hitoshura25/cvefixes huggingface dataset:
CVE-2019-3561 (PHP, published 2019-04-29T16:29Z)
Description: value: Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versions of HHVM (4.0.3, 3.30.4, and 3.27.7 and below).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/base/zend-string.cpp
hphp/test/slow/ext_string/ext_string.php
hphp/test/slow/ext_string/ext_string.php.expectf
Commit message: Prevent strrpos and strripos from visiting out-of-bounds memory.

Reviewed By: alexeyt

Differential Revision: D14669668

fbshipit-source-id: 16bb4674bccf83ffd737e60d1fd9fd4a0093f77c


Vulnerable code:
      ptr = bstrrstr(input, len + pos + s_len, s, s_len);
      ptr = bstrrcasestr(input, len + pos + s_len, s, s_len);

Fixed code:
#include <algorithm>
      ptr = bstrrstr(input, len + std::min(pos + s_len, 0), s, s_len);
      ptr = bstrrcasestr(input, len + std::min(pos + s_len, 0), s, s_len);
var_dump(strrpos("abc", "c\0", -1));
var_dump(strripos("abc", "c\0", -1));
var_dump(strrpos("abc", "abc", -3));
var_dump(strripos("abc", "abc", -3));
var_dump(strrpos("aaaa", "aa", -1));
var_dump(strripos("aaaa", "aa", -1));
var_dump(strrpos("aaaa", "aa", -2));
var_dump(strripos("aaaa", "aa", -2));

bool(false)
bool(false)
int(0)
int(0)
int(2)
int(2)
int(2)
int(2)
CVE-2019-3569 (PHP, published 2019-06-26T15:15Z)
Description: value: HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/server/fastcgi/fastcgi-server.cpp
hphp/test/server/debugger/tests/runTest1.php
hphp/test/server/fastcgi/tests/authDigestTest.php
hphp/test/server/fastcgi/tests/disable_ini_zend_compat.php
hphp/test/server/fastcgi/tests/global_variables_server.php
hphp/test/server/fastcgi/tests/headerTest.php
hphp/test/server/fastcgi/tests/httpsTest.php
hphp/test/server/fastcgi/tests/invalid.php
hphp/test/server/util/server_tests.inc
Commit message: Fix default FastCGI interface

Reviewed By: alexeyt

Differential Revision: D15567393

fbshipit-source-id: ffab228f689d4ddca9ea4835c70aecf16da2aa9f


Vulnerable code:
    sock_addr.setFromLocalPort(port);
  $url = "http://".php_uname('n').':'.$serverPort.'/test1.php';
  request(php_uname('n'), $serverPort, 'test1.php', 10); // ignore response
  var_dump(request(php_uname('n'), $serverPort, "test_auth_digest.php",
  var_dump(request(php_uname('n'), $serverPort, "test_auth_digest.php",
  echo request(php_uname('n'), $port, 'test_disable_ini_zend_compat.php');
    echo request(php_uname('n'), $port, $path, $post, $headers, $extra) . "\n";
  var_dump(request(php_uname('n'), $serverPort, "test_headers.php",
  var_dump(request(php_uname('n'), $serverPort, "test_https.php",
  $host = php_uname('n');
  $host = php_uname('n');
    $r = request(php_uname('n'), $adminPort, 'stop?instance-id='.$test_run_id);
  $host_name = "hphpd.debugger.".php_uname('n');
        var_dump(request(php_uname('n'), $serverPort, $request));

Fixed code:
    sock_addr.setFromHostPort("localhost", port);
    assert(sock_addr.isLoopbackAddress());
  request('localhost', $serverPort, 'test1.php', 10); // ignore response
  var_dump(request('localhost', $serverPort, "test_auth_digest.php",
  var_dump(request('localhost', $serverPort, "test_auth_digest.php",
  echo request('localhost', $port, 'test_disable_ini_zend_compat.php');
    echo request('localhost', $port, $path, $post, $headers, $extra) . "\n";
  var_dump(request('localhost', $serverPort, "test_headers.php",
  var_dump(request('localhost', $serverPort, "test_https.php",
  $host = 'localhost';
  $host = 'localhost';
    $r = request('localhost', $adminPort, 'stop?instance-id='.$test_run_id);
  $host_name = "hphpd.debugger.".\php_uname('n');
        var_dump(request('localhost', $serverPort, $request));
CVE-2020-1888 (C++, published 2020-03-03T15:15Z)
Description: value: Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/ext/json/JSON_parser.cpp
Commit message: Fix buffer overrun in SimpleParser::handleBackslash

Summary:
It read 4 chars, then checked for validity, but any of them could have
been the end of the string, so check after each one instead.

Reviewed By: oulgen

Differential Revision: D19611163

fbshipit-source-id: 3da0a39555cb85a93f4fd98048368f17cf37e2e4


Vulnerable code:
          if (UNLIKELY(ch1 != '0' || ch2 != '0' || dch3 < 0 || dch4 < 0)) {
            return false;
          }

Fixed code:
          if (UNLIKELY(ch1 != '0')) return false;
          if (UNLIKELY(ch2 != '0')) return false;
          if (UNLIKELY(dch3 < 0)) return false;
          if (UNLIKELY(dch4 < 0)) return false;
CVE-2020-1892 (C++, published 2020-03-03T15:15Z)
Description: value: Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to information leak and DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/ext/json/JSON_parser.cpp
Commit message: Fix a json_decode crash when depth==0

Summary:
Setting depth=0 is an error, and should result in NULL, but we weren't
checking for it, so in the case of a single, top-level string, we
would reading the -1th element of the stack.

Differential Revision: D19609959

fbshipit-source-id: 04ca1e0965e04b44df2d5c806a73c3da99ff66fb


Vulnerable code:

Fixed code:
  if (depth <= 0) {
    json->error_code = json_error_codes::JSON_ERROR_DEPTH;
    return false;
  }
CVE-2020-1893 (C++, published 2020-03-03T15:15Z)
Description: value: Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/ext/json/JSON_parser.cpp
Commit message: Fix a buffer-overrun in SimpleParser

Summary: In the failure case, we might have already consumed the entire string.

Reviewed By: binliu19, ottoni

Differential Revision: D19610775

fbshipit-source-id: d387df15994a310f5a31cfbb5fa11679997f7ae7


Vulnerable code:
    parser.skipSpace();
    if (!ok || parser.p != inp + length) {

Fixed code:
    if (!ok ||
        (parser.skipSpace(), parser.p != inp + length)) {
CVE-2020-1899 (PHP, published 2021-03-11T01:15Z)
Description: value: The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/base/variable-unserializer.cpp
hphp/test/slow/serialization/no-apc-string-pointer.php
hphp/test/slow/serialization/no-apc-string-pointer.php.expectf
Commit message: CVE-2020-1899

VariableUnserializer should only recognize type 'S' in APCSerialization mode


Vulnerable code:
  if (*p == 'S') {

Fixed code:
  if (*p == 'S' && type() == VariableUnserializer::Type::APCSerialize) {
<?hh
// Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved.

class Foo {
  public $name;
}

<<__EntryPoint>>
function main() {
  var_dump(unserialize("O:3:\"foo\":1:{S:\x00\x00\x00\x00\x00\x00\x00\x00;s:5:\"value\";}"));
}
Notice: Unable to unserialize: [O:3:"foo":1:{S:]. Unknown type 'S'. in %s/no-apc-string-pointer.php on line 10
bool(false)
CVE-2020-1900 (C++, published 2021-03-11T01:15Z)
Description: value: When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/base/object-data.cpp
hphp/runtime/base/variable-unserializer.cpp
Commit message: CVE-2020-1900

Pre-reserve object dynamic properties when unserializing


Vulnerable code:

Fixed code:
  auto const allocsz = MixedArray::computeAllocBytesFromMaxElms(numDynamic);
  if (UNLIKELY(allocsz > kMaxSmallSize && tl_heap->preAllocOOM(allocsz))) {
    check_non_safepoint_surprise();
  }

    obj->reserveDynProps(nProp);
CVE-2022-36937 (C++, published 2023-05-10T19:15Z)
Description: value: HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3.

Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/base/ssl-socket.cpp
Commit message: [security] Disable TLS 1.0 in stream extension URLs

The stream extension has the functions `stream_socket_server` and
`stream_socket_client` which accept URLs. When a URL starts with
`tls://` it would previously allow TLS 1.0 connections.

TLS 1.0 is deprecated and considered insecure.


Vulnerable code:
    smethod = TLSv1_client_method();
    smethod = TLSv1_server_method();

Fixed code:
    smethod = TLS_client_method();
    smethod = TLS_server_method();
CVE-2023-26132 (JavaScript, published 2023-06-10T05:15Z)
Description: value: Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/mickhansen/dottie.js
Files changed:
README.md
dottie.js
test/set.test.js
test/transform.test.js
Commit message: rudimentary __proto__ guarding


Vulnerable code:

Fixed code:

If you accept arbitrary/user-defined paths to `set` you should call `Object.preventExtensions(values)` first to guard against potential pollution.

    if (pieces[0] === '__proto__') return;

        if (pieces[0] === '__proto__') break;


  it('should not attempt to set __proto__', function () {
    var data = {};

    dottie.set(data, '__proto__.pollution', 'polluted');

    expect(data.__proto__.pollution).to.be.undefined;
  });

  it("should guard against prototype pollution", function () {
    var values = {
      'user.name': 'John Doe',
      '__proto__.pollution': 'pollution'
    };

    var transformed = dottie.transform(values);
    expect(transformed.user).not.to.equal(undefined);
    expect(transformed.user.name).to.equal('John Doe');
    expect(transformed.__proto__.pollution).to.be.undefined;
  });
CVE-2016-7405 (PHP, published 2016-10-03T18:59Z)
Description: value: The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ADOdb/ADOdb
Files changed:
drivers/adodb-pdo.inc.php
Commit message: PDO: fix incorrect quoting allowing SQL injection

The PDO driver was relying on ADOConnection::qstr() for quoting strings.
An application relying on qstr() to manually prepare SQL statements
rather than using parameterized queries may be vulnerable to SQL
injection attacks, as demonstrated by @jdavidlists.

This commit delegates string quoting to PDO::quote() when a connection
is available. If not, it simply replaces single quotes by the value of
$replaceQuote property.

Fixes #226


Vulnerable code:

Fixed code:

	/**
	 * Quotes a string to be sent to the database.
	 * If we have an active connection, delegates quoting to the underlying
	 * PDO object. Otherwise, replace "'" by the value of $replaceQuote (same
	 * behavior as mysqli driver)
	 * @param string  $s            The string to quote
	 * @param boolean $magic_quotes If false, use PDO::quote().
	 * @return string Quoted string
	 */
	function qstr($s, $magic_quotes = false)
	{
		if (!$magic_quotes) {
			if ($this->_connectionID) {
				return $this->_connectionID->quote($s);
			}
			return "'" . str_replace("'", $this->replaceQuote, $s) . "'";
		}

		// undo magic quotes for "
		$s = str_replace('\\"', '"', $s);
		return "'$s'";
	}
CVE-2021-43778 (PHP, published 2021-11-24T19:15Z)
Description: value: Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pluginsGLPI/barcode
Files changed:
front/send.php
Commit message: die on insecure file request, fix #85


Vulnerable code:

Fixed code:
      exit;
CVE-2020-7688 (JavaScript, published 2020-07-01T17:15Z)
Description: value: The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/mikaelbr/mversion
Files changed:
lib/git.js
Commit message: Fix Remote Command Execution


Vulnerable code:
        [gitApp, "tag", "-a", tagName, "-m", message].join(" "),

Fixed code:
        [gitApp, "tag", "-a", escapeQuotes(tagName), "-m", message].join(" "),
CVE-2013-1944 (C, published 2013-04-29T22:55Z)
Description: value: The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/bagder/curl
Files changed:
lib/cookie.c
Commit message: cookie: fix tailmatching to prevent cross-domain leakage

Cookies set for 'example.com' could accidentaly also be sent by libcurl
to the 'bexample.com' (ie with a prefix to the first domain name).

This is a security vulnerabilty, CVE-2013-1944.

Bug: http://curl.haxx.se/docs/adv_20130412.html


Vulnerable code:
static bool tailmatch(const char *little, const char *bigone)
  size_t littlelen = strlen(little);
  size_t biglen = strlen(bigone);
  if(littlelen > biglen)
  return Curl_raw_equal(little, bigone+biglen-littlelen) ? TRUE : FALSE;

Fixed code:
static bool tailmatch(const char *cooke_domain, const char *hostname)
  size_t cookie_domain_len = strlen(cooke_domain);
  size_t hostname_len = strlen(hostname);
  if(hostname_len < cookie_domain_len)
  if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len))
    return FALSE;

  /* A lead char of cookie_domain is not '.'.
     RFC6265 4.1.2.3. The Domain Attribute says:
       For example, if the value of the Domain attribute is
       "example.com", the user agent will include the cookie in the Cookie
       header when making HTTP requests to example.com, www.example.com, and
       www.corp.example.com.
   */
  if(hostname_len == cookie_domain_len)
    return TRUE;
  if('.' == *(hostname + hostname_len - cookie_domain_len - 1))
    return TRUE;
  return FALSE;
CVE-2013-2174 (C, published 2013-07-31T13:20Z)
Description: value: Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/bagder/curl
Files changed:
lib/escape.c
Commit message: Curl_urldecode: no peeking beyond end of input buffer

Security problem: CVE-2013-2174

If a program would give a string like "%FF" to curl_easy_unescape() but
ask for it to decode only the first byte, it would still parse and
decode the full hex sequence. The function then not only read beyond the
allowed buffer but it would also deduct the *unsigned* counter variable
for how many more bytes there's left to read in the buffer by two,
making the counter wrap. Continuing this, the function would go on
reading beyond the buffer and soon writing beyond the allocated target
buffer...

Bug: http://curl.haxx.se/docs/adv_20130622.html
Reported-by: Timo Sirainen


Vulnerable code:
 * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
    if(('%' == in) && ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {

Fixed code:
 * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
    if(('%' == in) && (alloc > 2) &&
       ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
CVE-2022-3975 (PHP, published 2022-11-13T10:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.5 is able to address this issue. The name of the patch is 0b3197fad950bb3383e83039a8ee4c9509b3ce02. It is recommended to upgrade the affected component. VDB-213554 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/nukeviet/nukeviet
Files changed:
vendor/vinades/nukeviet/Core/Request.php
Commit message: Tiếp tục fix lỗi XSS


Vulnerable code:
                if (preg_match('/^[\r\n\s\t]*d\s*a\s*t\s*a\s*\:([^\,]*?)\;*(base64)*?[\r\n\s\t]*\,[\r\n\s\t]*(.*?)[\r\n\s\t]*$/isu', $attrSubSet[1], $m)) {
                $value = $this->unhtmlentities($attrSubSet[1]);
        $source = preg_replace('/\<script([^\>]*)\>(.*)\<\/script\>/isU', '', $source, -1, $checkInvalid);
        while (preg_match('/\<script([^\>]*)\>(.*)\<\/script\>/isU', $preTag)) {

Fixed code:
                $value = $this->unhtmlentities($attrSubSet[1]);

                if (preg_match('/^[\r\n\s\t]*d\s*a\s*t\s*a\s*\:([^\,]*?)\;*[\r\n\s\t]*(base64)*?[\r\n\s\t]*\,[\r\n\s\t]*(.*?)[\r\n\s\t]*$/isu', $value, $m)) {
                if (preg_replace('/\<\s*s\s*c\s*r\s*i\s*p\s*t([^\>]*)\>(.*)\<\s*\/\s*s\s*c\s*r\s*i\s*p\s*t\s*\>/isU', '', $value)) {
                    continue;
                }

        $source = preg_replace('/\<\s*s\s*c\s*r\s*i\s*p\s*t([^\>]*)\>(.*)\<\s*\/\s*s\s*c\s*r\s*i\s*p\s*t\s*\>/isU', '', $source, -1, $checkInvalid);
        while (preg_match('/\<\s*s\s*c\s*r\s*i\s*p\s*t([^\>]*)\>(.*)\<\s*\/\s*s\s*c\s*r\s*i\s*p\s*t\>/isU', $preTag)) {