hitoshura25/cvefixes huggingface dataset:
CVE-2014-9491 (C, published 2015-01-20T15:59Z)
Description: value: The devzvol_readdir function in illumos does not check the return value of a strchr call, which allows remote attackers to cause a denial of service (NULL pointer dereference and panic) via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/illumos/illumos-gate
Files changed:
usr/src/uts/common/fs/dev/sdev_zvolops.c
Commit message: 5421 devzvol_readdir() needs to be more careful with strchr
Reviewed by: Keith Wesolowski <keith.wesolowski@joyent.com>
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
Approved by: Dan McDonald <danmcd@omniti.com>


Vulnerable code:
	ptr = strchr(ptr + 1, '/') + 1;

Fixed code:
	ptr = strchr(ptr + 1, '/');
	if (ptr == NULL)
		return (ENOENT);
	ptr++;
CVE-2016-6560 (Other, published 2017-03-31T19:59Z)
Description: value: illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/illumos/illumos-gate
Files changed:
usr/src/uts/intel/ia32/ml/copy.s
Commit message: 7488 bcopy and bzero should mind signed bits
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
Reviewed by: Patrick Mooney <patrick.mooney@joyent.com>
Approved by: Richard Lowe <richlowe@richlowe.net>


Vulnerable code:
 * Copyright 2015 Joyent, Inc.
	jge	bcopy_ck_size
	jge	L(use_rep)
	jge	L(aligned_loop)
	jge	L(ck_align)
	jg	L(use_rep)
	jge	L(bzero_loop)

Fixed code:
 * Copyright 2016 Joyent, Inc.
	jae	bcopy_ck_size
	jae	L(use_rep)
	jae	L(aligned_loop)
	jae	L(ck_align)
	ja	L(use_rep)
	jae	L(bzero_loop)
CVE-2016-6561 (C, published 2017-03-31T19:59Z)
Description: value: illumos smbsrv NULL pointer dereference allows system crash.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/illumos/illumos-gate
Files changed:
usr/src/uts/common/fs/smbsrv/smb2_flush.c
usr/src/uts/common/fs/smbsrv/smb_flush.c
usr/src/uts/common/fs/smbsrv/smb_ofile.c
usr/src/uts/common/smbsrv/smb_kproto.h
Commit message: 7483 SMB flush on pipe triggers NULL pointer dereference in module smbsrv
Reviewed by: Gordon Ross <gwr@nexenta.com>
Reviewed by: Matt Barden <matt.barden@nexenta.com>
Reviewed by: Evan Layton <evan.layton@nexenta.com>
Reviewed by: Dan McDonald <danmcd@omniti.com>
Approved by: Gordon Ross <gwr@nexenta.com>


Vulnerable code:
	smb_ofile_t *of = NULL;
	of = sr->fid_ofile;
	/*
	 * XXX - todo:
	 * Flush named pipe should drain writes.
	 */
	if ((of->f_node->flags & NODE_FLAGS_WRITE_THROUGH) == 0)
		(void) smb_fsop_commit(sr, of->f_cr, of->f_node);
static void smb_flush_file(struct smb_request *sr, struct smb_ofile *ofile);


		smb_flush_file(sr, sr->fid_ofile);
			smb_flush_file(sr, file);


/*
 * smb_flush_file
 *
 * If writes on this file are not synchronous, flush it using the NFSv3
 * commit interface.
 */
static void
smb_flush_file(struct smb_request *sr, struct smb_ofile *ofile)
{
	sr->user_cr = smb_ofile_getcred(ofile);

	if ((ofile->f_node->flags & NODE_FLAGS_WRITE_THROUGH) == 0)
		(void) smb_fsop_commit(sr, sr->user_cr, ofile->f_node);
}

Fixed code:
 * Copyright 2016 Syneto S.R.L. All rights reserved.
	smb_ofile_flush(sr, sr->fid_ofile);
 *
 * Copyright 2016 Syneto S.R.L. All rights reserved.
		smb_ofile_flush(sr, sr->fid_ofile);
			smb_ofile_flush(sr, file);
 * Copyright 2016 Syneto S.R.L. All rights reserved.
/*
 * smb_ofile_flush
 *
 * If writes on this file are not synchronous, flush it using the NFSv3
 * commit interface.
 *
 * XXX - todo: Flush named pipe should drain writes.
 */
void
smb_ofile_flush(struct smb_request *sr, struct smb_ofile *of)
{
	switch (of->f_ftype) {
	case SMB_FTYPE_DISK:
		if ((of->f_node->flags & NODE_FLAGS_WRITE_THROUGH) == 0)
			(void) smb_fsop_commit(sr, of->f_cr, of->f_node);
		break;
	default:
		break;
	}
}

 * Copyright 2016 Syneto S.R.L.  All rights reserved.
void smb_ofile_flush(smb_request_t *, smb_ofile_t *);
CVE-2020-27678 (C, published 2020-10-26T12:17Z)
Description: value: An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/illumos/illumos-gate
Files changed:
usr/src/lib/libpam/pam_framework.c
Commit message: 13242 parse_user_name in PAM is sloppy
Reviewed by: Alex Wilson <alex@cooperi.net>
Approved by: Gordon Ross <gordon.w.ross@gmail.com>


Vulnerable code:
 * Copyright (c) 2019, Joyent, Inc.
		if ((*ptr == ' ') || (*ptr == '\t'))
		else {
	if ((*ret_username = malloc(index + 1)) == NULL)
	(void) strcpy(*ret_username, username);

Fixed code:
 * Copyright 2020, Joyent, Inc.
		if ((*ptr == ' ') || (*ptr == '\t') ||
		    (index >= PAM_MAX_RESP_SIZE)) {
		} else {
	if (index >= PAM_MAX_RESP_SIZE ||
	    (*ret_username = strdup(username)) == NULL)
CVE-2021-43395 (C, published 2022-12-26T06:15Z)
Description: value: An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 2021.04, and SmartOS 20210923. A local unprivileged user can cause a deadlock and kernel panic via crafted rename and rmdir calls on tmpfs filesystems. Oracle Solaris 10 and 11 is also affected.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-667 \u2014 Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Repository: https://github.com/illumos/illumos-gate
Files changed:
usr/src/uts/common/fs/tmpfs/tmp_dir.c
Commit message: 14424 tmpfs can be induced to deadlock
Reviewed by: Robert Mustacchi <rm@fingolfin.org>
Reviewed by: Andy Fiddaman <andy@omnios.org>
Reviewed by: Mike Zeller <mike.zeller@joyent.com>
Approved by: Robert Mustacchi <rm@fingolfin.org>


Vulnerable code:
		if (tp != dir)
			rw_enter(&tp->tn_rwlock, RW_WRITER);

Fixed code:
/* Non-static so compilers won't constant-fold these away. */
clock_t tmpfs_rename_backoff_delay = 1;
unsigned int tmpfs_rename_backoff_tries = 0;
unsigned long tmpfs_rename_loops = 0;

		if (tp != dir) {
			unsigned int tries = 0;

			/*
			 * If we are acquiring tp->tn_rwlock (for SOURCE)
			 * inside here, we must consider the following:
			 *
			 * - dir->tn_rwlock (TARGET) is already HELD (see
			 * above ASSERT()).
			 *
			 * - It is possible our SOURCE is a parent of our
			 * TARGET. Yes it's unusual, but it will return an
			 * error below via tdircheckpath().
			 *
			 * - It is also possible that another thread,
			 * concurrent to this one, is performing
			 * rmdir(TARGET), which means it will first acquire
			 * SOURCE's lock, THEN acquire TARGET's lock, which
			 * could result in this thread holding TARGET and
			 * trying for SOURCE, but the other thread holding
			 * SOURCE and trying for TARGET.  This is deadlock,
			 * and it's inducible.
			 *
			 * To prevent this, we borrow some techniques from UFS
			 * and rw_tryenter(), delaying if we fail, and
			 * if someone tweaks the number of backoff tries to be
			 * nonzero, return EBUSY after that number of tries.
			 */
			while (!rw_tryenter(&tp->tn_rwlock, RW_WRITER)) {
				/*
				 * Sloppy, but this is a diagnostic so atomic
				 * increment would be overkill.
				 */
				tmpfs_rename_loops++;

				if (tmpfs_rename_backoff_tries != 0) {
					if (tries > tmpfs_rename_backoff_tries)
						return (EBUSY);
					tries++;
				}
				/*
				 * NOTE: We're still holding dir->tn_rwlock,
				 * so drop it over the delay, so any other
				 * thread can get its business done.
				 *
				 * No state change or state inspection happens
				 * prior to here, so it is not wholly dangerous
				 * to release-and-reacquire dir->tn_rwlock.
				 *
				 * Hold the vnode of dir in case it gets
				 * released by another thread, though.
				 */
				VN_HOLD(TNTOV(dir));
				rw_exit(&dir->tn_rwlock);
				delay(tmpfs_rename_backoff_delay);
				rw_enter(&dir->tn_rwlock, RW_WRITER);
				VN_RELE(TNTOV(dir));
			}
		}
CVE-2017-16907 (PHP, published 2017-11-20T20:29Z)
Description: value: In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/horde/base
Files changed:
lib/View/Sidebar.php
Commit message: Bug: 14857

Escape user supplied color data, preventing XSS vuln.


Vulnerable code:
            $row['style'] .= 'background-color:' . $row['color']

Fixed code:
            $row['style'] .= 'background-color:' . htmlspecialchars($row['color'])
CVE-2023-27581 (YAML, published 2023-03-13T21:15Z)
Description: value: github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/rlespinasse/github-slug-action
Files changed:
action.yml
Commit message: fix: use github.head_ref env var as trusted input



Vulnerable code:
    # Specific values

    # Calculated values
    - id: get-github-ref-name
      run: |
        refname="${{ github.head_ref || github.ref_name }}"
        if [ -f "$GITHUB_OUTPUT" ]; then
          echo "github-ref-name=${refname}" >> "$GITHUB_OUTPUT"
        else
          echo "::set-output name=github-ref-name::${refname}"
        fi
      shell: bash
        value: ${{ steps.get-github-ref-name.outputs.github-ref-name }}
    # Short

Fixed code:
    # From Environment Variables
    # From Specific values
        # Related to https://github.com/rlespinasse/github-slug-action/issues/104
        value: ${{ env.GITHUB_HEAD_REF_RAW || env.GITHUB_REF_NAME_RAW }}
      env:
        GITHUB_HEAD_REF_RAW: ${{ github.head_ref }}
        GITHUB_REF_NAME_RAW: ${{ github.ref_name }}

    # From Calculated values
    # From sha
CVE-2019-3554 (C, published 2019-01-15T22:29Z)
Description: value: Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-19 \u2014 Data Processing Errors
Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Repository: https://github.com/facebook/wangle
Files changed:
wangle/bootstrap/AcceptRoutingHandler-inl.h
Commit message: AcceptRoutingHandler should not assume a folly::AsyncSocket

Summary:
There is no reason to perform a cast to folly::AsyncSocket, when all of the
required behavior is in folly::AsyncTransportWrapper.

CVE-2019-3554

Reviewed By: avasylev

Differential Revision: D13599212

fbshipit-source-id: 3bb5475fe464c04cf5c04115f34e1bcf237cb4aa


Vulnerable code:
  auto socket = std::dynamic_pointer_cast<folly::AsyncSocket>(

Fixed code:
  auto socket = std::dynamic_pointer_cast<folly::AsyncTransportWrapper>(
  CHECK(socket);
CVE-2019-3563 (C++, published 2019-04-29T16:29Z)
Description: value: Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow. This affects versions of Wangle prior to v2019.04.22.00
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/wangle
Files changed:
wangle/codec/LineBasedFrameDecoder.cpp
wangle/codec/test/CodecTest.cpp
Commit message: Peek for \n in LineBasedFrameDecoder.

Summary:
Previously this could underflow if there was not a following \n.

CVE-2019-3563

Reviewed By: siyengar

Differential Revision: D14935715

fbshipit-source-id: 25c3eecf373f89efa1232456aeeb092f13b7fa06


Vulnerable code:
    } else if (terminatorType_ != TerminatorType::NEWLINE &&
               b == '\r' && !c.isAtEnd() && c.read<char>() == '\n') {

Fixed code:
    } else if (
        terminatorType_ != TerminatorType::NEWLINE && b == '\r' &&
        !c.isAtEnd() && *c.peekBytes().data() == '\n') {

TEST(LineBasedFrameDecoder, CarriageOnly) {
  auto pipeline = Pipeline<IOBufQueue&, std::unique_ptr<IOBuf>>::create();

  (*pipeline)
      .addBack(LineBasedFrameDecoder(
          10, true, LineBasedFrameDecoder::TerminatorType::CARRIAGENEWLINE))
      .addBack(test::FrameTester([&](std::unique_ptr<IOBuf>) { FAIL(); }))
      .finalize();

  IOBufQueue q(IOBufQueue::cacheChainLength());
  q.append(IOBuf::copyBuffer("\raa"));
  pipeline->read(q);
}

TEST(LineBasedFrameDecoder, DoubleCarriage) {
  auto pipeline = Pipeline<IOBufQueue&, std::unique_ptr<IOBuf>>::create();
  int called = 0;

  (*pipeline)
      .addBack(LineBasedFrameDecoder(
          10, true, LineBasedFrameDecoder::TerminatorType::CARRIAGENEWLINE))
      .addBack(test::FrameTester([&](std::unique_ptr<IOBuf> buf) {
        auto sz = buf->computeChainDataLength();
        called++;
        EXPECT_EQ(sz, 1);
      }))
      .finalize();

  IOBufQueue q(IOBufQueue::cacheChainLength());
  q.append(IOBuf::copyBuffer("\r\r\na\r\n"));
  pipeline->read(q);
  EXPECT_EQ(called, 2);
}
CVE-2019-20387 (C, published 2020-01-21T23:15Z)
Description: value: repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/openSUSE/libsolv
Files changed:
src/repodata.c
Commit message: repodata_schema2id: fix heap-buffer-overflow in memcmp

When the length of last schema in data->schemadata is
less than length of input schema, we got a read overflow
in asan test.

Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>


Vulnerable code:
      if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
        if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))

Fixed code:
      if ((data->schemata[cid] + len <= data->schemadatalen) &&
			  !memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
        if ((data->schemata[cid] + len <= data->schemadatalen) &&
				!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
CVE-2020-36630 (Unknown, published 2022-12-25T20:15Z)
Description: value: A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is able to address this issue. The name of the patch is f1a9eea2dfff30fb99d825bac194a676a82b9ec8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216771.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/FreePBX/cdr
Files changed:
Commit message: Merge pull request #20 in FREEPBX/cdr from ~VMISHRA/cdr:bugfix/FREEI-1763-14 to release/14.0

* commit '4aceac9f7e27b4715d702ce5fee377f13da6e89f':
  FREEI-1763 (ver14)SQL Injection in Cdr Module for the UCP application


Vulnerable code:

Fixed code:
CVE-2022-46663 (C, published 2023-02-07T21:15Z)
Description: value: In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/gwsw/less
Files changed:
line.c
Commit message: End OSC8 hyperlink on invalid embedded escape sequence.


Vulnerable code:
		if (pansi->prev_esc && ch == '\\')
			return ANSI_END;

Fixed code:
		if (pansi->prev_esc)
            return (ch == '\\') ? ANSI_END : ANSI_ERR;
CVE-2022-48624 (C, published 2024-02-19T01:15Z)
Description: value: close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/gwsw/less
Files changed:
filename.c
Commit message: Shell-quote filenames when invoking LESSCLOSE.


Vulnerable code:
	len = (int) (strlen(lessclose) + strlen(filename) + strlen(altfilename) + 2);
	SNPRINTF2(cmd, len, lessclose, filename, altfilename);

Fixed code:
	char *qfilename;
	char *qaltfilename;
	qfilename = shell_quote(filename);
	qaltfilename = shell_quote(altfilename);
	len = (int) (strlen(lessclose) + strlen(qfilename) + strlen(qaltfilename) + 2);
	SNPRINTF2(cmd, len, lessclose, qfilename, qaltfilename);
	free(qaltfilename);
	free(qfilename);
CVE-2024-32487 (C, published 2024-04-13T15:15Z)
Description: value: less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/gwsw/less
Files changed:
filename.c
Commit message: Fix bug when viewing a file whose name contains a newline.


Vulnerable code:
static int metachar(char c)
			if (metachar(*s))
				/*
				 * Add the escape char.
				 */
			*np++ = *s++;

Fixed code:
static lbool metachar(char c)
/*
 * Must use quotes rather than escape char for this metachar?
 */
static lbool must_quote(char c)
{
	/* {{ Maybe the set of must_quote chars should be configurable? }} */
	return (c == '\n'); 
}

			} else if (must_quote(*p))
			{
				len += 3; /* open quote + char + close quote */
			if (!metachar(*s))
				*np++ = *s++;
			} else if (must_quote(*s))
			{
				/* Surround the char with quotes. */
				*np++ = openquote;
				*np++ = *s++;
				*np++ = closequote;
			} else
			{
				/* Insert an escape char before the char. */
				*np++ = *s++;
CVE-2020-36559 (Go, published 2022-12-27T22:15Z)
Description: value: Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/go-aah/aah
Files changed:
README.md
http_engine.go
static.go
static_test.go
version.go
Commit message: #266 addressing path traversal issue on static file delivery (#267)



Vulnerable code:
	"aahframe.work/essentials"
	"aahframe.work/essentials"
	t.Log("Directory Listing - /assets")
	resp, err = httpClient.Get(ts.URL + "/assets")
	assert.Nil(t, err)
	assert.Equal(t, 200, resp.StatusCode)
	body := responseBody(resp)
	assert.True(t, strings.Contains(body, "<title>Listing of /assets/</title>"))
	assert.True(t, strings.Contains(body, "<h1>Listing of /assets/</h1><hr>"))
	assert.True(t, strings.Contains(body, `<a href="robots.txt">robots.txt</a>`))
	assert.Equal(t, "", resp.Header.Get(ahttp.HeaderCacheControl))
const Version = "0.12.3"

Fixed code:
  * `v0.12.4` [released](https://docs.aahframework.org/release-notes.html) and tagged on Mar 03, 2020.
	"path"
	ess "aahframe.work/essentials"
	// Path Clean
	r.URL.Path = path.Clean(r.URL.Path)

	ess "aahframe.work/essentials"
		fmt.Println("here 1")
	// t.Log("Directory Listing - /assets")
	// resp, err = httpClient.Get(ts.URL + "/assets")
	// fmt.Println("err", err.Error())
	// assert.Nil(t, err)
	// assert.Equal(t, 200, resp.StatusCode)
	// body := responseBody(resp)
	// fmt.Println("body", body)
	// assert.True(t, strings.Contains(body, "<title>Listing of /assets/</title>"))
	// assert.True(t, strings.Contains(body, "<h1>Listing of /assets/</h1><hr>"))
	// assert.True(t, strings.Contains(body, `<a href="robots.txt">robots.txt</a>`))
	// assert.Equal(t, "", resp.Header.Get(ahttp.HeaderCacheControl))
const Version = "0.12.4"