hitoshura25/cvefixes huggingface dataset:
CVE-2018-11592 (C, published 2018-05-31T16:29Z)
Description: value: Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via an Out-of-bounds Read during syntax parsing in which certain height validation is missing in libs/graphics/jswrap_graphics.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/espruino/Espruino
Files changed:
ChangeLog
libs/graphics/jswrap_graphics.c
libs/graphics/lcd_arraybuffer.c
Commit message: Add height check for Graphics.createArrayBuffer(...vertical_byte:true) (fix #1421)


Vulnerable code:
      else
        jsWarn("vertical_byte only works for 1bpp ArrayBuffers\n");

Fixed code:
            Add height check for Graphics.createArrayBuffer(...vertical_byte:true) (fix #1421)
      else {
        jsExceptionHere(JSET_ERROR, "vertical_byte only works for 1bpp ArrayBuffers\n");
        return 0;
      }
      if (gfx.data.height&7) {
        jsExceptionHere(JSET_ERROR, "height must be a multiple of 8 when using vertical_byte\n");
        return 0;
      }
      assert(ptr>=gfx->backendData && ptr<((char*)gfx->backendData + graphicsGetMemoryRequired(gfx)));
CVE-2018-11593 (C, published 2018-05-31T16:29Z)
Description: value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclosure with a user crafted input file via a Buffer Overflow during syntax parsing because strncpy is misused in jslex.c.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/espruino/Espruino
Files changed:
src/jslex.c
Commit message: remove strncpy usage as it's effectively useless, replace with an assertion since fn is only used internally (fix #1426)


Vulnerable code:
  case LEX_EOF : strncpy(str, "EOF", len); return;
  case LEX_ID : strncpy(str, "ID", len); return;
  case LEX_INT : strncpy(str, "INT", len); return;
  case LEX_FLOAT : strncpy(str, "FLOAT", len); return;
  case LEX_STR : strncpy(str, "STRING", len); return;
  case LEX_UNFINISHED_STR : strncpy(str, "UNFINISHED STRING", len); return;
  case LEX_TEMPLATE_LITERAL : strncpy(str, "TEMPLATE LITERAL", len); return;
  case LEX_UNFINISHED_TEMPLATE_LITERAL : strncpy(str, "UNFINISHED TEMPLATE LITERAL", len); return;
  case LEX_REGEX : strncpy(str, "REGEX", len); return;
  case LEX_UNFINISHED_REGEX : strncpy(str, "UNFINISHED REGEX", len); return;
  case LEX_UNFINISHED_COMMENT : strncpy(str, "UNFINISHED COMMENT", len); return;
    strncpy(str, &tokenNames[p], len);
  assert(len>=10);

Fixed code:
  assert(len>28); // size of largest string

  case LEX_EOF : strcpy(str, "EOF"); return;
  case LEX_ID : strcpy(str, "ID"); return;
  case LEX_INT : strcpy(str, "INT"); return;
  case LEX_FLOAT : strcpy(str, "FLOAT"); return;
  case LEX_STR : strcpy(str, "STRING"); return;
  case LEX_UNFINISHED_STR : strcpy(str, "UNFINISHED STRING"); return;
  case LEX_TEMPLATE_LITERAL : strcpy(str, "TEMPLATE LITERAL"); return;
  case LEX_UNFINISHED_TEMPLATE_LITERAL : strcpy(str, "UNFINISHED TEMPLATE LITERAL"); return;
  case LEX_REGEX : strcpy(str, "REGEX"); return;
  case LEX_UNFINISHED_REGEX : strcpy(str, "UNFINISHED REGEX"); return;
  case LEX_UNFINISHED_COMMENT : strcpy(str, "UNFINISHED COMMENT"); return;
    strcpy(str, &tokenNames[p]);
CVE-2018-11594 (Other, published 2018-05-31T16:29Z)
Description: value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing of "VOID" tokens in jsparse.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/espruino/Espruino
Files changed:
ChangeLog
src/jsparse.c
Commit message: Fix stack overflow if void void void... is repeated many times (fix #1434)


Vulnerable code:

Fixed code:
            Fix stack overflow if void void void... is repeated many times (fix #1434)
    if (!jspCheckStackPosition()) return 0;
CVE-2018-11595 (C, published 2018-05-31T16:29Z)
Description: value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Privileges with a user crafted input file via a Buffer Overflow during syntax parsing, because strncat is misused.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/espruino/Espruino
Files changed:
ChangeLog
src/jslex.c
src/jspin.c
src/jsutils.c
src/jsvar.c
Commit message: Fix strncat/cpy bounding issues (fix #1425)


Vulnerable code:
  strncpy(str, "?[",len);
  itostr(token, &str[2], 10);
  strncat(str, "]",len);
    strncpy(str, "ID:", len);
    strncat(str, jslGetTokenValueAsString(), len);
    strncpy(str, "String:'", len);
    strncat(str, jslGetTokenValueAsString(), len);
    strncat(str, "'", len);
      strncpy(result, "undefined", 10);
  if (flags & JSPFTS_DEVICE) strncat(buf, devStr, bufSize);
  if (flags & JSPFTS_SPACE) strncat(buf, " ", bufSize);
  if (infoStr && (flags & JSPFTS_TYPE)) strncat(buf, infoStr, bufSize);
  if (isnan(val)) strncpy(str,"NaN",len);
    if (val<0) strncpy(str,"-Infinity",len);
    else strncpy(str,"Infinity",len);
      strncpy(str, "", len);

Fixed code:
            Fix strncat/cpy bounding issues (fix #1425)
  espruino_snprintf(str, len, "?[%d]", token);
    espruino_snprintf(str, len, "ID:%s", jslGetTokenValueAsString());
    espruino_snprintf(str, len, "String:'%s'", jslGetTokenValueAsString());
      strcpy(result, "undefined");
  if (flags & JSPFTS_DEVICE) strncat(buf, devStr, bufSize-1);
  if (flags & JSPFTS_SPACE) strncat(buf, " ", bufSize-(strlen(buf)+1));
  if (infoStr && (flags & JSPFTS_TYPE)) strncat(buf, infoStr, bufSize-(strlen(buf)+1));
  assert(len>9); // in case if strcpy
  if (isnan(val)) strcpy(str,"NaN");
    if (val<0) strcpy(str,"-Infinity");
    else strcpy(str,"Infinity");
    str[len-1] = 0;
      str[0] = 0;
CVE-2018-11596 (C, published 2018-05-31T16:29Z)
Description: value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because a check for '\0' is made for the wrong array element in jsvar.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/espruino/Espruino
Files changed:
src/jsvar.c
Commit message: fix jsvGetString regression


Vulnerable code:
    while (*s && l<len) {

Fixed code:
    while (s[l] && l<len) {
CVE-2018-11597 (Other, published 2018-05-31T16:29Z)
Description: value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because of a missing check for stack exhaustion with many '{' characters in jsparse.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/espruino/Espruino
Files changed:
ChangeLog
src/jsparse.c
Commit message: Fix stack overflow if interpreting a file full of '{' (fix #1448)


Vulnerable code:

Fixed code:
            Fix stack overflow if interpreting a file full of '{' (fix #1448)
    if (!jspCheckStackPosition()) return 0;
CVE-2018-11598 (Other, published 2018-05-31T16:29Z)
Description: value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Information Disclosure with user crafted input files via a Buffer Overflow or Out-of-bounds Read during syntax parsing of certain for loops in jsparse.c.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/espruino/Espruino
Files changed:
ChangeLog
src/jsparse.c
Commit message: Fix bug if using an undefined member of an object for for..in (fix #1437)


Vulnerable code:
        /* If we're assigning to this and we don't have a parent,
         * add it to the symbol table root */
        if (!jsvGetRefs(lhs) && jsvIsName(lhs)) {
          if (!jsvIsArrayBufferName(lhs) && !jsvIsNewChild(lhs))
            jsvAddName(execInfo.root, lhs);
        }
        jspReplaceWith(lhs, rhs);
    bool addedIteratorToScope = false;
    if (JSP_SHOULD_EXECUTE && !jsvGetRefs(forStatement)) {
      // if the variable did not exist, add it to the scope
      addedIteratorToScope = true;
      jsvAddName(execInfo.root, forStatement);
    }
              jsvSetValueOfName(forStatement, indexValue);
    if (addedIteratorToScope) {
      jsvRemoveChild(execInfo.root, forStatement);
    }

Fixed code:
            Fix bug if using an undefined member of an object for for..in (fix #1437)
void jspReplaceWithOrAddToRoot(JsVar *dst, JsVar *src) {
  /* If we're assigning to this and we don't have a parent,
   * add it to the symbol table root */
  if (!jsvGetRefs(dst) && jsvIsName(dst)) {
    if (!jsvIsArrayBufferName(dst) && !jsvIsNewChild(dst))
      jsvAddName(execInfo.root, dst);
  }
  jspReplaceWith(dst, src);
}

        jspReplaceWithOrAddToRoot(lhs, rhs);
              jspReplaceWithOrAddToRoot(forStatement, indexValue);
CVE-2022-25044 (C, published 2022-03-05T02:15Z)
Description: value: Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/espruino/Espruino
Files changed:
ChangeLog
src/jsparse.c
src/jsparse.h
src/jsvar.c
Commit message: Fix potential corruption issue caused by `delete [].__proto__` (fix #2142)


Vulnerable code:
        child = jspNewPrototype(objName);
      if (jsvHasChildren(parent)) {
/// Create a new Class of the given instance and return its prototype
/// Create a new Class of the given instance and return its prototype

Fixed code:
            Fix potential corruption issue caused by `delete [].__proto__` (fix #2142)
        JsVar *p = jsvSkipNameAndUnLock(jspNewPrototype(objName));
        // jspNewPrototype returns a 'prototype' name that's already a child of eg. an array
        // Create a new 'name' called __proto__ that links to it
        JsVar *i = jsvNewFromString(JSPARSE_INHERITS_VAR);
        if (p) child = jsvCreateNewChild(object, i, p);
        jsvUnLock(i);
#ifdef DEBUG
      if (jsvHasChildren(parent)) assert(jsvIsChild(parent, a));
#endif
      if (jsvHasChildren(parent) && jsvIsChild(parent, a)) {
        /* we use jsvIsChild here just in case. delete probably isn't called
        that often so it pays to be safe */
/// Create a new Class of the given instance and return its prototype (as a name 'prototype')
/// Create a new Class of the given instance and return its prototype (as a name 'prototype')
      assert(jsvIsName(insertAfter));
#ifdef DEBUG
  assert(jsvIsChild(parent, child));
#endif
CVE-2023-52264 (PHP, published 2023-12-30T23:15Z)
Description: value: The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thirtybees/beesblog
Files changed:
controllers/front/post.php
Commit message: Fix XSS vulnerability

Special thanks to Ulaş Deniz İlhan from Zigrin Security for discovering
and reporting this vulnerability.


Vulnerable code:
            'sharing_url' => addcslashes(Tools::getHttpHost(true).$_SERVER['REQUEST_URI'], "'"),

Fixed code:
            'sharing_url' => addcslashes($post->link, "'"),
CVE-2021-23436 (JavaScript, published 2021-09-01T18:15Z)
Description: value: This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/immerjs/immer
Files changed:
__tests__/patch.js
src/plugins/patches.ts
Commit message: fix(security): Follow up on CVE-2020-28477 where `path: [["__proto__"], "x"]` could still pollute the prototype


Vulnerable code:
				const p = path[i]

Fixed code:
test("CVE-2020-28477 (https://snyk.io/vuln/SNYK-JS-IMMER-1019369) follow up", () => {
	const obj = {}

	// @ts-ignore
	expect(obj.polluted).toBe(undefined)
	expect(() => {
		applyPatches({}, [
			{op: "add", path: [["__proto__"], "polluted"], value: "yes"}
		])
	}).toThrow(
		isProd
			? "24"
			: "Patching reserved attributes like __proto__, prototype and constructor is not allowed"
	)
	// @ts-ignore
	expect(obj.polluted).toBe(undefined)
})

				const p = "" + path[i]
CVE-2021-3757 (JavaScript, published 2021-09-02T12:15Z)
Description: value: immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/immerjs/immer
Files changed:
__tests__/patch.js
src/plugins/patches.ts
Commit message: fix(security): Follow up on CVE-2020-28477 where `path: [["__proto__"], "x"]` could still pollute the prototype


Vulnerable code:
				const p = path[i]

Fixed code:
test("CVE-2020-28477 (https://snyk.io/vuln/SNYK-JS-IMMER-1019369) follow up", () => {
	const obj = {}

	// @ts-ignore
	expect(obj.polluted).toBe(undefined)
	expect(() => {
		applyPatches({}, [
			{op: "add", path: [["__proto__"], "polluted"], value: "yes"}
		])
	}).toThrow(
		isProd
			? "24"
			: "Patching reserved attributes like __proto__, prototype and constructor is not allowed"
	)
	// @ts-ignore
	expect(obj.polluted).toBe(undefined)
})

				const p = "" + path[i]
CVE-2021-23392 (JavaScript, published 2021-06-08T08:15Z)
Description: value: The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/locutusjs/locutus
Files changed:
src/php/net-gopher/gopher_parsedir.js
Commit message: Prevent ReDos issue with regex inside gopher_parsedir (#446)



Vulnerable code:
  const entryPattern = /^(.)(.*?)\t(.*?)\t(.*?)\t(.*?)\u000d\u000a$/

Fixed code:
  const entryPattern = /^(.)([^\t]*)\t([^\t]*)\t([^\t]*)\t([^\t]*)\r\n$/
CVE-2021-33295 (TypeScript, published 2022-06-16T21:15Z)
Description: value: Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/laurent22/joplin
Files changed:
packages/renderer/htmlUtils.ts
Commit message: All: Security: Filter out NOSCRIPT tags that could be used to cause an XSS (thanks to Jubair Rehman for the PoC)


Vulnerable code:
	sanitizeHtml(html: string, options: any = null) {
		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta'];

Fixed code:
	public sanitizeHtml(html: string, options: any = null) {
		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];
CVE-2021-37916 (TypeScript, published 2021-08-03T00:15Z)
Description: value: Joplin before 2.0.9 allows XSS via button and form in the note body.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/laurent22/joplin
Files changed:
packages/renderer/htmlUtils.ts
Commit message: Desktop, Mobile: Filter out form elements from note body to prevent potential XSS (thanks to Dmytro Vdovychinskiy for the PoC)


Vulnerable code:
		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];

Fixed code:
		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript', 'button', 'form', 'input', 'select', 'textarea', 'option', 'optgroup'];
CVE-2022-45598 (TypeScript, published 2023-01-31T16:15Z)
Description: value: Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/laurent22/joplin
Files changed:
packages/app-cli/tests/md_to_html/sanitize_12.html
packages/app-cli/tests/md_to_html/sanitize_12.md
packages/renderer/MdToHtml.ts
Commit message: All: Security: Fix XSS when a specially crafted string is passed to the renderer


Vulnerable code:
				const sourceBlockHtml = `<pre class="joplin-source" data-joplin-language="${lang}" data-joplin-source-open="\`\`\`${lang}&#10;" data-joplin-source-close="&#10;\`\`\`">${markdownIt.utils.escapeHtml(trimmedStr)}</pre>`;

Fixed code:
<div class="joplin-editable"><pre class="joplin-source" data-joplin-language="&quot;&gt;&lt;svg/onload=top.eval(atob(&quot;cmVxdWlyZSgnY2hpbGRfcHJvY2VzcycpLmV4ZWMoJ29wZW4gLW4gL1N5c3RlbS9BcHBsaWNhdGlvbnMvQ2FsY3VsYXRvci5hcHAvQ29udGVudHMvTWFjT1MvQ2FsY3VsYXRvcicp&quot;))&gt;" data-joplin-source-open="```&quot;&gt;&lt;svg/onload=top.eval(atob(&quot;cmVxdWlyZSgnY2hpbGRfcHJvY2VzcycpLmV4ZWMoJ29wZW4gLW4gL1N5c3RlbS9BcHBsaWNhdGlvbnMvQ2FsY3VsYXRvci5hcHAvQ29udGVudHMvTWFjT1MvQ2FsY3VsYXRvcicp&quot;))&gt;&#10;" data-joplin-source-close="&#10;```">ts</pre><pre class="hljs"><code><span class="hljs-attribute">ts</span></code></pre></div>
```"><svg/onload=top.eval(atob("cmVxdWlyZSgnY2hpbGRfcHJvY2VzcycpLmV4ZWMoJ29wZW4gLW4gL1N5c3RlbS9BcHBsaWNhdGlvbnMvQ2FsY3VsYXRvci5hcHAvQ29udGVudHMvTWFjT1MvQ2FsY3VsYXRvcicp"))>
ts
```
const Entities = require('html-entities').AllHtmlEntities;
const htmlentities = new Entities().encode;
				const sourceBlockHtml = `<pre class="joplin-source" data-joplin-language="${htmlentities(lang)}" data-joplin-source-open="\`\`\`${htmlentities(lang)}&#10;" data-joplin-source-close="&#10;\`\`\`">${markdownIt.utils.escapeHtml(trimmedStr)}</pre>`;
CVE-2023-37298 (TypeScript, published 2023-06-30T15:15Z)
Description: value: Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/laurent22/joplin
Files changed:
packages/app-cli/tests/MdToHtml.ts
packages/app-cli/tests/md_to_html/sanitize_15.html
packages/app-cli/tests/md_to_html/sanitize_15.md
packages/renderer/htmlUtils.ts
Commit message: Desktop, Mobile: Security: Disable SVG tag support in editor to prevent XSS


Vulnerable code:
			// if (mdFilename !== 'sanitize_9.md') continue;
		// needs to load CSS files using a relative URL). For that reason
		// it is disabled. More info:
		// https://github.com/laurent22/joplin/issues/3021
		// "link" can be used to escape the parser and inject JavaScript.
		// Adding "meta" too for the same reason as it shouldn't be used in
		// notes anyway.

Fixed code:
			if (mdFilename !== 'sanitize_15.md') continue;
<use href="data:image/svg+xml,&lt;svg id=&apos;x&apos; xmlns=&apos;http://www.w3.org/2000/svg&apos;&gt;&lt;image href=&apos;asdf&apos; onerror=&apos;top.require(`child_process`).execSync(`calc.exe`)&apos; /&gt;&lt;/svg&gt;#x" class="jop-noMdConv">
<svg><use href="data:image/svg+xml,&lt;svg id='x' xmlns='http://www.w3.org/2000/svg'&gt;&lt;image href='asdf' onerror='top.require(`child_process`).execSync(`calc.exe`)' /&gt;&lt;/svg&gt;#x" />
		// needs to load CSS files using a relative URL). For that reason it is
		// disabled. More info: https://github.com/laurent22/joplin/issues/3021
		// "link" can be used to escape the parser and inject JavaScript. Adding
		// "meta" too for the same reason as it shouldn't be used in notes
		// anyway.
		//
		// There are too many issues with SVG tags and to handle them properly
		// we should parse them separately. Currently we are not so it is better
		// to disable them. SVG graphics are still supported via the IMG tag.
			'svg',