hitoshura25/cvefixes huggingface dataset:
CVE-2015-10023 (Go, published 2023-01-07T12:15Z)
Description: value: A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Fumon/trello-octometric
Files changed:
metrics-ui/server/srv.go
Commit message: Fixed sql injection


Vulnerable code:
		query := fmt.Sprintf(`SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, end_of_day_total from trello.dailytallies order by day DESC limit %s) r;`, vars["num"])
		err := db.QueryRow(query).Scan(&output)
		query := fmt.Sprintf(`SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, up_count, down_count, finished_count from trello.dailytallies order by day DESC limit %s) r;`, vars["num"])
		err := db.QueryRow(query).Scan(&output)

Fixed code:
		query := `SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, end_of_day_total from trello.dailytallies order by day DESC limit $1) r;`
		err := db.QueryRow(query, vars["num"]).Scan(&output)
		query := `SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, up_count, down_count, finished_count from trello.dailytallies order by day DESC limit $1) r;`
		err := db.QueryRow(query, vars["num"]).Scan(&output)
CVE-2022-0692 (PHP, published 2022-02-21T13:15Z)
Description: value: Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/rudloff/alltube
Files changed:
classes/Factory/ViewFactory.php
index.php
templates/inc/logo.tpl
Commit message: Don't redirect to REQUEST_URI when browsing to index.php
Instead, we can make sure everything works correctly on index.php


Vulnerable code:
if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], '/index.php') !== false) {
    header('Location: ' . str_ireplace('/index.php', '/', $_SERVER['REQUEST_URI']));
    die;
}

    <a class="logocompatible" href="{base_url}">

Fixed code:
    /**
     * @param Uri $uri
     * @return Uri
     */
    private static function cleanBasePath(Uri $uri): Uri
    {
        $basePath = $uri->getBasePath();
        if (str_ends_with($basePath, 'index.php')) {
            /*
             * When the base path ends with index.php,
             * routing works correctly, but it breaks the URL of static assets using {base_url}.
             * So we alter the base path but only in the URI used by SmartyPlugins.
             */
            $uri = $uri->withBasePath(dirname($basePath));
        }

        return $uri;
    }

        $uri = self::cleanBasePath($uri);

    <a class="logocompatible" href="{path_for name="index"}">
CVE-2022-0768 (Unknown, published 2022-02-28T10:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/rudloff/alltube
Files changed:
Commit message: Merge branch 'hotfix/3.0.2'


Vulnerable code:

Fixed code:
CVE-2020-29171 (PHP, published 2021-02-10T15:15Z)
Description: value: Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Arsenal21/all-in-one-wordpress-security
Files changed:
all-in-one-wp-security/admin/wp-security-blacklist-menu.php
all-in-one-wp-security/readme.txt
all-in-one-wp-security/wp-security-core.php
all-in-one-wp-security/wp-security.php
Commit message: v4.4.6 released

Vulnerable code:
    
    
    function __construct() 
    
    function set_menu_tabs() 
    
    function get_current_tab() 
    function render_menu_tabs() 
        foreach ( $this->menu_tabs as $tab_key => $tab_caption ) 
            echo '<a class="nav-tab ' . $active . '" href="?page=' . $this->menu_page_slug . '&tab=' . $tab_key . '">' . $tab_caption . '</a>';	
    
    function render_menu_page() 
        ?>        
        <?php 
    
    function render_tab1() 
            
                    
                
                    
                    
        ?>    
        </div>            
            </tr>            
                            <?php 
                    <textarea name="aiowps_banned_user_agents" rows="5" cols="50"><?php echo ($result == -1)?$_POST['aiowps_banned_user_agents']:$aio_wp_security->configs->get_value('aiowps_banned_user_agents'); ?></textarea>
                            <?php 
    
	if (!empty($submitted_agents)) 
        
        
Stable tag: 4.4.5
    var $version = '4.4.5';
Version: 4.4.5

Fixed code:


    function __construct()

    function set_menu_tabs()

    function get_current_tab()
    function render_menu_tabs()
        foreach ( $this->menu_tabs as $tab_key => $tab_caption )
            echo '<a class="nav-tab ' . $active . '" href="?page=' . $this->menu_page_slug . '&tab=' . $tab_key . '">' . $tab_caption . '</a>';

    function render_menu_page()
        ?>
        <?php

    function render_tab1()





        ?>
        </div>
            </tr>
                            <?php
                    <textarea name="aiowps_banned_user_agents" rows="5" cols="50"><?php echo ($result == -1)?htmlspecialchars($_POST['aiowps_banned_user_agents']):htmlspecialchars($aio_wp_security->configs->get_value('aiowps_banned_user_agents')); ?></textarea>
                            <?php

	if (!empty($submitted_agents))


Stable tag: 4.4.6
= 4.4.6 =
- Fixed potential vulnerability with the Banned User Agents feature (in the blacklist menu).

    var $version = '4.4.6';
Version: 4.4.6
CVE-2022-4513 (Java, published 2022-12-15T20:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in European Environment Agency eionet.contreg. This issue affects some unknown processing. The manipulation of the argument searchTag/resourceUri leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2022-06-27T0948 is able to address this issue. The name of the patch is a120c2153e263e62c4db34a06ab96a9f1c6bccb6. It is recommended to upgrade the affected component. The identifier VDB-215885 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/eea/eionet.contreg
Files changed:
pom.xml
src/main/java/eionet/cr/web/action/TagSearchActionBean.java
src/main/java/eionet/cr/web/action/factsheet/FactsheetActionBean.java
Commit message: - Security upgrades for xss prevention


Vulnerable code:
        this.searchTag = searchTag;
        this.uri = resourceUri;

Fixed code:
        <dependency>
            <groupId>com.samaxes.stripes</groupId>
            <artifactId>stripesafe</artifactId>
            <version>1.0.1</version>
        </dependency>

import org.apache.commons.lang.StringEscapeUtils;

        this.searchTag = StringEscapeUtils.escapeHtml(searchTag);

        this.uri = StringEscapeUtils.escapeHtml(resourceUri);;
CVE-2016-9964 (Python, published 2016-12-16T09:59Z)
Description: value: redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-93 \u2014 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Repository: https://github.com/bottlepy/bottle
Files changed:
bottle.py
test/test_environ.py
Commit message: fix #913: Harden bottle against malformed headers.

Bottle now checks against certain control characters (\n, \r and \0) in header names or values and raises a ValueError if the application tries to set an invalid header.


Vulnerable code:
def _hkey(s):
    return s.title().replace('_', '-')


        self.dict[_hkey(key)] = [value if isinstance(value, unicode) else
                                 str(value)]
        self.dict.setdefault(_hkey(key), []).append(
            value if isinstance(value, unicode) else str(value))
        self.dict[_hkey(key)] = [value if isinstance(value, unicode) else
                                 str(value)]
        for name in [_hkey(n) for n in names]:

Fixed code:
def _hkey(key):
    if '\n' in key or '\r' in key or '\0' in key:
        raise ValueError("Header names must not contain control characters: %r" % key)
    return key.title().replace('_', '-')

def _hval(value):
    value = value if isinstance(value, unicode) else str(value)
    if '\n' in value or '\r' in value or '\0' in value:
        raise ValueError("Header value must not contain control characters: %r" % value)
    return value
        self.dict[_hkey(key)] = [_hval(value)]
        self.dict.setdefault(_hkey(key), []).append(_hval(value))
        self.dict[_hkey(key)] = [_hval(value)]
        for name in (_hkey(n) for n in names):

import itertools

    def test_prevent_control_characters_in_headers(self):
        apis = 'append', 'replace', '__setitem__', 'setdefault'
        masks = '{}test', 'test{}', 'te{}st'
        tests = '\n', '\r', '\n\r', '\0'
        for api, mask, test in itertools.product(apis, masks, tests):
            hd = bottle.HeaderDict()
            func = getattr(hd, api)
            value = mask.replace("{}", test)
            self.assertRaises(ValueError, func, value, "test-value")
            self.assertRaises(ValueError, func, "test-name", value)
CVE-2021-23784 (JavaScript, published 2021-11-03T18:15Z)
Description: value: This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lukeed/tempura
Files changed:
docs/api.md
src/$index.js
src/index.d.ts
test/$index.js
Commit message: break: ensure `esc` always returns a string;

- prevents a XSS attack within an array


Vulnerable code:
Returns: `string` or `typeof value`
> **Note:** Any non-`string` values are returned as is.
	if (typeof value !== 'string') return value;
export function esc<T=unknown>(value: T): T|string;
esc('should echo non-string inputs', () => {
	// @ts-ignore
	assert.is(tempura.esc(), undefined);
	assert.is(tempura.esc(null), null);
	assert.is(tempura.esc(false), false);
	assert.is(tempura.esc(123), 123);
	assert.is(tempura.esc(0), 0);

	assert.equal(tempura.esc([1, 2, 3]), [1, 2, 3]);
	assert.equal(tempura.esc({ foo: 1 }), { foo: 1 });

Fixed code:
Returns: `string`
> **Note:** Any non-`string` values are coerced to a strings!
>  * `null` and `undefined` become `""`
>  * `{ foo: 123 }` becomes `"[object Object]"`
>  * `[1, 2, 3]` becomes `"1,2,3"`
>  * `123` becomes `"123"`
	value = (value == null) ? '' : '' + value;
export function esc(value: string|unknown): string;
esc('should convert non-string inputs to string', () => {
	assert.is(tempura.esc(), '');
	assert.is(tempura.esc(null), '');

	assert.is(tempura.esc(false), 'false');
	assert.is(tempura.esc(123), '123');
	assert.is(tempura.esc(0), '0');

	assert.equal(tempura.esc([1, 2, 3]), '1,2,3');
	assert.equal(tempura.esc({ foo: 1 }), '[object Object]');
});

esc('should prevent xss scripting in array', () => {
	let output = tempura.esc(['<img src=x onerror="alert(1)" />']);
	assert.is(output, '&ltimg src=x onerror=&quot;alert(1)&quot; />');
CVE-2022-4556 (Objective-C, published 2022-12-16T17:15Z)
Description: value: A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/Alinto/sogo
Files changed:
SoObjects/SOGo/SOGoUserDefaults.m
Commit message: fix(security): Security fix for WSTG-INPV-02. Add XSS protection on identity fullName. Fixes #5642.


Vulnerable code:
        [identity setObject: fullName forKey: @"fullName"];
  return [self arrayForKey: @"SOGoMailIdentities"];

Fixed code:
        [identity setObject: [fullName stringWithoutHTMLInjection: YES] forKey: @"fullName"];
  NSMutableArray *mailIdentities;
  NSMutableDictionary *mailIdentity;
  NSUInteger i;

  // Remove possible XSS injection
  mailIdentities = [NSMutableArray arrayWithArray: [self arrayForKey: @"SOGoMailIdentities"]];
  for (i = 0 ; i < [mailIdentities length] ; i++) {
    mailIdentity = [mailIdentities objectAtIndex: i];
    if ([mailIdentity objectForKey: @"fullName"]) {
      [mailIdentity setObject: [[mailIdentity objectForKey: @"fullName"] stringWithoutHTMLInjection: YES] forKey: @"fullName"];
      [mailIdentities setObject: mailIdentity atIndexedSubscript: i];
    }
  }

  return mailIdentities;
CVE-2023-48104 (Objective-C, published 2024-01-16T01:15Z)
Description: value: Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Alinto/sogo
Files changed:
SoObjects/SOGo/NSString+Utilities.m
Tests/Unit/TestNSString+Utilities.m
Commit message: fix(hmtl): prevent html injection of tag form


Vulnerable code:

Fixed code:
      // Remove <form
      regex = [NSRegularExpression regularExpressionWithPattern:@"<[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*f[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*o[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*r[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*m" 
                                  options: NSRegularExpressionCaseInsensitive error:&error];
      newResult = [regex stringByReplacingMatchesInString:result options:0 range:NSMakeRange(0, [result length]) withTemplate:@"<for*"];
      result = [NSString stringWithString: newResult];

      // Remove </form
      regex = [NSRegularExpression regularExpressionWithPattern:@"<[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*/[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*f[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*o[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*r[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*m" 
                                  options: NSRegularExpressionCaseInsensitive error:&error];
      newResult = [regex stringByReplacingMatchesInString:result options:0 range:NSMakeRange(0, [result length]) withTemplate:@"</for*"];
      result = [NSString stringWithString: newResult];

  testEquals([[NSString stringWithString:@"foobar <form action=\"\">bar</form>"] stringWithoutHTMLInjection: NO], @"foobar <for* action=\"\">bar</for*>");
CVE-2021-40540 (C, published 2021-09-07T02:15Z)
Description: value: ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/babelouest/ulfius
Files changed:
src/ulfius.c
Commit message: Fix bug when malformed HTTP requests are sent, thanks Jeremy Brown!


Vulnerable code:
    if (NULL == con_info->request || ulfius_init_request(con_info->request) != U_OK) {


Fixed code:
    memset(con_info, 0, sizeof(struct connection_info_struct));
    if (ulfius_init_request(con_info->request) != U_OK) {
      y_log_message(Y_LOG_LEVEL_ERROR, "Ulfius - Error initializing con_info->request");
CVE-2024-24558 (Other, published 2024-01-30T20:15Z)
Description: value: TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web.  The `@tanstack/react-query-next-experimental` NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. To fix this issue, please update to version 5.18.0 or later.

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/TanStack/query
Files changed:
packages/react-query-next-experimental/src/HydrationStreamProvider.tsx
packages/react-query-next-experimental/src/htmlescape.ts
Commit message: Merge pull request from GHSA-997g-27x8-43rf

Co-authored-by: Lenz Weber-Tronic <lorenz.weber-tronic@apollographql.com>

Vulnerable code:
    const idJSON = JSON.stringify(id)
        `window[${idJSON}].push(${serializedCacheArgs});`,

Fixed code:
import { htmlEscapeJsonString } from './htmlescape'
    const idJSON = htmlEscapeJsonString(JSON.stringify(id))
        `window[${idJSON}].push(${htmlEscapeJsonString(serializedCacheArgs)});`,
// --------------------------------------------------------------------------------
//
// copied from
// https://github.com/vercel/next.js/blob/6bc07792a4462a4bf921a72ab30dc4ab2c4e1bda/packages/next/src/server/htmlescape.ts
// License: https://github.com/vercel/next.js/blob/6bc07792a4462a4bf921a72ab30dc4ab2c4e1bda/packages/next/license.md
//
// --------------------------------------------------------------------------------

// This utility is based on https://github.com/zertosh/htmlescape
// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE

const ESCAPE_LOOKUP: { [match: string]: string } = {
  "&": "\\u0026",
  ">": "\\u003e",
  "<": "\\u003c",
  "\u2028": "\\u2028",
  "\u2029": "\\u2029",
};

export const ESCAPE_REGEX = /[&><\u2028\u2029]/g;

export function htmlEscapeJsonString(str: string): string {
  return str.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
}
CVE-2013-3300 (Scala, published 2013-07-29T13:59Z)
Description: value: The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/lift/framework
Files changed:
core/json/src/main/scala/net/liftweb/json/JsonParser.scala
core/json/src/test/scala/net/liftweb/json/JsonParserSpec.scala
Commit message: Addresses a data bleeding issue with lift-json


Vulnerable code:
    def near = new String(segment, (cur-20) max 0, (cur + 1) min Segments.segmentSize)

Fixed code:
    def near = {
      val start = (cur - 20) max 0
      val len = ((cur + 1) min Segments.segmentSize) - start
      new String(segment, start, len)
    }

  private def parseBadThing(): String =     try {
    parse("""{"user":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"<}""")
    "x" * 1000
  } catch {
    case e: Throwable => e.getMessage
  }



  "Parser does not bleed prior results" in {
    parse("""{"a": "now is the time for all good men to come to the aid of their dog and eat dog food with other dogs and bark and woof and do dog things. now is the time for all good men to come to the aid of their dog and eat dog food with other dogs and bark and woof and do dog things. now is the time for all good men to come to the aid of their dog and eat dog food with other dogs and bark and woof and do dog things. now is the time for all good men to come to the aid of their dog and eat dog food with other dogs and bark and woof and do dog things. now is the time for all good men to come to the aid of their dog and eat dog food with other dogs and bark and woof and do dog things. now is the time for all good men to come to the aid of their dog and eat dog food with other dogs and bark and woof and do dog things. now is the time for all good men to come to the aid of their dog and eat dog food with other dogs and bark and woof and do dog things.now is the time for all good men to come to the aid of their dog and eat dog food with other dogs and bark and woof and do dog things"}""")

    val msg = parseBadThing()

    msg.length must be_<=(50)
  }