bucket: result,

Fixed code:
                    Bucket: htmlEscape(result),