hitoshura25/cvefixes huggingface dataset:
CVE-2021-3027 (Python, published 2021-03-26T03:16Z)
Description: value: app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided search filter because user input gets no sanitization.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/LibrIT/passhport
Files changed:
passhportd/app/views_mod/user/user.py
Commit message: Update user.py

Double check on bind from user input in case of external access of the function

Vulnerable code:
                    "(" + config.LDAPFIELD + "=" + login + ")") :
    uid = useruid(s, login)

Fixed code:
                    "(" + config.LDAPFIELD + "=" + escape_rdn(login) + ")") :
    uid = useruid(s, escape_rdn(login))
CVE-2021-4275 (HTML, published 2022-12-21T22:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is 974f21aa1b2527ef39c8afe1a5060548217deca8. It is recommended to apply a patch to fix this issue. VDB-216498 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/katlings/pyambic-pentameter
Files changed:
app.py
templates/custom.html
templates/custom_poem.html
templates/generate.html
Commit message: haha actually use csrf


Vulnerable code:
app.config.update(WTF_CSRF_ENABLED=False)

Fixed code:
import os
SECRET_KEY = os.urandom(32)
app.config['SECRET_KEY'] = SECRET_KEY
          {{ form.csrf_token }}
          {{ form.csrf_token }}
              {{ form.csrf_token }}
CVE-2023-48183 (C, published 2024-04-23T07:15Z)
Description: value: QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bellard/quickjs
Files changed:
quickjs.c
Commit message: fixed lexical scope of 'this' with eval (github issue #192)


Vulnerable code:
                                    TRUE, i, vd->var_name, FALSE, FALSE,
                                    JS_VAR_NORMAL);
                                    FALSE, i, vd->var_name, FALSE, FALSE,
                                    JS_VAR_NORMAL);
                                    FALSE, i, vd->var_name, FALSE, FALSE,
                                    JS_VAR_NORMAL);

Fixed code:
            /* XXX: propagate is_const and var_kind too ? */
                                    TRUE, i, vd->var_name, FALSE,
                                    vd->is_lexical, JS_VAR_NORMAL);
                                    FALSE, i, vd->var_name, FALSE,
                                    vd->is_lexical, JS_VAR_NORMAL);
                                    FALSE, i, vd->var_name, FALSE,
                                    vd->is_lexical, JS_VAR_NORMAL);
CVE-2022-30688 (Perl, published 2022-05-17T19:15Z)
Description: value: needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/liske/needrestart
Files changed:
perl/lib/NeedRestart/Interp/Perl.pm
perl/lib/NeedRestart/Interp/Python.pm
perl/lib/NeedRestart/Interp/Ruby.pm
Commit message: [Interp] CVE-2022-30688: Anchor interpreter regex to prevent local privilege escalation (reported by Jakub Wilk).


Vulnerable code:
    return 1 if($bin =~ m@/usr/(local/)?bin/perl@);
    return 1 if($bin =~ m@/usr/(local/)?bin/python@);
    return 1 if($bin =~ m@/usr/(local/)?bin/ruby@);

Fixed code:
    return 1 if($bin =~ m@^/usr/(local/)?bin/perl(5[.\d]*)?$@);
    return 1 if($bin =~ m@^/usr/(local/)?bin/python([23][.\d]*)?$@);
    return 1 if($bin =~ m@^/usr/(local/)?bin/ruby$@);
CVE-2024-1163 (JSON, published 2024-02-13T15:15Z)
Description: value: Uncontrolled Resource Consumption in GitHub repository mbloch/mapshaper prior to 0.6.44.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mbloch/mapshaper
Files changed:
CHANGELOG.md
REFERENCE.md
bin/mapshaper-gui
package-lock.json
package.json
Commit message: v0.6.44


Vulnerable code:
This documentation applies to version 0.6.39 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
    if (uri == '/close') {
      serveError("404 Not Found\n", 404, response);
  "version": "0.6.43",
      "version": "0.6.43",
  "version": "0.6.43",

Fixed code:
v0.6.44
* Added -style css= option for adding inline CSS to SVG symbols.
* Bug fixes

This documentation applies to version 0.6.43 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
`css=`             Inline CSS to use as the `style=` attribute of each SVG symbol.

    if (uri.includes('..')) {
      // block attempts to load files outside webroot
      serve404(response);
    } else if (uri == '/close') {
function serve404(response) {
  serveError("404 Not Found\n", 404, response);
}

      serve404(response);
  "version": "0.6.44",
      "version": "0.6.44",
  "version": "0.6.44",
CVE-2021-3934 (Other, published 2021-11-12T12:15Z)
Description: value: ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/ohmyzsh/ohmyzsh
Files changed:
lib/functions.zsh
Commit message: fix(lib): fix `omz_urldecode` unsafe eval bug

The `omz_urldecode` function uses an eval to decode the input which can be
exploited to inject commands. This is used only in the svn plugin and it
requires a complex process to exploit, so it is highly unlikely to have been
used by an attacker.


Vulnerable code:
  local decoded
  eval "decoded=\$'$tmp'"
  local safe_encodings

Fixed code:
  local decoded="$(printf -- "$tmp")"
  local -a safe_encodings
CVE-2020-8498 (PHP, published 2020-01-30T23:15Z)
Description: value: XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bradyvercher/gistpress
Files changed:
includes/class-gistpress.php
Commit message: Sanitize the shortcode id attribute.


Vulnerable code:

Fixed code:
		$attr['id']                = preg_replace( '/[^a-z0-9]+/i', '', $attr['id'] );
CVE-2017-11173 (Ruby, published 2017-07-13T03:29Z)
Description: value: Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cyu/rack-cors
Files changed:
lib/rack/cors.rb
Commit message: Add end string anchor to string origin def

Build regex with end string anchor when string is used to configure
origin

[Fixes #86]


Vulnerable code:
            else                  Regexp.compile("^[a-z][a-z0-9.+-]*:\\\/\\\/#{Regexp.quote(n)}")

Fixed code:
            else                  Regexp.compile("^[a-z][a-z0-9.+-]*:\\\/\\\/#{Regexp.quote(n)}$")
CVE-2019-18978 (Ruby, published 2019-11-14T21:15Z)
Description: value: An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/cyu/rack-cors
Files changed:
CHANGELOG.md
lib/rack/cors.rb
lib/rack/cors/version.rb
test/unit/cors_test.rb
test/unit/test.ru
Commit message: Unescape and resolve paths before resource checks

Fix scenario where someone could use '../' to access private resources


Vulnerable code:
          headers = process_preflight(env)
          add_headers = process_cors(env)
      vary_resource = resource_for_path(env[PATH_INFO])
      def process_preflight(env)
        resource, error = match_resource(env)
      def process_cors(env)
        resource, error = match_resource(env)
      def match_resource(env)
        path   = env[PATH_INFO]
    VERSION = "1.0.3"

Fixed code:
## 1.0.4 - 2019-11-13
### Security
- Escape and resolve path before evaluating resource rules (thanks to Colby Morgan)

      path = evaluate_path(env)

            "  Path-Info: #{path}",
          headers = process_preflight(env, path)
          add_headers = process_cors(env, path)
      vary_resource = resource_for_path(path)
      def evaluate_path(env)
        path = env[PATH_INFO]
        path = Rack::Utils.clean_path_info(Rack::Utils.unescape_path(path)) if path
        path
      end

      def process_preflight(env, path)
        resource, error = match_resource(path, env)
      def process_cors(env, path)
        resource, error = match_resource(path, env)
      def match_resource(path, env)
    VERSION = "1.0.4"
  it "decode URL and resolve paths before resource matching" do
    header 'Origin', 'http://localhost:3000'
    get '/public/a/..%2F..%2Fprivate/stuff'
    last_response.wont_render_cors_success
  end

    resource '/public/*'
CVE-2022-1236 (Unknown, published 2022-04-05T09:15Z)
Description: value: Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/weseek/growi
Files changed:
Commit message: Merge pull request #5630 from weseek/imprv/extend-minimum-password-length

fix: Displaying minimum length of password

Vulnerable code:

Fixed code:
CVE-2021-3804 (TypeScript, published 2021-09-17T07:15Z)
Description: value: taro is vulnerable to Inefficient Regular Expression Complexity
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/nervjs/taro
Files changed:
packages/taro-helper/src/constants.ts
Commit message: Security fix for ReDoS

Fixed Regular Expression Denial of Service vulnerability in url validation

Vulnerable code:
export const REG_URL = /^(?:(?:(?:https?|ftp):)?\/\/)(?:\S+(?::\S*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,}))\.?)(?::\d{2,5})?(?:[/?#]\S*)?$/i

Fixed code:
export const REG_URL = /^(?:(?:(?:https?|ftp):)?\/\/)(?:\S+(?::\S*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)+(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/i
CVE-2019-25093 (PHP, published 2023-01-02T11:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in dragonexpert Recent Threads on Index. Affected is the function recentthread_list_threads of the file inc/plugins/recentthreads/hooks.php of the component Setting Handler. The manipulation of the argument recentthread_forumskip leads to cross site scripting. It is possible to launch the attack remotely. The patch is identified as 051465d807a8fcc6a8b0f4bcbb19299672399f48. It is recommended to apply a patch to fix this issue. VDB-217182 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dragonexpert/recentthreads
Files changed:
inc/plugins/recentthreads/hooks.php
Commit message: Update hooks.php

Fixes a low risk XSS vulnerability.  Classified as low risk due to needing access to ACP->Config.

Vulnerable code:
        $ignoreforums = " AND t.fid NOT IN(" . $mybb->settings['recentthread_forumskip'] . ") ";

Fixed code:
        $ignoreforums = " AND t.fid NOT IN(" . htmlspecialchars($mybb->settings['recentthread_forumskip']) . ") ";
CVE-2016-6829 (Unknown, published 2016-12-09T20:59Z)
Description: value: The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/crowbar/crowbar-openstack
Files changed:
Commit message: Merge pull request #485 from s-t-e-v-e-n-k/trove-random-password

Set the trove service password to random

Vulnerable code:

Fixed code:
CVE-2022-25050 (C, published 2022-03-02T00:15Z)
Description: value: rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/merbanan/rtl_433
Files changed:
src/devices/cmr113.c
src/devices/somfy_iohc.c
Commit message: minor: Fix overflow in Clipsal-CMR113 and Somfy-IOHC reported by aug5t7


Vulnerable code:
#define COMPARE_BITS 83
#define COMPARE_BYTES (COMPARE_BITS/8)
    int offset = bitbuffer_search(bitbuffer, 0, 0, preamble_pattern, 24) + 24;
    if (offset >= bitbuffer->bits_per_row[0] - 19 * 10)
    int num_bits = bitbuffer->bits_per_row[0] - offset;
    bitrow_printf(b, len * 8, "%s: offset %d, num_bits %d, len %d, msg_len %d\n", __func__, offset, num_bits, len, msg_len);

Fixed code:
#define COMPARE_BITS  83
#define COMPARE_BYTES ((COMPARE_BITS + 7) / 8)
    unsigned offset = bitbuffer_search(bitbuffer, 0, 0, preamble_pattern, 24) + 24;
    if (offset + 19 * 10 >= bitbuffer->bits_per_row[0])
    unsigned num_bits = bitbuffer->bits_per_row[0] - offset;
    num_bits = MIN(num_bits, sizeof (b) * 8);
    bitrow_printf(b, len * 8, "%s: offset %u, num_bits %u, len %d, msg_len %d\n", __func__, offset, num_bits, len, msg_len);
CVE-2022-25051 (C, published 2022-03-02T00:15Z)
Description: value: An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/merbanan/rtl_433
Files changed:
src/devices/cmr113.c
src/devices/somfy_iohc.c
Commit message: minor: Fix overflow in Clipsal-CMR113 and Somfy-IOHC reported by aug5t7


Vulnerable code:
#define COMPARE_BITS 83
#define COMPARE_BYTES (COMPARE_BITS/8)
    int offset = bitbuffer_search(bitbuffer, 0, 0, preamble_pattern, 24) + 24;
    if (offset >= bitbuffer->bits_per_row[0] - 19 * 10)
    int num_bits = bitbuffer->bits_per_row[0] - offset;
    bitrow_printf(b, len * 8, "%s: offset %d, num_bits %d, len %d, msg_len %d\n", __func__, offset, num_bits, len, msg_len);

Fixed code:
#define COMPARE_BITS  83
#define COMPARE_BYTES ((COMPARE_BITS + 7) / 8)
    unsigned offset = bitbuffer_search(bitbuffer, 0, 0, preamble_pattern, 24) + 24;
    if (offset + 19 * 10 >= bitbuffer->bits_per_row[0])
    unsigned num_bits = bitbuffer->bits_per_row[0] - offset;
    num_bits = MIN(num_bits, sizeof (b) * 8);
    bitrow_printf(b, len * 8, "%s: offset %u, num_bits %u, len %d, msg_len %d\n", __func__, offset, num_bits, len, msg_len);
CVE-2024-31221 (C++, published 2024-04-08T15:15Z)
Description: value: Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the issue. As a workaround, restarting Sunshine after unpairing all devices prevents the vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/LizardByte/Sunshine
Files changed:
src/crypto.cpp
src/crypto.h
src/nvhttp.cpp
Commit message: fix(security): ensure unpairing takes effect without restart (#2365)



Vulnerable code:
    crypto::cert_chain_t cert_chain;
    // /resume doesn't always get the parameter "localAudioPlayMode"
    // /launch will store it in host_audio
    https_server.verify = [&cert_chain, add_cert](SSL *ssl) {

Fixed code:
  void
  cert_chain_t::clear() {
    _certs.clear();
  }
    void
    clear();

  crypto::cert_chain_t cert_chain;

    // resume doesn't always get the parameter "localAudioPlayMode"
    // launch will store it in host_audio
    https_server.verify = [add_cert](SSL *ssl) {
    cert_chain.clear();
CVE-2024-31226 (C++, published 2024-05-16T19:15Z)
Description: value: Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\Program.exe`, `C:\Program.bat`, or `C:\Program.cmd` on the user's computer. This attack vector isn't exploitable unless the user has manually loosened ACLs on the system drive. If the user's system locale is not English, then the name of the executable will likely vary. Version 0.23.0 contains a patch for the issue. Some workarounds are available. One may identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate. Alternatively, ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory `C:`. Require that all executables be placed in write-protected directories.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/LizardByte/Sunshine
Files changed:
tools/sunshinesvc.cpp
Commit message: Quote the path to sunshinesvc.exe when launching the termination helper (#2379)



Vulnerable code:
  std::wstring command { module_path };
        NULL,

Fixed code:
  std::wstring command;
  command += L'"';
  command += module_path;
  command += L'"';
        module_path,
CVE-2018-1000165 (PHP, published 2018-04-18T19:29Z)
Description: value: LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/lightSAML/lightSAML
Files changed:
src/LightSaml/Model/XmlDSig/AbstractSignatureReader.php
Commit message: Check for supported signature algorithms


Vulnerable code:
                    return;

Fixed code:
                    return null;

        if (!in_array($algorithm, [
            XMLSecurityKey::RSA_SHA1,
            XMLSecurityKey::RSA_SHA256,
            XMLSecurityKey::RSA_SHA384,
            XMLSecurityKey::RSA_SHA512,
        ])) {
            throw new LightSamlSecurityException(sprintf('Unsupported signing algorithm: "%s"', $algorithm));
        }