hitoshura25/cvefixes huggingface dataset:
CVE-2021-43816 (Go, published 2022-01-05T19:15Z)
Description: value: containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-281 \u2014 Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Repository: https://github.com/containerd/containerd
Files changed:
pkg/cri/opts/spec_linux.go
pkg/cri/server/container_create_linux.go
Commit message: [cri] label etc files for selinux containers

Signed-off-by: Michael Crosby <michael@thepasture.io>


Vulnerable code:
	specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel))

Fixed code:
const (
	etcHosts       = "/etc/hosts"
	etcHostname    = "/etc/hostname"
	resolvConfPath = "/etc/resolv.conf"
)

// WithRelabeledContainerMounts relabels the default container mounts for files in /etc
func WithRelabeledContainerMounts(mountLabel string) oci.SpecOpts {
	return func(ctx context.Context, client oci.Client, _ *containers.Container, s *runtimespec.Spec) (err error) {
		if mountLabel == "" {
			return nil
		}
		for _, m := range s.Mounts {
			switch m.Destination {
			case etcHosts, etcHostname, resolvConfPath:
				if err := label.Relabel(m.Source, mountLabel, false); err != nil {
					return err
				}
			}
		}
		return nil
	}
}

	specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel), customopts.WithRelabeledContainerMounts(mountLabel))
CVE-2022-31030 (Unknown, published 2022-06-09T14:15Z)
Description: value: containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/containerd/containerd
Files changed:
Commit message: Merge pull request from GHSA-5ffw-gxpp-mxpf

Limit the response size of ExecSync

Vulnerable code:

Fixed code:
CVE-2018-1002204 (Unknown, published 2018-07-25T17:29Z)
Description: value: adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/cthackers/adm-zip
Files changed:
Commit message: Merge pull request #212 from aviadatsnyk/master

fix: prevent extracting archived files outside of target path.  Credit to Snyk Security Research Team for disclosure and fixing the issue.

Vulnerable code:

Fixed code:
CVE-2018-7651 (JavaScript, published 2018-03-04T01:29Z)
Description: value: index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long base64 hash string.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/zkat/ssri
Files changed:
index.js
test/integrity.js
test/stringify.js
Commit message: fix(security): tweak strict SRI regex (#10)

The previous form was vulnerable to ReDoS attacks, by
crafting exceptionally long base64 hash strings.

This issue only affected consumers using the opts.strict option.

Vulnerable code:
const STRICT_SRI_REGEX = /^([^-]+)-([A-Za-z0-9+/]+(?:=?=?))([?\x21-\x7E]*)$/
  const sri = ssri.parse('sha512-foo sha256-bar!')
    'sha512-foo sha256-bar!',
    'sha512-foo',
    'sha512-foo\nsha256-bar!',
    sri.concat('sha1-bar!', {strict: true}).toString(),
    'sha512-foo',
    ssri.stringify('sha512-foo sha256-bar', {sep: ' \r|\n\t', strict: true}),
    'sha512-foo \r \n\tsha256-bar',

Fixed code:
const STRICT_SRI_REGEX = /^([^-]+)-([A-Za-z0-9+/=]{44,88})(\?[\x21-\x7E]*)*$/
  const sri = ssri.parse('sha1-eUN/Xt2hP5wGabl43XqQZt0gWfE= sha256-Qhx213Vjr6GRSEawEL0WTzlb00whAuXpngy5zxc8HYc=')
    'sha1-eUN/Xt2hP5wGabl43XqQZt0gWfE= sha256-Qhx213Vjr6GRSEawEL0WTzlb00whAuXpngy5zxc8HYc=',
    'sha256-Qhx213Vjr6GRSEawEL0WTzlb00whAuXpngy5zxc8HYc=',
    'sha1-eUN/Xt2hP5wGabl43XqQZt0gWfE=\nsha256-Qhx213Vjr6GRSEawEL0WTzlb00whAuXpngy5zxc8HYc=',
  const strictSri = ssri.parse('sha512-WrLorGiX4iEWOOOaJSiCrmDIamA47exH+Bz7tVwIPb4sCU8w4iNqGCqYuspMMeU5pgz/sU7koP5u8W3RCUojGw==')
    strictSri.concat('sha1-eUN/Xt2hP5wGabl43XqQZt0gWfE=', {
      strict: true
    }).toString(),
    'sha512-WrLorGiX4iEWOOOaJSiCrmDIamA47exH+Bz7tVwIPb4sCU8w4iNqGCqYuspMMeU5pgz/sU7koP5u8W3RCUojGw==',
    ssri.stringify('sha512-WrLorGiX4iEWOOOaJSiCrmDIamA47exH+Bz7tVwIPb4sCU8w4iNqGCqYuspMMeU5pgz/sU7koP5u8W3RCUojGw== sha256-Qhx213Vjr6GRSEawEL0WTzlb00whAuXpngy5zxc8HYc=', {sep: ' \r|\n\t', strict: true}),
    'sha512-WrLorGiX4iEWOOOaJSiCrmDIamA47exH+Bz7tVwIPb4sCU8w4iNqGCqYuspMMeU5pgz/sU7koP5u8W3RCUojGw== \r \n\tsha256-Qhx213Vjr6GRSEawEL0WTzlb00whAuXpngy5zxc8HYc=',
CVE-2022-21710 (JSON, published 2022-01-24T20:15Z)
Description: value: ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:&lt;img src=x onerror=alert()&gt;}}`. This issue has a patch in version 2.3.4.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription
Files changed:
extension.json
Commit message: build: bump version to 2.3.4

Vulnerable code:
	"version": "2.3.3",

Fixed code:
	"version": "2.3.4",
CVE-2022-21710 (PHP, published 2022-01-24T20:15Z)
Description: value: ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:&lt;img src=x onerror=alert()&gt;}}`. This issue has a patch in version 2.3.4.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription
Files changed:
includes/Hooks/ActionsHooks.php
modules/ext.shortDescription.js
Commit message: fix: unsanitized shortdesc property


Vulnerable code:
			$shortdesc
		tagline.innerHTML = shortdesc;

Fixed code:
			htmlspecialchars( $shortdesc )
		tagline.innerHTML = mw.html.escape( shortdesc );
CVE-2021-41134 (Unknown, published 2021-11-03T18:15Z)
Description: value: nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook (diffNotebookCheckpoint), nbdime appears to simply append .ipynb to the name of the input file. The NbdimeWidget is then created, and the base string is passed through to the request API function. From there, the frontend simply renders the HTML tag and anything along with it. Users are advised to patch to the most recent version of the affected product.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jupyter/nbdime
Files changed:
Commit message: Merge pull request from GHSA-p6rw-44q7-3fw4

Safer handling of user strings

Vulnerable code:

Fixed code:
CVE-2024-24811 (Unknown, published 2024-02-07T15:15Z)
Description: value: SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/zopefoundation/Products.SQLAlchemyDA
Files changed:
Commit message: Merge pull request from GHSA-r3jc-3qmm-w3pw

Add missing security declarations on the database adapter class

Vulnerable code:

Fixed code:
CVE-2018-7247 (C, published 2018-02-19T18:29Z)
Description: value: An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer, leading potentially to arbitrary code execution or possibly unspecified other impact.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/DanBloomberg/leptonica
Files changed:
prog/htmlviewer.c
Commit message: prog/htmlviewer: Catch unbound memory access (CID 1386222)

rootname can have any size, so limit the amount of copied bytes.

Signed-off-by: Stefan Weil <sw@weilnetz.de>


Vulnerable code:
    sprintf(charbuf, "%s/%s.html", dirout, rootname);
    sprintf(charbuf, "%s/%s-links.html", dirout, rootname);
        sprintf(charbuf, "%s_thumb_%03d", rootname, index);

Fixed code:
    snprintf(charbuf, sizeof(charbuf), "%s/%s.html", dirout, rootname);
    snprintf(charbuf, sizeof(charbuf), "%s/%s-links.html", dirout, rootname);
        snprintf(charbuf, sizeof(charbuf), "%s_thumb_%03d", rootname, index);
CVE-2020-36278 (C, published 2021-03-12T00:15Z)
Description: value: Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/DanBloomberg/leptonica
Files changed:
src/ccbord.c
Commit message: Issue 23433 in oss-fuzz: Heap-buffer-overflow in findNextBorderPixel()
* Check pix boundary when looking for the next pixel.


Vulnerable code:

Fixed code:
        if (npx < 0 || npx >= w || npy < 0 || npy >= h)
            continue;
CVE-2020-36279 (C, published 2021-03-12T00:15Z)
Description: value: Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap_reg.c and adaptmap.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/DanBloomberg/leptonica
Files changed:
prog/adaptmap_reg.c
src/adaptmap.c
Commit message: Fixing oss-fuzz issue 22512: Heap-buffer-overflow in rasteropGeneralLow()
* Simplified the hole-filling function
`


Vulnerable code:
PIXA         *pixa;
    pixDisplayWithTitle(pix1, 100, 0, NULL, rp->display);
PIX      *pixt;
        pixt = pixCopy(NULL, pix);
            for (j = goodcol - 1; j >= 0; j--) {
                pixRasterop(pix, j, 0, 1, h, PIX_SRC, pixt, j + 1, 0);
                pixRasterop(pixt, j, 0, 1, h, PIX_SRC, pix, j, 0);
            }
                pixRasterop(pix, j, 0, 1, h, PIX_SRC, pixt, j - 1, 0);
                pixRasterop(pixt, j, 0, 1, h, PIX_SRC, pix, j, 0);
        pixDestroy(&pixt);

Fixed code:
PIXA         *pixa, *pixa2;
        /* Check pixFillMapHoles() */
    pixa2 = pixaCreate(3);
    pix1 = pixRead("weasel8.png");  /* use this as the map */
    pixGammaTRC(pix1, pix1, 1.0, 0, 270);  /* darken white pixels */
    pixaAddPix(pixa2, pix1, L_COPY);
    pixGetDimensions(pix1, &w, &h, NULL);
    pixRasterop(pix1, 0, 0, 5, h, PIX_SET, NULL, 0, 0);  /* add white holes */
    pixRasterop(pix1, 20, 0, 2, h, PIX_SET, NULL, 0, 0);
    pixRasterop(pix1, 40, 0, 3, h, PIX_SET, NULL, 0, 0);
    pixRasterop(pix1, 0, 0, w, 3, PIX_SET, NULL, 0, 0);
    pixRasterop(pix1, 0, 15, w, 3, PIX_SET, NULL, 0, 0);
    pixRasterop(pix1, 0, 35, w, 2, PIX_SET, NULL, 0, 0);
    pixaAddPix(pixa2, pix1, L_COPY);
    pixFillMapHoles(pix1, w, h, L_FILL_WHITE);
    pixaAddPix(pixa2, pix1, L_INSERT);
    pix2 = pixaDisplayTiledInColumns(pixa2, 3, 1.0, 20, 1);
    regTestWritePixAndCheck(rp, pix2, IFF_PNG);  /* 14 */
    pixDisplayWithTitle(pix2, 50, 850, NULL, rp->display);
    pixaDestroy(&pixa2);
    pixDestroy(&pix2);
    
    pixDisplayWithTitle(pix1, 50, 0, NULL, rp->display);
            for (j = goodcol - 1; j >= 0; j--)
                pixRasterop(pix, j, 0, 1, h, PIX_SRC, pix, j + 1, 0);
                pixRasterop(pix, j, 0, 1, h, PIX_SRC, pix, j - 1, 0);
CVE-2020-36280 (C, published 2021-03-12T00:15Z)
Description: value: Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream, related to tiffio.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/DanBloomberg/leptonica
Files changed:
prog/dewarptest1.c
src/tiffio.c
Commit message: Issue 23654 in oss-fuzz: Heap-buffer-overflow in pixReadFromTiffStream
  * Increase scanline buffer for reading gray+alpha and converting to RGBA


Vulnerable code:
    lept_rmdir("lept/dewmod");
    lept_rmdir("lept/dewtest");
        linebuf = (l_uint8 *)LEPT_CALLOC(tiffbpl + 1, sizeof(l_uint8));

Fixed code:
    lept_rmdir("lept/dewmod");
    lept_mkdir("lept/dewmod");
        linebuf = (l_uint8 *)LEPT_CALLOC(2 * tiffbpl + 1, sizeof(l_uint8));
CVE-2020-36281 (C, published 2021-03-12T01:15Z)
Description: value: Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/DanBloomberg/leptonica
Files changed:
src/colorquant1.c
Commit message: Fixed issue 22140 in oss-fuzz: Heap-buffer-overflow
* color quantized pix must be 8 bpp before extra colors are added.


Vulnerable code:
PIX       *pixc, *pixm, *pixg, *pixd;
    if ((pixc = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)

Fixed code:
PIX       *pix1, *pixc, *pixm, *pixg, *pixd;
    if ((pix1 = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)
    pixc = pixConvertTo8(pix1, 1);  /* must be 8 bpp */
    pixDestroy(&pix1);
CVE-2023-27583 (Go, published 2023-03-13T21:15Z)
Description: value: PanIndex is a network disk directory index. In Panindex prior to version 3.1.3,  a hard-coded JWT key `PanIndex` is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, one may change the JWT key in the source code before compiling the project.
  

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/px-org/PanIndex
Files changed:
control/middleware/jwt.go
dao/db.go
Commit message: :bug:Fix login security issues


Vulnerable code:
		Key:         []byte("PanIndex"),

Fixed code:
		Key:         []byte(module.GloablConfig.JwtSignKey),
	{"jwt_sign_key", uuid.NewV4().String(), "common"},
CVE-2020-4062 (Unknown, published 2020-06-22T16:15Z)
Description: value: In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open port. This allows an attacker to gain full read & write access to the Conjur Postgres database, including escalating the attacker's privileges to assume full control. A malicious actor who knows the IP address and port number of the Postgres database and has access into the Kubernetes cluster where Conjur runs can gain full read & write access to the Postgres database. This enables the attacker to write a policy that allows full access to retrieve any secret. This Helm chart is a method to install Conjur OSS into a Kubernetes environment. Hence, the systems impacted are only Conjur OSS systems that were deployed using this chart. Other deployments including Docker and the CyberArk Dynamic Access Provider (DAP) are not affected. To remediate this vulnerability, clone the latest Helm Chart and follow the upgrade instructions. If you are not able to fully remediate this vulnerability immediately, you can mitigate some of the risk by making sure Conjur OSS is deployed on an isolated Kubernetes cluster or namespace. The term "isolated" refers to: - No other workloads besides Conjur OSS and its backend database are running in that Kubernetes cluster/namespace. - Kubernetes and helm access to the cluster/namespace is limited to security administrators via Role-Based Access Control (RBAC).
Severity: HIGH (CVSS v3 base score: 9)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/cyberark/conjur-oss-helm-chart
Files changed:
Commit message: Merge pull request from GHSA-mg2m-623j-wpxw

Adds postgres password configuration

Vulnerable code:

Fixed code:
CVE-2021-3794 (JavaScript, published 2021-09-15T13:15Z)
Description: value: vuelidate is vulnerable to Inefficient Regular Expression Complexity
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/vuelidate/vuelidate
Files changed:
packages/validators/src/raw/__tests__/url.spec.js
packages/validators/src/raw/url.js
Commit message: fix(validators): update the url validator, to reduce potential ReDos attacks (#933)



Vulnerable code:
    "http://-.~_!$&'()*+,;=:%40:80%2f::::::@example.com",
    'http://www.foo.bar./',
  correctUrls.forEach((urlString) => {
    it(`should validate correct url ${urlString}`, () => {
      expect(url(urlString)).toBe(true)
    })
  incorrectUrls.forEach((urlString) => {
    it(`should not validate incorrect url ${urlString}`, () => {
      expect(url(urlString)).toBe(false)
    })
const urlRegex = /^(?:(?:https?|ftp):\/\/)(?:\S+(?::\S*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,})))(?::\d{2,5})?(?:[/?#]\S*)?$/i

Fixed code:
    /** domains ending with a dot at the end are valid, {@see http://www.dns-sd.org/trailingdotsindomainnames.html} */
    'http://www.foo.bar./',
    'http://www.foo.bar.',
    'http://foo.bar.',
    'http://foo.bar./',
    'http://-.~_!$&\'()*+,;=:%40:80%2f::::::@example.com',
  it.each(correctUrls)('should validate correct url %s', (urlString) => {
    expect(url(urlString)).toBe(true)
  it.each(incorrectUrls)('should not validate incorrect url %s', (urlString) => {
    expect(url(urlString)).toBe(false)
/**
 * Regex taken from {@link https://gist.github.com/dperini/729294}
 */
const urlRegex = /^(?:(?:(?:https?|ftp):)?\/\/)(?:\S+(?::\S*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)+(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/i