hitoshura25/cvefixes huggingface dataset:
CVE-2022-0631 (C, published 2022-02-18T14:15Z)
Description: value: Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c: packed arguments length may be zero for `send` method.


Vulnerable code:

Fixed code:
  argnum_error:
    if (RARRAY_LEN(regs[0]) == 0) goto argnum_error;
CVE-2022-0632 (C, published 2022-02-19T14:15Z)
Description: value: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: adjust stack position for `OP_SUPER` instruction.


Vulnerable code:
        else if (!s2) {/* super at top-level */
          push();      /* no need to push block */
        }
          gen_blkmove(s, s2->ainfo, lv);
        st++;
        if (!s2) push();
        else gen_blkmove(s, s2->ainfo, lv);
        st++;

Fixed code:
        else if (s2) gen_blkmove(s, s2->ainfo, lv);
          genop_1(s, OP_LOADNIL, cursp());
          push();
        if (s2) gen_blkmove(s, s2->ainfo, lv);
        else {
          genop_1(s, OP_LOADNIL, cursp());
          push();
        }
      st++;
      if (val) push();
CVE-2022-0717 (C, published 2022-02-23T02:15Z)
Description: value: Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: fix a argument generation bug in array assignment.


Vulnerable code:
      if (n < 14) {

Fixed code:
      if (n < 15) {
        if (n == 15) {
          pop_n(14);
          genop_2(s, OP_ARRAY, cursp(), 15);
        }
CVE-2022-0890 (C, published 2022-03-10T01:15Z)
Description: value: NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
Severity: HIGH (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-fiber/src/fiber.c
Commit message: fiber.c: should pack 15+ arguments in an array.


Vulnerable code:
    mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
    b = c->stbase+1;
    e = b + len;
    while (b<e) {
      *b++ = *a++;
    }

Fixed code:
    if (len >= 15) {
      mrb_stack_extend(mrb, 3);   /* for receiver, args and (optional) block */
      c->stbase[1] = mrb_ary_new_from_values(mrb, len, a);
      len = 15;
    }
    else {
      mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
      b = c->stbase+1;
      e = b + len;
      while (b<e) {
        *b++ = *a++;
      }
    }
CVE-2022-1071 (C, published 2022-03-26T04:15Z)
Description: value: User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c: stack may be reallocated in functions calls.

Probably due to recursive VM calls via `mrb_funcall()`.


Vulnerable code:
        regs[a] = mrb_hash_get(mrb, va, vb);
          regs[a] = mrb_str_aref(mrb, va, vb, mrb_undef_value());
      regs[a] = mrb_vm_const_get(mrb, syms[b]);
      regs[a] = mrb_const_get(mrb, regs[a], syms[b]);
      mrb_value kdict;
      regs[a] = mrb_hash_get(mrb, kdict, k);

Fixed code:
        va = mrb_hash_get(mrb, va, vb);
        regs[a] = va;
          va = mrb_str_aref(mrb, va, vb, mrb_undef_value());
          regs[a] = va;
      mrb_value v = mrb_vm_const_get(mrb, syms[b]);
      regs[a] = v;
      mrb_value v = mrb_const_get(mrb, regs[a], syms[b]);
      regs[a] = v;
      mrb_value kdict, v;
      v = mrb_hash_get(mrb, kdict, k);
      regs[a] = v;
CVE-2022-1106 (C, published 2022-03-27T14:15Z)
Description: value: use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c: vm.c: stack may be reallocated in functions calls; aaa28a5

`mrb_range_new()` also calls VM recursively.


Vulnerable code:
      regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);
      regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);

Fixed code:
      mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);
      regs[a] = v;
      mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);
      regs[a] = v;
CVE-2022-1201 (C, published 2022-04-02T08:15Z)
Description: value: NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c: target class may be NULL.


Vulnerable code:
        if (target_class->tt != MRB_TT_ICLASS) {

Fixed code:
        if (!target_class || target_class->tt != MRB_TT_ICLASS) {
CVE-2022-1212 (C, published 2022-04-05T04:15Z)
Description: value: Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c: create break object before clearing GC arena.

Otherwise it possibly cause use-after-free.


Vulnerable code:
            mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);

Fixed code:
            mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);
CVE-2022-1276 (C, published 2022-04-10T10:15Z)
Description: value: Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: need to pack argument when `n==13` too.

Because we have extra 2 arguments coming (kw and rhs).


Vulnerable code:
          if (n == 14) {

Fixed code:
          if (n == 13 || n == 14) {
CVE-2022-1286 (C, published 2022-04-10T11:15Z)
Description: value: heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mruby/mruby
Files changed:
src/class.c
Commit message: class.c: clear method cache after `remove_method`.


Vulnerable code:
  if (h && mt_del(mrb, h, mid)) return;

Fixed code:
  if (h && mt_del(mrb, h, mid)) {
    mrb_mc_clear_by_class(mrb, c);
    return;
  }
CVE-2022-1427 (C, published 2022-04-23T00:15Z)
Description: value: Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c: check if target_class is NULL (when prepended).


Vulnerable code:
      if (target_class->flags & MRB_FL_CLASS_IS_PREPENDED) {
        target_class = mrb_vm_ci_target_class(ci);
      }
      else if (target_class->tt == MRB_TT_MODULE) {

Fixed code:
      if ((target_class->flags & MRB_FL_CLASS_IS_PREPENDED) || target_class->tt == MRB_TT_MODULE) {
CVE-2022-1934 (C, published 2022-05-31T03:15Z)
Description: value: Use After Free in GitHub repository mruby/mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c (hash_new_from_regs): stack may be reallocated.


Vulnerable code:
hash_new_from_values(mrb_state *mrb, mrb_int argc, mrb_value *regs)
    mrb_hash_set(mrb, hash, regs[0], regs[1]);
    regs += 2;
#define ARGUMENT_NORMALIZE(arg_base, arg_info, insn) do { \
    mrb_value kdict = hash_new_from_values(mrb, nk, regs+kidx); \
#define regs (mrb->c->ci->stack)

Fixed code:
#define regs (mrb->c->ci->stack)

hash_new_from_regs(mrb_state *mrb, mrb_int argc, mrb_int idx)
    mrb_hash_set(mrb, hash, regs[idx+0], regs[idx+1]);
    idx += 2;
#define ARGUMENT_NORMALIZE(arg_base, arg_info, insn) do {       \
    mrb_value kdict = hash_new_from_regs(mrb, nk, kidx); \
CVE-2018-6354 (HTML, published 2018-01-27T15:29Z)
Description: value: templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/formspree/formspree
Files changed:
formspree/templates/forms/thanks.html
Commit message: Remove XSS opportunity


Vulnerable code:
        {% if request.args.get('next') %}
          <a href="{{ request.args.get('next') }}" class="button" style="margin-top: 1em;">Return to original site</a>
        {% endif %}

Fixed code:
CVE-2021-3649 (JavaScript, published 2021-07-16T14:15Z)
Description: value: chatwoot is vulnerable to Inefficient Regular Expression Complexity
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/chatwoot/chatwoot
Files changed:
app/javascript/dashboard/components/widgets/conversation/Message.vue
app/javascript/shared/mixins/messageFormatterMixin.js
app/javascript/shared/mixins/specs/messageFormatterMixin.spec.js
Commit message: fix: Use Dompurify to strip style characters (#2632)



Vulnerable code:
import { stripStyleCharacters } from './helpers/EmailContentParser';
        const parsedContent = stripStyleCharacters(contentToBeParsed);
export const stripStyleCharacters = emailContent => {
  let contentToBeParsed = emailContent.replace(/<style(.|\s)*?<\/style>/g, '');
  contentToBeParsed = contentToBeParsed.replace(/style="(.*?)"/g, '');
  let parsedContent = new DOMParser().parseFromString(
    contentToBeParsed,
    'text/html'
  );
  if (!parsedContent.getElementsByTagName('parsererror').length) {
    return parsedContent.body.innerHTML;
  }
  return '';
};
import { stripStyleCharacters } from '../EmailContentParser';

describe('#stripStyleCharacters', () => {
  it('remove style characters', () => {
    expect(
      stripStyleCharacters(
        `<html><body><style type="text/css"> \n<!-- \nimg \n	{max-width:100%} \ndiv \n	{width:100%!important; \n	height:100%; \n	line-height:1.6em} \ndiv \n	{background-color:#f6f6f6} \n--> \n</style>\n<div itemscope="" itemtype="http://schema.org/EmailMessage" style="font-family:'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing:border-box; font-size:14px; width:100%!important; height:100%; line-height:1.6em; background-color:#f6f6f6; margin:0; background-color:#f6f6f6">Test Content</div>\n</body></html>`
      )
    ).toEqual(
      '\n<div itemscope="" itemtype="http://schema.org/EmailMessage">Test Content</div>\n'
    );
  });
});

Fixed code:
        const parsedContent = this.stripStyleCharacters(contentToBeParsed);
import DOMPurify from 'dompurify';
    stripStyleCharacters(message) {
      return DOMPurify.sanitize(message, {
        FORBID_TAGS: ['style'],
        FORBID_ATTR: [
          'id',
          'class',
          'style',
          'bgcolor',
          'valign',
          'width',
          'face',
          'color',
          'height',
          'lang',
          'align',
          'size',
        ],
      });
    },

  it('stripStyleCharacters returns message without style tags', () => {
    const Component = {
      render() {},
      mixins: [messageFormatterMixin],
    };
    const wrapper = shallowMount(Component);
    const message =
      '<b style="max-width:100%">Chatwoot is an opensource tool. https://www.chatwoot.com</b><style type="css">.message{}</style>';
    expect(wrapper.vm.stripStyleCharacters(message)).toMatch(
      '<b>Chatwoot is an opensource tool. https://www.chatwoot.com</b>'
    );
  });
CVE-2021-3813 (Ruby, published 2022-02-09T15:15Z)
Description: value: Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/chatwoot/chatwoot
Files changed:
app/finders/conversation_finder.rb
spec/finders/conversation_finder_spec.rb
Commit message: Fix: Conversation filter permissions (#3908)

fixes: chatwoot/product#225

Vulnerable code:
                   current_account.inboxes.where(id: params[:inbox_id])

Fixed code:
                   @current_user.assigned_inboxes.where(id: params[:inbox_id])
  let!(:admin) { create(:user, account: account, role: :administrator) }
  let!(:restricted_inbox) { create(:inbox, account: account) }
    context 'with inbox' do
      let!(:restricted_conversation) { create(:conversation, account: account, inbox_id: restricted_inbox.id) }

      it 'returns conversation from any inbox if its admin' do
        params = { inbox_id: restricted_inbox.id }
        result = described_class.new(admin, params).perform

        expect(result[:conversations].map(&:id)).to include(restricted_conversation.id)
      end

      it 'returns conversation from inbox if agent is its member' do
        params = { inbox_id: restricted_inbox.id }
        create(:inbox_member, user: user_1, inbox: restricted_inbox)
        result = described_class.new(user_1, params).perform

        expect(result[:conversations].map(&:id)).to include(restricted_conversation.id)
      end

      it 'does not return conversations from inboxes where agent is not a member' do
        params = { inbox_id: restricted_inbox.id }
        result = described_class.new(user_1, params).perform

        expect(result[:conversations].map(&:id)).not_to include(restricted_conversation.id)
      end
    end
CVE-2022-0526 (JavaScript, published 2022-02-09T05:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/chatwoot/chatwoot
Files changed:
app/javascript/dashboard/components/CustomAttribute.vue
app/javascript/dashboard/helper/URLHelper.js
app/javascript/dashboard/helper/specs/URLHelper.spec.js
app/javascript/dashboard/mixins/attributeMixin.js
app/javascript/dashboard/mixins/specs/attributeMixin.spec.js
Commit message: fix: Render valid urls only in custom attributes (#3921)



Vulnerable code:
          {{ value || '---' }}


    isAttributeLink(attributeValue) {
      /* eslint-disable no-useless-escape */
      const URL_REGEX = /^https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)$/gm;
      return URL_REGEX.test(attributeValue);
    },
      if (this.isAttributeLink(attributeValue)) {
  it('return true if link is passed', () => {
    const Component = {
      render() {},
      title: 'TestComponent',
      mixins: [attributeMixin],
    };
    const wrapper = shallowMount(Component, { store, localVue });
    expect(wrapper.vm.isAttributeLink('https://www.chatwoot.com/pricing')).toBe(
      true
    );
  });


Fixed code:
          {{ urlValue }}
import { isValidURL } from '../helper/URLHelper';
    urlValue() {
      return isValidURL(this.value) ? this.value : '---';
    },

export const isValidURL = value => {
  /* eslint-disable no-useless-escape */
  const URL_REGEX = /^https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)$/gm;
  return URL_REGEX.test(value);
};
  isValidURL,

  describe('isValidURL', () => {
    it('should return true if valid url is passed', () => {
      expect(isValidURL('https://chatwoot.com')).toBe(true);
    });
    it('should return false if invalid url is passed', () => {
      expect(isValidURL('alert.window')).toBe(false);
    });
  });
import { isValidURL } from '../helper/URLHelper';
      if (isValidURL(attributeValue)) {
CVE-2022-0542 (JavaScript, published 2022-08-19T18:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/chatwoot/chatwoot
Files changed:
app/javascript/shared/helpers/MessageFormatter.js
app/javascript/shared/helpers/specs/MessageFormatter.spec.js
Commit message: fix: Handle unsanitized markup in DOM (#4110)



Vulnerable code:
    return marked(this.message, { breaks: true, gfm: true });
        '<p>Chatwoot is an opensource tool. <a rel="noreferrer noopener nofollow" href="https://www.chatwoot.com" class="link" title="" target="_blank">Chatwoot</a></p>'
        '<p>Chatwoot is an opensource tool. <a rel="noreferrer noopener nofollow" href="https://www.chatwoot.com" class="link" title="" target="_blank">https://www.chatwoot.com</a></p>'

Fixed code:
    DOMPurify.addHook('afterSanitizeAttributes', node => {
      if ('target' in node) node.setAttribute('target', '_blank');
    });
    return DOMPurify.sanitize(
      marked(this.message, { breaks: true, gfm: true })
    );
        '<p>Chatwoot is an opensource tool. <a title="" class="link" href="https://www.chatwoot.com" rel="noreferrer noopener nofollow" target="_blank">Chatwoot</a></p>'
        '<p>Chatwoot is an opensource tool. <a title="" class="link" href="https://www.chatwoot.com" rel="noreferrer noopener nofollow" target="_blank">https://www.chatwoot.com</a></p>'

  describe('#sanitize', () => {
    it('sanitizes markup and removes all unnecessary elements', () => {
      const message =
        '[xssLink](javascript:alert(document.cookie))\n[normalLink](https://google.com)**I am a bold text paragraph**';
      expect(new MessageFormatter(message).formattedMessage).toMatch(
        '<p><a title="" class="link" rel="noreferrer noopener nofollow" target="_blank">xssLink</a><br><a title="" class="link" href="https://google.com" rel="noreferrer noopener nofollow" target="_blank">normalLink</a><strong>I am a bold text paragraph</strong></p>'
      );
    });
  });