hitoshura25/cvefixes huggingface dataset:
CVE-2022-1330 (Unknown, published 2022-04-12T21:15Z)
Description: value: stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss .
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/alvarotrigo/fullpage.js
Files changed:
Commit message: Merge pull request #4360 from ranjit-git/ranjit-git-patch-1

Ranjit git patch 1

Vulnerable code:

Fixed code:
CVE-2021-4269 (JavaScript, published 2022-12-21T19:15Z)
Description: value: A vulnerability has been found in SimpleRisk and classified as problematic. This vulnerability affects the function checkAndSetValidation of the file simplerisk/js/common.js. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 20220306-001 is able to address this issue. The name of the patch is 591405b4ed160fbefc1dca1e55c5745079a7bb48. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216472.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/simplerisk/code
Files changed:
simplerisk/js/common.js
Commit message: Potential XSS fix


Vulnerable code:
            var message = field_required_lang.replace("_XXX_", issue_el.attr("title"))

Fixed code:

            // We have to make sure that no html gets through to toastr as it's displaying what it gets 'as is';
            var escaped = $("<div/>").text(issue_el.attr("title")).html();
            var message = field_required_lang.replace("_XXX_", escaped);
CVE-2023-45811 (Unknown, published 2023-10-17T23:15Z)
Description: value: Synchrony deobfuscator is a javascript cleaner & deobfuscator.  A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `deobfuscator@2.4.4`. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags

Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/relative/synchrony
Files changed:
Commit message: Merge pull request from GHSA-jg82-xh3w-rhxx

Advisory fix 1

Vulnerable code:

Fixed code:
CVE-2021-21335 (C, published 2021-03-08T21:15Z)
Description: value: In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/stnoonan/spnego-http-auth-nginx-module
Files changed:
ngx_http_auth_spnego_module.c
Commit message: Check basic auth result against != NGX_OK rather than == NGX_DECLINED

This corrects the error handling case when ngx_http_auth_spnego_basic is called with a bad configuration or bad username. These cases return NGX_ERROR, which allowed basic auth to proceed.

Thanks to Prakapovich Pavel aka Flyguy.by for pointing this out.

Vulnerable code:
            if (NGX_DECLINED == ngx_http_auth_spnego_basic(r, ctx, alcf)) {

Fixed code:
            if (NGX_OK != ngx_http_auth_spnego_basic(r, ctx, alcf)) {
CVE-2017-16754 (PHP, published 2017-11-10T02:29Z)
Description: value: Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/bolt/bolt
Files changed:
src/EventListener/ProfilerListener.php
src/Provider/EventListenerServiceProvider.php
Commit message: Request listener to prevent access to profiler routes


Vulnerable code:

Fixed code:
<?php

namespace Bolt\EventListener;

use Bolt\AccessControl\Token\Token;
use Bolt\Request\ProfilerAwareTrait;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
use Symfony\Component\HttpKernel\KernelEvents;

/**
 * Symfony Profiler listener.
 *
 * @author Gawain Lynch <gawain.lynch@gmail.com>
 */
class ProfilerListener implements EventSubscriberInterface
{
    use ProfilerAwareTrait;

    /** @var SessionInterface */
    private $session;
    /** @var bool */
    private $debug;
    /** @var bool */
    private $debugLoggedOff;

    /**
     * Constructor.
     *
     * @param SessionInterface $session
     * @param bool             $debug
     * @param bool             $debugLoggedOff
     */
    public function __construct(SessionInterface $session, $debug, $debugLoggedOff)
    {
        $this->session = $session;
        $this->debug = $debug;
        $this->debugLoggedOff = $debugLoggedOff;
    }

    /**
     * Request listener to prevent access to profiler routes when debugging is
     * not enabled, or the user is logged off & debugging is not configured to
     * show when logged off.
     *
     * @param GetResponseEvent $event
     */
    public function onKernelRequest(GetResponseEvent $event)
    {
        $request = $event->getRequest();
        if (!$this->isProfilerRequest($request)) {
            return;
        }

        $token = $this->session->isStarted() ? $this->session->get('authentication') : null;
        if ($this->debug && ($token instanceof Token || $this->debugLoggedOff)) {
            return;
        }

        throw new NotFoundHttpException();
    }

    /**
     * {@inheritdoc}
     */
    public static function getSubscribedEvents()
    {
        return [
            KernelEvents::REQUEST => ['onKernelRequest'],
        ];
    }
}

        $app['listener.profile'] = $app->share(
            function ($app) {
                return new Listener\ProfilerListener(
                    $app['session'],
                    $app['debug'],
                    $app['config']->get('general/debug_show_loggedoff')
                );
            }
        );

        $dispatcher->addSubscriber($app['listener.profile']);
CVE-2020-4040 (Unknown, published 2020-06-08T22:15Z)
Description: value: Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/bolt/bolt
Files changed:
Commit message: Merge pull request #7853 from bolt/fix/csrf-check-on-preview

Check CSRF on Preview page

Vulnerable code:

Fixed code:
CVE-2020-4041 (Unknown, published 2020-06-08T22:15Z)
Description: value: In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bolt/bolt
Files changed:
Commit message: Merge pull request #7853 from bolt/fix/csrf-check-on-preview

Check CSRF on Preview page

Vulnerable code:

Fixed code:
CVE-2021-26276 (JSON, published 2021-01-27T20:15Z)
Description: value: scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-913 \u2014 Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Repository: https://github.com/godaddy/node-config-shield
Files changed:
package.json
scripts/cli.js
Commit message: Replaced eval with JSON5.parse


Vulnerable code:
  "version": "0.2.1",
  ]
      objVal = eval('(' + val + ')'); // attempt to parse

Fixed code:
  "version": "0.2.2",
  ],
  "dependencies": {
    "json5": "^2.1.3"
  }
var JSON5 = require('json5');
      objVal = JSON5.parse(val); // attempt to parse
CVE-2022-46146 (Go, published 2022-11-29T14:15Z)
Description: value: Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/prometheus/exporter-toolkit
Files changed:
web/handler.go
web/handler_test.go
Commit message: Merge pull request from GHSA-7rg2-cxvp-9p7p

* Fix authentication bypass if stored password hash is known

Signed-off-by: Julien Pivotto <roidelapluie@o11y.eu>

* Add test for CVE-2022-46146

Signed-off-by: Julien Pivotto <roidelapluie@o11y.eu>

Signed-off-by: Julien Pivotto <roidelapluie@o11y.eu>

Vulnerable code:
		cacheKey := hex.EncodeToString(append(append([]byte(user), []byte(hashedPassword)...), []byte(pass)...))
			authOk = err == nil

Fixed code:
	"strings"
		cacheKey := strings.Join(
			[]string{
				hex.EncodeToString([]byte(user)),
				hex.EncodeToString([]byte(hashedPassword)),
				hex.EncodeToString([]byte(pass)),
			}, ":")
			authOk = validUser && err == nil
// TestByPassBasicAuthVuln tests for CVE-2022-46146.
func TestByPassBasicAuthVuln(t *testing.T) {
	server := &http.Server{
		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Write([]byte("Hello World!"))
		}),
	}

	done := make(chan struct{})
	t.Cleanup(func() {
		if err := server.Shutdown(context.Background()); err != nil {
			t.Fatal(err)
		}
		<-done
	})

	go func() {
		flags := FlagConfig{
			WebListenAddresses: &([]string{port}),
			WebSystemdSocket:   OfBool(false),
			WebConfigFile:      OfString("testdata/web_config_users_noTLS.good.yml"),
		}
		ListenAndServe(server, &flags, testlogger)
		close(done)
	}()

	login := func(username, password string) {
		client := &http.Client{}
		req, err := http.NewRequest("GET", "http://localhost"+port, nil)
		if err != nil {
			t.Fatal(err)
		}
		req.SetBasicAuth(username, password)
		r, err := client.Do(req)
		if err != nil {
			t.Fatal(err)
		}
		if r.StatusCode != 401 {
			t.Fatalf("bad return code, expected %d, got %d", 401, r.StatusCode)
		}
	}

	// Poison the cache.
	login("alice$2y$12$1DpfPeqF9HzHJt.EWswy1exHluGfbhnn3yXhR7Xes6m3WJqFg0Wby", "fakepassword")
	// Login with a wrong password.
	login("alice", "$2y$10$QOauhQNbBCuQDKes6eFzPeMqBSjb7Mr5DUmpZ/VcEd00UAV/LDeSifakepassword")
}
CVE-2022-46146 (Go, published 2022-11-29T14:15Z)
Description: value: Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-303 \u2014 Incorrect Implementation of Authentication Algorithm
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
Repository: https://github.com/prometheus/exporter-toolkit
Files changed:
web/handler.go
web/handler_test.go
Commit message: Merge pull request from GHSA-7rg2-cxvp-9p7p

* Fix authentication bypass if stored password hash is known

Signed-off-by: Julien Pivotto <roidelapluie@o11y.eu>

* Add test for CVE-2022-46146

Signed-off-by: Julien Pivotto <roidelapluie@o11y.eu>

Signed-off-by: Julien Pivotto <roidelapluie@o11y.eu>

Vulnerable code:
		cacheKey := hex.EncodeToString(append(append([]byte(user), []byte(hashedPassword)...), []byte(pass)...))
			authOk = err == nil

Fixed code:
	"strings"
		cacheKey := strings.Join(
			[]string{
				hex.EncodeToString([]byte(user)),
				hex.EncodeToString([]byte(hashedPassword)),
				hex.EncodeToString([]byte(pass)),
			}, ":")
			authOk = validUser && err == nil
// TestByPassBasicAuthVuln tests for CVE-2022-46146.
func TestByPassBasicAuthVuln(t *testing.T) {
	server := &http.Server{
		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Write([]byte("Hello World!"))
		}),
	}

	done := make(chan struct{})
	t.Cleanup(func() {
		if err := server.Shutdown(context.Background()); err != nil {
			t.Fatal(err)
		}
		<-done
	})

	go func() {
		flags := FlagConfig{
			WebListenAddresses: &([]string{port}),
			WebSystemdSocket:   OfBool(false),
			WebConfigFile:      OfString("testdata/web_config_users_noTLS.good.yml"),
		}
		ListenAndServe(server, &flags, testlogger)
		close(done)
	}()

	login := func(username, password string) {
		client := &http.Client{}
		req, err := http.NewRequest("GET", "http://localhost"+port, nil)
		if err != nil {
			t.Fatal(err)
		}
		req.SetBasicAuth(username, password)
		r, err := client.Do(req)
		if err != nil {
			t.Fatal(err)
		}
		if r.StatusCode != 401 {
			t.Fatalf("bad return code, expected %d, got %d", 401, r.StatusCode)
		}
	}

	// Poison the cache.
	login("alice$2y$12$1DpfPeqF9HzHJt.EWswy1exHluGfbhnn3yXhR7Xes6m3WJqFg0Wby", "fakepassword")
	// Login with a wrong password.
	login("alice", "$2y$10$QOauhQNbBCuQDKes6eFzPeMqBSjb7Mr5DUmpZ/VcEd00UAV/LDeSifakepassword")
}
CVE-2021-3780 (TypeScript, published 2021-09-15T12:15Z)
Description: value: peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/chocobozzz/peertube
Files changed:
client/src/app/shared/shared-actor-image-edit/actor-avatar-edit.component.ts
client/src/app/shared/shared-actor-image-edit/actor-banner-edit.component.ts
client/src/app/shared/shared-actor-image/actor-avatar.component.ts
client/src/app/shared/shared-forms/preview-upload.component.ts
client/src/root-helpers/images.ts
client/src/root-helpers/index.ts
Commit message: Safer image preview


Vulnerable code:
import { DomSanitizer, SafeResourceUrl } from '@angular/platform-browser'
  preview: SafeResourceUrl
    private sanitizer: DomSanitizer,
      this.preview = this.sanitizer.bypassSecurityTrustResourceUrl(URL.createObjectURL(avatarfile))
import { DomSanitizer, SafeResourceUrl } from '@angular/platform-browser'
    private sanitizer: DomSanitizer,
      this.preview = this.sanitizer.bypassSecurityTrustResourceUrl(URL.createObjectURL(bannerfile))
import { SafeResourceUrl } from '@angular/platform-browser'
  @Input() previewImage: SafeResourceUrl
import { DomSanitizer, SafeResourceUrl } from '@angular/platform-browser'
  imageSrc: SafeResourceUrl
    private sanitizer: DomSanitizer,
      const url = URL.createObjectURL(this.file)
      this.imageSrc = this.sanitizer.bypassSecurityTrustResourceUrl(url)

Fixed code:
import { imageToDataURL } from '@root-helpers/images'
  preview: string
      imageToDataURL(avatarfile).then(result => this.preview = result)
import { SafeResourceUrl } from '@angular/platform-browser'
import { imageToDataURL } from '@root-helpers/images'
      imageToDataURL(bannerfile).then(result => this.preview = result)
  @Input() previewImage: string
import { imageToDataURL } from '@root-helpers/images'
  imageSrc: string
      imageToDataURL(this.file).then(result => this.imageSrc = result)
function imageToDataURL (input: File | Blob) {
  return new Promise<string>(res => {
    const reader = new FileReader()

    reader.onerror = err => console.error('Cannot read input file.', err)
    reader.onloadend = () => res(reader.result as string)
    reader.readAsDataURL(input)
  })
}

export {
  imageToDataURL
}
export * from './images'
CVE-2022-0132 (TypeScript, published 2022-01-10T14:12Z)
Description: value: peertube is vulnerable to Server-Side Request Forgery (SSRF)
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/chocobozzz/peertube
Files changed:
server/middlewares/validators/videos/video-imports.ts
server/tests/api/check-params/video-imports.ts
Commit message: Prevent video import on non unicast ips


Vulnerable code:

Fixed code:
import { isValid as isIPValid, parse as parseIP } from 'ipaddr.js'
    if (req.body.targetUrl) {
      const hostname = new URL(req.body.targetUrl).hostname

      if (isIPValid(hostname)) {
        const parsed = parseIP(hostname)

        if (parsed.range() !== 'unicast') {
          cleanUpReqFiles(req)

          return res.fail({
            status: HttpStatusCode.FORBIDDEN_403,
            message: 'Cannot use non unicast IP as targetUrl.'
          })
        }
      }
    }

    it('Should fail with localhost', async function () {
      const fields = { ...baseCorrectParams, targetUrl: 'http://localhost:8000' }

      await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
    })

    it('Should fail with a private IP target urls', async function () {
      const targetUrls = [
        'http://127.0.0.1:8000',
        'http://127.0.0.1',
        'http://127.0.0.1/hello',
        'https://192.168.1.42',
        'http://192.168.1.42'
      ]

      for (const targetUrl of targetUrls) {
        const fields = { ...baseCorrectParams, targetUrl }

        await makePostBodyRequest({
          url: server.url,
          path,
          token: server.accessToken,
          fields,
          expectedStatus: HttpStatusCode.FORBIDDEN_403
        })
      }
    })
CVE-2022-0508 (TypeScript, published 2022-02-08T11:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/chocobozzz/peertube
Files changed:
client/src/app/+videos/+video-edit/video-add-components/video-upload.component.ts
server/helpers/dns.ts
server/middlewares/validators/videos/video-imports.ts
server/tests/api/check-params/video-imports.ts
server/tests/helpers/dns.ts
server/tests/helpers/index.ts
Commit message: Correctly check import target URL IP


Vulnerable code:
import { HttpStatusCode, VideoCreateResult, VideoPrivacy } from '@shared/models'
import { isValid as isIPValid, parse as parseIP } from 'ipaddr.js'
      if (isIPValid(hostname)) {
        const parsed = parseIP(hostname)
        if (parsed.range() !== 'unicast') {
          cleanUpReqFiles(req)

          return res.fail({
            status: HttpStatusCode.FORBIDDEN_403,
            message: 'Cannot use non unicast IP as targetUrl.'
          })
        }
        'http://192.168.1.42'

Fixed code:
import { HttpStatusCode, VideoCreateResult } from '@shared/models'
import { lookup } from 'dns'
import { parse as parseIP } from 'ipaddr.js'

function dnsLookupAll (hostname: string) {
  return new Promise<string[]>((res, rej) => {
    lookup(hostname, { family: 0, all: true }, (err, adresses) => {
      if (err) return rej(err)

      return res(adresses.map(a => a.address))
    })
  })
}

async function isResolvingToUnicastOnly (hostname: string) {
  const addresses = await dnsLookupAll(hostname)

  for (const address of addresses) {
    const parsed = parseIP(address)

    if (parsed.range() !== 'unicast') return false
  }

  return true
}

export {
  dnsLookupAll,
  isResolvingToUnicastOnly
}
import { isResolvingToUnicastOnly } from '@server/helpers/dns'
      if (await isResolvingToUnicastOnly(hostname) !== true) {
        cleanUpReqFiles(req)
        return res.fail({
          status: HttpStatusCode.FORBIDDEN_403,
          message: 'Cannot use non unicast IP as targetUrl.'
        })
        'http://192.168.1.42',
        'http://127.0.0.1.cpy.re'
/* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */

import 'mocha'
import { expect } from 'chai'
import { isResolvingToUnicastOnly } from '@server/helpers/dns'

describe('DNS helpers', function () {

  it('Should correctly check unicast IPs', async function () {
    expect(await isResolvingToUnicastOnly('cpy.re')).to.be.true
    expect(await isResolvingToUnicastOnly('framasoft.org')).to.be.true
    expect(await isResolvingToUnicastOnly('8.8.8.8')).to.be.true

    expect(await isResolvingToUnicastOnly('127.0.0.1')).to.be.false
    expect(await isResolvingToUnicastOnly('127.0.0.1.cpy.re')).to.be.false
  })
})
import './dns'