mcanoglu/cwe-class-group huggingface dataset:
it 'correctly exports the CategoryUser table' do
      data, _csv_out = make_component_csv

      expect(data.find { |r| r['category_id'] == category.id }).to be_nil
      expect(data.length).to eq(4)
      data.sort! { |a, b| a['category_id'].to_i <=> b['category_id'].to_i }

      expect(data[0][:category_id]).to eq(subcategory.id.to_s)
      expect(data[0][:notification_level].to_s).to eq('tracking')
      expect(DateTime.parse(data[0][:dismiss_new_timestamp])).to eq(reset_at)

      expect(data[1][:category_id]).to eq(subsubcategory.id.to_s)
      expect(data[1][:category_names]).to eq("#{category.name}|#{subcategory.name}|#{subsubcategory.name}")
      expect(data[1][:notification_level]).to eq('regular')
      expect(DateTime.parse(data[1][:dismiss_new_timestamp])).to eq(reset_at)

      expect(data[2][:category_id]).to eq(announcements.id.to_s)
      expect(data[2][:category_names]).to eq(announcements.name)
      expect(data[2][:notification_level]).to eq('watching_first_post')
      expect(data[2][:dismiss_new_timestamp]).to eq('')

      expect(data[3][:category_names]).to eq(data[3][:category_id])
    end

// Vulnerability class: CWE-200
def test_update_valid
    SmartProxy.any_instance.stubs(:valid?).returns(true)
    put :update, {:id => SmartProxy.first,:smart_proxy => {:url => "http://elsewhere.com:8443"}}, set_session_user
    assert_equal "http://elsewhere.com:8443", SmartProxy.first.url
    assert_redirected_to smart_proxies_url
  end

// Vulnerability class: CWE-200
it "doesn't log in the user when not approved" do
        SiteSetting.must_approve_users = true

        get "/session/email-login/#{email_token.token}"

        expect(response.status).to eq(200)

        expect(CGI.unescapeHTML(response.body)).to include(
          I18n.t("login.not_approved")
        )
      end

// Vulnerability class: CWE-287
it "requires an account with mail" do
      user = FactoryGirl.create(:user)
      get :index, {}, set_session_user.merge(:user => user.id)
      assert_response :redirect
      assert_redirected_to edit_user_path(user)
      assert_equal "An email address is required, please update your account details", flash[:error]
    end

// Vulnerability class: CWE-200
it "allows you to create an account and redeems the invite successfully even if must_approve_users is enabled" do
        SiteSetting.must_approve_users = true

        login_with_sso_and_invite

        expect(response.status).to eq(302)
        expect(response).to redirect_to("/")
        expect(invite.reload.redeemed?).to eq(true)

        user = User.find_by_email("bob@bob.com")
        expect(user.active).to eq(true)
      end

// Vulnerability class: CWE-863
def initialize(remote_host, remote_port, local_host = nil, local_port = nil)
    if Thread.current[:private_address_check] && PrivateAddressCheck.resolves_to_private_address?(remote_host)
      raise PrivateAddressCheck::PrivateConnectionAttemptedError
    end

    initialize_without_private_address_check(remote_host, remote_port, local_host, local_port)
  end

// Vulnerability class: CWE-362
it "updates a hostgroup with a parent parameter" do
      child = FactoryGirl.create(:hostgroup, :parent => @base)
      as_admin do
        assert_equal "original", child.parameters["x"]
      end
      post :update, {"id" => child.id, "hostgroup" => {"name" => child.name,
                                                       :group_parameters_attributes => {"0" => {:name => "x", :value =>"overridden", :_destroy => ""}}}}, set_session_user
      assert_redirected_to hostgroups_url
      child.reload
      assert_equal "overridden", child.parameters["x"]
    end

// Vulnerability class: CWE-200
def build_query(path, details)
      query = @pattern.dup
      query.gsub!(/\:prefix(\/)?/, path.prefix.empty? ? "" : "#{path.prefix}\\1") # prefix can be empty...
      query.gsub!(/\:action/, path.partial? ? "_#{path.name}" : path.name)

      details.each do |ext, variants|
        query.gsub!(/\:#{ext}/, "{#{variants.compact.uniq.join(',')}}")
      end

      File.expand_path(query, @path)
    end

// Vulnerability class: CWE-20
def create_clamp_code(nbits, signed)
        if signed == :signed
          max = (1 << (nbits - 1)) - 1
          min = -(max + 1)
        else
          max = (1 << nbits) - 1
          min = 0
        end

        "val = (val < #{min}) ? #{min} : (val > #{max}) ? #{max} : val"
      end

// Vulnerability class: CWE-400
def deliver!(mail)
      envelope_from = mail.return_path || mail.sender || mail.from_addrs.first
      return_path = "-f " + '"' + envelope_from.escape_for_shell + '"' if envelope_from

      arguments = [settings[:arguments], return_path].compact.join(" ")

      self.class.call(settings[:location], arguments, mail.destinations.collect(&:shellescape).join(" "), mail)
    end

// Vulnerability class: CWE-20
def crop_command
      target = @attachment.instance

      if target.cropping?(@attachment.name)
        w = target.send :"#{@attachment.name}_crop_w"
        h = target.send :"#{@attachment.name}_crop_h"
        x = target.send :"#{@attachment.name}_crop_x"
        y = target.send :"#{@attachment.name}_crop_y"
        ["-crop", "#{w}x#{h}+#{x}+#{y}"]
      end
    end

// Vulnerability class: CWE-20
def selected_ids
    return @selected_ids if @selected_ids
    ids = default_ids_hash
    #types NOT ignored - get ids that are selected
    hash_keys.each do |col|
      ids[col] = Array(taxonomy.send(col))
    end
    #types that ARE ignored - get ALL ids for object
    Array(taxonomy.ignore_types).each do |taxonomy_type|
      ids["#{taxonomy_type.tableize.singularize}_ids"] = taxonomy_type.constantize.pluck(:id)
    end

    ids["#{opposite_taxonomy_type}_ids"] = Array(taxonomy.send("#{opposite_taxonomy_type}_ids"))
    @selected_ids                        = ids
  end

// Vulnerability class: CWE-200
def with_taxonomy_scope(loc = Location.current, org = Organization.current, inner_method = :subtree_ids)
      self.which_ancestry_method = inner_method
      self.which_location        = Location.expand(loc) if SETTINGS[:locations_enabled]
      self.which_organization    = Organization.expand(org) if SETTINGS[:organizations_enabled]
      scope = block_given? ? yield : where('1=1')
      scope = scope_by_taxable_ids(scope)
      scope.readonly(false)
    end

// Vulnerability class: CWE-200
def deliver!(mail)
      envelope_from = mail.return_path || mail.sender || mail.from_addrs.first
      return_path = "-f \"#{envelope_from.to_s.gsub('"', '\"')}\"" if envelope_from

      arguments = [settings[:arguments], return_path].compact.join(" ")

      Sendmail.call(settings[:location], arguments, mail.destinations.collect(&:shellescape).join(" "), mail)
    end

// Vulnerability class: CWE-20
it "should be created correctly" do
      invite = Fabricate(:invite, email: 'walter.white@email.com')
      user = InviteRedeemer.create_user_from_invite(invite: invite, email: invite.email, username: 'walter', name: 'Walter White')
      expect(user.username).to eq('walter')
      expect(user.name).to eq('Walter White')
      expect(user.email).to eq('walter.white@email.com')
      expect(user.approved).to eq(true)
      expect(user.active).to eq(false)
    end

// Vulnerability class: CWE-863
it "approves pending record" do
        reviewable = ReviewableUser.needs_review!(target: Fabricate(:user, email: invite.email), created_by: invite.invited_by)
        reviewable.status = Reviewable.statuses[:pending]
        reviewable.save!
        invite_redeemer.redeem

        reviewable.reload
        expect(reviewable.status).to eq(Reviewable.statuses[:approved])
      end

// Vulnerability class: CWE-863
it "should choose :file_server when the settings name is 'puppet' and no server is specified" do
        modules = mock 'modules'

        @request.expects(:protocol).returns "puppet"
        @request.expects(:server).returns nil
        Puppet.settings.expects(:value).with(:name).returns "puppet"
        @object.select_terminus(@request).should == :file_server
      end

// Vulnerability class: CWE-200
it "fails when user is suspended" do
        user.update!(
          suspended_till: 2.days.from_now,
          suspended_at: Time.zone.now
        )

        get "/session/email-login/#{email_token.token}"

        expect(response.status).to eq(200)

        expect(CGI.unescapeHTML(response.body)).to include(I18n.t("login.suspended",
          date: I18n.l(user.suspended_till, format: :date_only)
        ))
      end

// Vulnerability class: CWE-287
it 'should return a second factor prompt' do
            get "/session/email-login/#{email_token.token}"

            expect(response.status).to eq(200)

            response_body = CGI.unescapeHTML(response.body)

            expect(response_body).to include(I18n.t(
              "login.second_factor_title"
            ))

            expect(response_body).to_not include(I18n.t(
              "login.invalid_second_factor_code"
            ))
          end

// Vulnerability class: CWE-287
it "can set the password and ip_address" do
      password = 's3cure5tpasSw0rD'
      ip_address = '192.168.1.1'
      invite = Fabricate(:invite, email: 'walter.white@email.com')
      user = InviteRedeemer.create_user_from_invite(invite: invite, email: invite.email, username: 'walter', name: 'Walter White', password: password, ip_address: ip_address)
      expect(user).to have_password
      expect(user.confirm_password?(password)).to eq(true)
      expect(user.approved).to eq(true)
      expect(user.ip_address).to eq(ip_address)
      expect(user.registration_ip_address).to eq(ip_address)
    end

// Vulnerability class: CWE-863
def test_parse_bigger
    xml = <<-XML.strip_heredoc
      <request id="1027" creator="Iggy">
        <action type="submit">
          <source project="home:Iggy" package="TestPack" rev="1"/>
          <target project="kde4" package="mypackage"/>
          <options>
            <sourceupdate>cleanup</sourceupdate>
          </options>
          <acceptinfo rev="1" srcmd5="806a6e27ed7915d1bb8d8a989404fd5a" osrcmd5="d41d8cd98f00b204e9800998ecf8427e"/>
        </action>
        <priority>critical</priority>
        <state name="review" who="Iggy" when="2012-11-07T21:13:12">
          <comment>No comment</comment>
        </state>
        <review state="new" when="2017-09-01T09:11:11" by_user="adrian"/>
        <review state="new" when="2017-09-01T09:11:11" by_group="test_group"/>
        <review state="accepted" when="2012-11-07T21:13:12" who="tom" by_user="tom">
          <comment>review1</comment>
        </review>
        <review state="new" when="2012-11-07T21:13:13" who="tom" by_user="tom">
          <comment>please accept</comment>
        </review>
        <description>Left blank</description>
      </request>
    XML
    req = BsRequest.new_from_xml(xml)
    req.save!
    # number got increased by one
    assert_equal 1027, req.number

    newxml = req.render_xml
    assert_equal xml, newxml

    wi = req.webui_infos(diffs: false)
    # iggy is *not* target maintainer
    assert_equal false, wi['is_target_maintainer']
    assert_equal wi['actions'][0], type: :submit,
                                   sprj: 'home:Iggy',
                                   spkg: 'TestPack',
                                   srev: '1',
                                   tprj: 'kde4',
                                   tpkg: 'mypackage',
                                   name: 'Submit TestPack'
  end

// Vulnerability class: CWE-862
def execute(op)
      mode = options[:consistency] == :eventual ? :read : :write
      socket = socket_for(mode)

      if safe?
        last_error = Protocol::Command.new(
          "admin", { getlasterror: 1 }.merge(safety)
        )

        socket.execute(op, last_error).documents.first.tap do |result|
          raise Errors::OperationFailure.new(
            op, result
          ) if result["err"] || result["errmsg"]
        end
      else
        socket.execute(op)
      end
    end

// Vulnerability class: CWE-400
def test_jail_instances_should_have_limited_methods
    expected = ["class", "inspect", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
    expected.delete('respond_to_missing?') if RUBY_VERSION > '1.9.3' # respond_to_missing? is private in rubies above 1.9.3
    objects.each do |object|
      assert_equal expected.sort, reject_pretty_methods(object.to_jail.methods.map(&:to_s).sort)
    end
  end

// Vulnerability class: CWE-200
def category_preferences_export
      return enum_for(:category_preferences_export) unless block_given?

      CategoryUser
        .where(user_id: @current_user.id)
        .select(:category_id, :notification_level, :last_seen_at)
        .each do |cu|
        yield [
          cu.category_id,
          piped_category_name(cu.category_id),
          NotificationLevels.all[cu.notification_level],
          cu.last_seen_at
        ]
      end
    end

// Vulnerability class: CWE-200
it "activates user invited via email with a token" do
      invite = Fabricate(:invite, invited_by: Fabricate(:admin), email: 'walter.white@email.com', emailed_status: Invite.emailed_status_types[:sent])
      user = InviteRedeemer.create_user_from_invite(invite: invite, email: invite.email, username: 'walter', name: 'Walter White', email_token: invite.email_token)

      expect(user.username).to eq('walter')
      expect(user.name).to eq('Walter White')
      expect(user.email).to eq('walter.white@email.com')
      expect(user.approved).to eq(true)
      expect(user.active).to eq(true)
    end

// Vulnerability class: CWE-863
def authenticate!
      unless Setting['oauth_active']
        Rails.logger.warn 'Trying to authenticate with OAuth, but OAuth is not active'
        return nil
      end

      unless (incoming_key = OAuth::RequestProxy.proxy(request).oauth_consumer_key) == Setting['oauth_consumer_key']
        Rails.logger.warn "oauth_consumer_key should be '#{Setting['oauth_consumer_key']}' but was '#{incoming_key}'"
        return nil
      end

      if OAuth::Signature.verify(request, :consumer_secret => Setting['oauth_consumer_secret'])
        if Setting['oauth_map_users']
          user_name = request.headers['HTTP_FOREMAN_USER'].to_s
          User.find_by_login(user_name).tap do |obj|
            Rails.logger.warn "Oauth: mapping to user '#{user_name}' failed" if obj.nil?
          end.try(:login)
        else
          User::ANONYMOUS_API_ADMIN
        end
      else
        Rails.logger.warn "OAuth signature verification failed."
        return nil
      end
    end

// Vulnerability class: CWE-200
def create_fixed_clamp_code(nbits, signed)
        if nbits == 1 && signed == :signed
          raise "signed bitfield must have more than one bit"
        end

        if signed == :signed
          max = (1 << (nbits - 1)) - 1
          min = -(max + 1)
        else
          min = 0
          max = (1 << nbits) - 1
        end

        clamp = "(val < #{min}) ? #{min} : (val > #{max}) ? #{max} : val"

        if nbits == 1
          # allow single bits to be used as booleans
          clamp = "(val == true) ? 1 : (not val) ? 0 : #{clamp}"
        end

        "val = #{clamp}"
      end

// Vulnerability class: CWE-400
def require_smart_proxy_or_login(features = nil)
    features = features.call if features.respond_to?(:call)
    allowed_smart_proxies = features.blank? ? SmartProxy.all : SmartProxy.with_features(*features)

    if !Setting[:restrict_registered_smart_proxies] || auth_smart_proxy(allowed_smart_proxies, Setting[:require_ssl_smart_proxies])
      set_admin_user
      return true
    end

    require_login
    unless User.current
      render_error 'access_denied', :status => :forbidden unless performed? && api_request?
      return false
    end
    authorize
  end

// Vulnerability class: CWE-200
it 'supports group' do
      topic = Fabricate(:topic, created_at: 3.months.ago)
      post = Fabricate(:post, raw: 'hi this is a test 123 123', topic: topic)

      group = Group.create!(name: "Like_a_Boss")
      GroupUser.create!(user_id: post.user_id, group_id: group.id)

      expect(Search.execute('group:like_a_boss').posts.length).to eq(1)
      expect(Search.execute('group:"like a brick"').posts.length).to eq(0)
    end

// Vulnerability class: CWE-200
it "does not raise error if record is not pending" do
        reviewable = ReviewableUser.needs_review!(target: Fabricate(:user, email: invite.email), created_by: invite.invited_by)
        reviewable.status = Reviewable.statuses[:ignored]
        reviewable.save!
        invite_redeemer.redeem

        reviewable.reload
        expect(reviewable.status).to eq(Reviewable.statuses[:ignored])
      end

// Vulnerability class: CWE-863
def initialize(session, query_operation)
      @session = session
      @query_op = query_operation.dup

      @get_more_op = Protocol::GetMore.new(
        @query_op.database,
        @query_op.collection,
        0,
        @query_op.limit
      )

      @kill_cursor_op = Protocol::KillCursors.new([0])
    end

// Vulnerability class: CWE-20
def self.taxonomy_conditions
      org = Organization.expand(Organization.current) if SETTINGS[:organizations_enabled]
      loc = Location.expand(Location.current) if SETTINGS[:locations_enabled]
      conditions = {}
      conditions[:organization_id] = Array(org).map { |o| o.subtree_ids }.flatten.uniq if org.present?
      conditions[:location_id] = Array(loc).map { |l| l.subtree_ids }.flatten.uniq if loc.present?
      conditions
    end

// Vulnerability class: CWE-200
def execute(op)
      mode = options[:consistency] == :eventual ? :read : :write
      socket = socket_for(mode)

      if safe?
        last_error = Protocol::Command.new(
          "admin", { getlasterror: 1 }.merge(safety)
        )

        socket.execute(op, last_error).documents.first.tap do |result|
          raise Errors::OperationFailure.new(
            op, result
          ) if result["err"] || result["errmsg"]
        end
      else
        socket.execute(op)
      end
    end

// Vulnerability class: CWE-20
def sync
      known = known_addresses.shuffle
      seen  = {}

      sync_seed = ->(seed) do
        server = Server.new seed

        unless seen[server.resolved_address]
          seen[server.resolved_address] = true

          hosts = sync_server(server)

          hosts.each do |host|
            sync_seed[host]
          end
        end
      end

      known.each do |seed|
        sync_seed[seed]
      end

      unless servers.empty?
        @dynamic_seeds = servers.map(&:address)
      end

      true
    end

// Vulnerability class: CWE-400
def private_message_reset_new
    topic_query = TopicQuery.new(current_user)

    if params[:topic_ids].present?
      unless Array === params[:topic_ids]
        raise Discourse::InvalidParameters.new(
          "Expecting topic_ids to contain a list of topic ids"
        )
      end

      topic_scope = topic_query
        .private_messages_for(current_user, :all)
        .where("topics.id IN (?)", params[:topic_ids].map(&:to_i))
    else
      params.require(:inbox)
      inbox = params[:inbox].to_s
      filter = private_message_filter(topic_query, inbox)
      topic_query.options[:limit] = false
      topic_scope = topic_query.filter_private_message_new(current_user, filter)
    end

    topic_ids = TopicsBulkAction.new(
      current_user,
      topic_scope.pluck(:id),
      type: "dismiss_topics"
    ).perform!

    render json: success_json.merge(topic_ids: topic_ids)
  end

// Vulnerability class: CWE-863
def build_actions(actions, guardian, args)
    return unless pending?

    if guardian.can_approve?(target) || args[:approved_by_invite]
      actions.add(:approve_user) do |a|
        a.icon = 'user-plus'
        a.label = "reviewables.actions.approve_user.title"
      end
    end

    delete_user_actions(actions, require_reject_reason: !is_a_suspect_user?)
  end

// Vulnerability class: CWE-863
def get_user_archive_fields(user_archive)
      user_archive_array = []
      topic_data = user_archive.topic
      user_archive = user_archive.as_json
      topic_data = Topic.with_deleted.find_by(id: user_archive['topic_id']) if topic_data.nil?
      return user_archive_array if topic_data.nil?

      categories = piped_category_name(topic_data.category_id)
      is_pm = topic_data.archetype == "private_message" ? I18n.t("csv_export.boolean_yes") : I18n.t("csv_export.boolean_no")
      url = "#{Discourse.base_url}/t/#{topic_data.slug}/#{topic_data.id}/#{user_archive['post_number']}"

      topic_hash = { "post" => user_archive['raw'], "topic_title" => topic_data.title, "categories" => categories, "is_pm" => is_pm, "url" => url }
      user_archive.merge!(topic_hash)

      HEADER_ATTRS_FOR['user_archive'].each do |attr|
        user_archive_array.push(user_archive[attr])
      end

      user_archive_array
    end

// Vulnerability class: CWE-200
def approve_account_if_needed
    if invited_user.present? && reviewable_user = ReviewableUser.find_by(target: invited_user, status: Reviewable.statuses[:pending])
      reviewable_user.perform(
        invite.invited_by,
        :approve_user,
        send_email: false,
        approved_by_invite: true
      )
    end
  end

// Vulnerability class: CWE-863
def split_path(request)
    # Reparse the configuration if necessary.
    readconfig

    mount_name, path = request.key.split(File::Separator, 2)

    raise(ArgumentError, "Cannot find file: Invalid path '#{mount_name}'") unless mount_name =~ %r{^[-\w]+$}

    return nil unless mount = find_mount(mount_name, request.environment)
    if mount.name == "modules" and mount_name != "modules"
      # yay backward-compatibility
      path = "#{mount_name}/#{path}"
    end

    if path == ""
      path = nil
    elsif path
      # Remove any double slashes that might have occurred
      path = path.gsub(/\/+/, "/")
    end

    return mount, path
  end

// Vulnerability class: CWE-200
def redirect_back_or_default(default, options={})
    back_url = params[:back_url].to_s
    if back_url.present?
      begin
        uri = URI.parse(back_url)
        # do not redirect user to another host or to the login or register page
        if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
          redirect_to(back_url)
          return
        end
      rescue URI::InvalidURIError
        logger.warn("Could not redirect to invalid URL #{back_url}")
        # redirect to default
      end
    elsif options[:referer]
      redirect_to_referer_or default
      return
    end
    redirect_to default
    false
  end

// Vulnerability class: CWE-20
def filter_archived(list, user, archived: true)
      # Executing an extra query instead of a sub-query because it is more
      # efficient for the PG planner. Caution should be used when changing the
      # query here as it can easily lead to an inefficient query.
      group_ids = group_with_messages_ids(user)

      list = list.joins(<<~SQL)
      LEFT JOIN group_archived_messages gm
        ON gm.topic_id = topics.id
        #{group_ids.present? ? "AND gm.group_id IN (#{group_ids.join(",")})" : ""}
      LEFT JOIN user_archived_messages um
        ON um.user_id = #{user.id.to_i}
        AND um.topic_id = topics.id
      SQL

      list =
        if archived
          list.where("um.user_id IS NOT NULL OR gm.topic_id IS NOT NULL")
        else
          list.where("um.user_id IS NULL AND gm.topic_id IS NULL")
        end

      list
    end

// Vulnerability class: CWE-863
it "does not automatically approve users if must_approve_users is true" do
      SiteSetting.must_approve_users = true

      invite = Fabricate(:invite, email: 'test@example.com')
      user = InviteRedeemer.create_user_from_invite(invite: invite, email: invite.email, username: 'test')
      expect(user.approved).to eq(false)
    end

// Vulnerability class: CWE-863
it 'should write the public key to disk if its the first time its been seen' do
          @plugin.stubs(:lookup_config_option).with('learn_public_keys').returns('1')
          @plugin.stubs(:lookup_config_option).with('publickey_dir').returns('ssh/pkd')
          File.stubs(:directory?).with('ssh/pkd').returns(true)
          File.stubs(:exists?).with('ssh/pkd/rspec_pub.pem').returns(false)
          file = mock
          File.expects(:open).with('ssh/pkd/rspec_pub.pem', 'w').yields(file)
          file.expects(:puts).with('ssh-rsa abcd')
          @plugin.send(:write_key_to_disk, 'ssh-rsa abcd', 'rspec')
        end

// Vulnerability class: CWE-20
def sync_server(server)
      [].tap do |hosts|
        socket = server.socket

        if socket.connect
          info = socket.simple_query Protocol::Command.new(:admin, ismaster: 1)

          if info["ismaster"]
            server.primary = true
          end

          if info["secondary"]
            server.secondary = true
          end

          if info["primary"]
            hosts.push info["primary"]
          end

          if info["hosts"]
            hosts.concat info["hosts"]
          end

          if info["passives"]
            hosts.concat info["passives"]
          end

          merge(server)

        end
      end.uniq
    end

// Vulnerability class: CWE-400
def filter_archived(list, user, archived: true)
      list = list.joins(<<~SQL)
      LEFT JOIN group_archived_messages gm ON gm.topic_id = topics.id
      LEFT JOIN user_archived_messages um
        ON um.user_id = #{user.id.to_i}
        AND um.topic_id = topics.id
      SQL

      list =
        if archived
          list.where("um.user_id IS NOT NULL OR gm.topic_id IS NOT NULL")
        else
          list.where("um.user_id IS NULL AND gm.topic_id IS NULL")
        end

      list
    end

// Vulnerability class: CWE-863
def self.publish_unread(post)
    return unless post.topic.regular?
    # TODO at high scale we are going to have to defer this,
    #   perhaps cut down to users that are around in the last 7 days as well

    group_ids =
      if post.post_type == Post.types[:whisper]
        [Group::AUTO_GROUPS[:staff]]
      else
        post.topic.category && post.topic.category.secure_group_ids
      end

    tags = nil
    tag_ids = nil
    if include_tags_in_report?
      tag_ids, tags = post.topic.tags.pluck(:id, :name).transpose
    end

    TopicUser
      .tracking(post.topic_id)
      .includes(user: :user_stat)
      .select([:user_id, :last_read_post_number, :notification_level])
      .each do |tu|

      payload = {
        last_read_post_number: tu.last_read_post_number,
        highest_post_number: post.post_number,
        updated_at: post.topic.updated_at,
        created_at: post.created_at,
        category_id: post.topic.category_id,
        notification_level: tu.notification_level,
        archetype: post.topic.archetype,
        first_unread_at: tu.user.user_stat.first_unread_at,
        unread_not_too_old: true
      }

      if tags
        payload[:tags] = tags
        payload[:topic_tag_ids] = tag_ids
      end

      message = {
        topic_id: post.topic_id,
        message_type: UNREAD_MESSAGE_TYPE,
        payload: payload
      }

      MessageBus.publish(self.unread_channel_key(tu.user_id), message.as_json, group_ids: group_ids)
    end

  end

// Vulnerability class: CWE-200
def generate(time, inc = 0)
          pid = Process.pid % 0xFFFF

          [
            time >> 24 & 0xFF, # 4 bytes time (network order)
            time >> 16 & 0xFF,
            time >> 8  & 0xFF,
            time       & 0xFF,
            @machine_id[0],   # 3 bytes machine
            @machine_id[1],
            @machine_id[2],
            pid  >> 8  & 0xFF, # 2 bytes process id
            pid        & 0xFF,
            inc  >> 16 & 0xFF, # 3 bytes increment
            inc  >> 8  & 0xFF,
            inc        & 0xFF,
          ]
        end

// Vulnerability class: CWE-400
def sync
      known = known_addresses.shuffle
      seen  = {}

      sync_seed = ->(seed) do
        server = Server.new seed

        unless seen[server.resolved_address]
          seen[server.resolved_address] = true

          hosts = sync_server(server)

          hosts.each do |host|
            sync_seed[host]
          end
        end
      end

      known.each do |seed|
        sync_seed[seed]
      end

      unless servers.empty?
        @dynamic_seeds = servers.map(&:address)
      end

      true
    end

// Vulnerability class: CWE-20
it 'should overwrite the existing public key if overwrite_stored_key is set' do
          @plugin.stubs(:lookup_config_option).with('learn_public_keys').returns('1')
          @plugin.stubs(:lookup_config_option).with('publickey_dir').returns('ssh/pkd')
          @plugin.stubs(:lookup_config_option).with('overwrite_stored_keys', 'n').returns('1')
          File.stubs(:directory?).with('ssh/pkd').returns(true)
          File.stubs(:exists?).with('ssh/pkd/rspec_pub.pem').returns(true)
          File.stubs(:read).with('ssh/pkd/rspec_pub.pem').returns('ssh-rsa dcba')
          file = mock
          File.expects(:open).with('ssh/pkd/rspec_pub.pem', 'w').yields(file)
          file.expects(:puts).with('ssh-rsa abcd')
          Log.expects(:warn)
          @plugin.send(:write_key_to_disk, 'ssh-rsa abcd', 'rspec')
        end

// Vulnerability class: CWE-20
it "updates a hostgroup with a parent parameter, allows empty values" do
      child = FactoryGirl.create(:hostgroup, :parent => @base)
      as_admin do
        assert_equal "original", child.parameters["x"]
      end
      post :update, {"id" => child.id, "hostgroup" => {"name" => child.name,
                                                       :group_parameters_attributes => {"0" => {:name => "x", :value => "", :_destroy => ""},
                                                                                        "1" => {:name => "y", :value => "overridden", :_destroy => ""}}}}, set_session_user
      assert_redirected_to hostgroups_url
      child.reload
      assert_equal "overridden", child.parameters["y"]
      assert_equal "", child.parameters["x"]
    end

// Vulnerability class: CWE-200
def decode_compact_serialized(input, private_key_or_secret, algorithms = nil, encryption_methods = nil, _allow_blank_payload = false)
        unless input.count('.') + 1 == NUM_OF_SEGMENTS
          raise InvalidFormat.new("Invalid JWE Format. JWE should include #{NUM_OF_SEGMENTS} segments.")
        end
        jwe = new
        _header_json_, jwe.jwe_encrypted_key, jwe.iv, jwe.cipher_text, jwe.authentication_tag = input.split('.').collect do |segment|
          begin
            Base64.urlsafe_decode64 segment
          rescue ArgumentError
            raise DecryptionFailed
          end
        end
        jwe.auth_data = input.split('.').first
        jwe.header = JSON.parse(_header_json_).with_indifferent_access
        unless private_key_or_secret == :skip_decryption
          jwe.decrypt! private_key_or_secret, algorithms, encryption_methods
        end
        jwe
      end

// Vulnerability class: CWE-287
def test_jail_classes_should_have_limited_methods
    expected = ["new", "methods", "name", "inherited", "method_added", "inspect",
                "allow", "allowed?", "allowed_methods", "init_allowed_methods",
                "<", # < needed in Rails Object#subclasses_of
                "ancestors", "==" # ancestors and == needed in Rails::Generator::Spec#lookup_class
               ]
    objects.each do |object|
      assert_equal expected.sort, reject_pretty_methods(object.to_jail.class.methods.map(&:to_s).sort)
    end
  end

// Vulnerability class: CWE-200
def self.new_from_xml_hash(hash)
    r = Review.new

    r.state = hash.delete('state') { raise ArgumentError, 'no state' }
    r.state = r.state.to_sym

    r.by_user = hash.delete('by_user')
    r.by_group = hash.delete('by_group')
    r.by_project = hash.delete('by_project')
    r.by_package = hash.delete('by_package')

    r.reviewer = r.creator = hash.delete('who')
    r.reason = hash.delete('comment')
    begin
      r.created_at = Time.zone.parse(hash.delete('when'))
    rescue TypeError
      # no valid time -> ignore
    end

    raise ArgumentError, "too much information #{hash.inspect}" if hash.present?
    r
  end

// Vulnerability class: CWE-862
it "returns only published articles" do
      article = create(:article)
      create(:comment, article: article)
      unpublished_article = create(:article, state: "draft")
      create(:comment, article: unpublished_article)
      expect(described_class.published).to eq([article])
      expect(described_class.bestof).to eq([article])
    end

// Vulnerability class: CWE-863
def socket_for(mode)
      sync unless primaries.any? || (secondaries.any? && mode == :read)

      server = nil
      while primaries.any? || (secondaries.any? && mode == :read)
        if mode == :write || secondaries.empty?
          server = primaries.sample
        else
          server = secondaries.sample
        end

        if server
          socket = server.socket
          socket.connect unless socket.connection

          if socket.alive?
            break server
          else
            remove server
          end
        end
      end

// Vulnerability class: CWE-20
def write!(headers)
        if @orig_disable_profiling != @disable_profiling || @orig_backtrace_level != @backtrace_level || @cookie.nil?
          settings = {"p" =>  "t" }
          settings["dp"] = "t"              if @disable_profiling
          settings["bt"] = @backtrace_level if @backtrace_level
          settings_string = settings.map{|k,v| "#{k}=#{v}"}.join(",")
          Rack::Utils.set_cookie_header!(headers, COOKIE_NAME, :value => settings_string, :path => '/')
        end
      end

// Vulnerability class: CWE-200
def reactions_given
      params.require(:username)
      user = fetch_user_from_params(include_inactive: current_user.try(:staff?) || (current_user && SiteSetting.show_inactive_accounts))
      raise Discourse::NotFound unless guardian.can_see_profile?(user)

      reaction_users = DiscourseReactions::ReactionUser
        .joins(:reaction, :post)
        .includes(:user, :post, :reaction)
        .where(user_id: user.id)
        .where('discourse_reactions_reactions.reaction_users_count IS NOT NULL')

      if params[:before_reaction_user_id]
        reaction_users = reaction_users
          .where('discourse_reactions_reaction_users.id < ?', params[:before_reaction_user_id].to_i)
      end

      reaction_users = reaction_users
        .order(created_at: :desc)
        .limit(20)

      render_serialized(reaction_users.to_a, UserReactionSerializer)
    end

// Vulnerability class: CWE-200
def handle_meta(message, local, &callback)
      method = Channel.parse(message['channel'])[1]

      unless META_METHODS.include?(method)
        response = make_response(message)
        response['error'] = Faye::Error.channel_forbidden(message['channel'])
        response['successful'] = false
        return callback.call([response])
      end

      __send__(method, message, local) do |responses|
        responses = [responses].flatten
        responses.each { |r| advize(r, message['connectionType']) }
        callback.call(responses)
      end
    end

// Vulnerability class: CWE-287
def update
    article = Ticket::Article.find(params[:id])
    authorize!(article)

    clean_params = Ticket::Article.association_name_to_id_convert(params)
    clean_params = Ticket::Article.param_cleanup(clean_params, true)

    # only apply preferences changes (keep not updated keys/values)
    clean_params = article.param_preferences_merge(clean_params)

    article.update!(clean_params)

    if response_expand?
      result = article.attributes_with_association_names
      render json: result, status: :ok
      return
    end

    if response_full?
      full = Ticket::Article.full(params[:id])
      render json: full, status: :ok
      return
    end

    render json: article.attributes_with_association_names, status: :ok
  end

// Vulnerability class: CWE-862
def initialize(env)
        request = ::Rack::Request.new(env)
        @cookie = request.cookies[COOKIE_NAME]
        if @cookie
          @cookie.split(",").map{|pair| pair.split("=")}.each do |k,v|
            @orig_disable_profiling = @disable_profiling = (v=='t') if k == "dp"
            @backtrace_level = v.to_i if k == "bt"
          end
        end

        @backtrace_level = nil if !@backtrace_level.nil? && (@backtrace_level == 0 || @backtrace_level > BACKTRACE_NONE)
        @orig_backtrace_level = @backtrace_level

      end

// Vulnerability class: CWE-200
def write_key_to_disk(key, identity)

        # Writing is disabled. Don't bother checking any other states.
        return unless lookup_config_option('learn_public_keys') =~ /^1|y/

        publickey_dir = lookup_config_option('publickey_dir')

        unless publickey_dir
          Log.info("Public key sent with request but no publickey_dir defined in configuration. Not writing key to disk.")
          return
        end

        if File.directory?(publickey_dir)
          if File.exists?(old_keyfile = File.join(publickey_dir, "#{identity}_pub.pem"))
            old_key = File.read(old_keyfile).chomp

            unless old_key == key
              unless lookup_config_option('overwrite_stored_keys', 'n') =~ /^1|y/
                Log.warn("Public key sent from '%s' does not match the stored key. Not overwriting." % identity)
              else
                Log.warn("Public key sent from '%s' does not match the stored key. Overwriting." % identity)
                File.open(File.join(publickey_dir, "#{identity}_pub.pem"), 'w') { |f| f.puts key }
              end
            end
          else
            Log.debug("Discovered a new public key for '%s'. Writing to '%s'" % [identity, publickey_dir])
            File.open(File.join(publickey_dir, "#{identity}_pub.pem"), 'w') { |f| f.puts key }
          end
        else
          raise("Cannot write public key to '%s'. Directory does not exist." % publickey_dir)
        end
      end

// Vulnerability class: CWE-20
def test_update_valid
    Realm.any_instance.stubs(:valid?).returns(true)
    put :update, {:id => Realm.first.name,
                  :realm => { :realm_proxy_id => SmartProxy.first.id } }, set_session_user
    assert_equal SmartProxy.first.id, Realm.first.realm_proxy_id
    assert_redirected_to realms_url
  end

// Vulnerability class: CWE-200
it 'does not include user or group archived messages' do
      UserArchivedMessage.archive!(user.id, group_message)
      UserArchivedMessage.archive!(user.id, private_message)

      topics = TopicQuery.new(nil).list_private_messages_all(user).topics

      expect(topics).to eq([])

      GroupArchivedMessage.archive!(user_2.id, group_message)

      topics = TopicQuery.new(nil).list_private_messages_all(user_2).topics

      expect(topics).to contain_exactly(private_message)
    end

// Vulnerability class: CWE-863
def generate(time, inc = 0)
          pid = Process.pid % 0xFFFF

          [
            time >> 24 & 0xFF, # 4 bytes time (network order)
            time >> 16 & 0xFF,
            time >> 8  & 0xFF,
            time       & 0xFF,
            @machine_id[0],   # 3 bytes machine
            @machine_id[1],
            @machine_id[2],
            pid  >> 8  & 0xFF, # 2 bytes process id
            pid        & 0xFF,
            inc  >> 16 & 0xFF, # 3 bytes increment
            inc  >> 8  & 0xFF,
            inc        & 0xFF,
          ]
        end

// Vulnerability class: CWE-20
def show_article
    auto_discovery_feed
    respond_to do |format|
      format.html do
        @comment = Comment.new
        @page_title = this_blog.article_title_template.to_title(@article, this_blog, params)
        @description = this_blog.article_desc_template.to_title(@article, this_blog, params)

        @keywords = @article.tags.map(&:name).join(", ")
        render "articles/#{@article.post_type}"
      end
      format.atom { render_feedback_feed("atom") }
      format.rss { render_feedback_feed("rss") }
      format.xml { render_feedback_feed("atom") }
    end
  rescue ActiveRecord::RecordNotFound
    error!
  end

// Vulnerability class: CWE-863
def test_formats_valid
    AuthSourceLdap.any_instance.stubs(:valid?).returns(false)
    put :update, {:id => AuthSourceLdap.first.id, :format => "weird", :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    assert_response :success

    wierd_id = "#{AuthSourceLdap.first.id}.weird"
    put :update, {:id => wierd_id, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    assert_response :success

    parameterized_id = "#{AuthSourceLdap.first.id}-#{AuthSourceLdap.first.name.parameterize}"
    put :update, {:id => parameterized_id, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    assert_response :success
  end

// Vulnerability class: CWE-200
def reset_password
      @admin_user = Motor::AdminUser.find(params[:admin_user_id])

      authorize!(:manage, @admin_user)

      Devise::Mailer.default_url_options = { host: request.host, protocol: request.protocol, port: request.port }

      @admin_user.send_reset_password_instructions

      head :ok
    end

// Vulnerability class: CWE-116
def private_messages_for(user, type)
      options = @options
      options.reverse_merge!(per_page: per_page_setting)

      result = Topic.includes(:allowed_users)
      result = result.includes(:tags) if SiteSetting.tagging_enabled

      if type == :group
        result = result.joins(
          "INNER JOIN topic_allowed_groups tag ON tag.topic_id = topics.id AND tag.group_id IN (SELECT id FROM groups WHERE LOWER(name) = '#{PG::Connection.escape_string(@options[:group_name].downcase)}')"
        )

        unless user.admin?
          result = result.joins("INNER JOIN group_users gu ON gu.group_id = tag.group_id AND gu.user_id = #{user.id.to_i}")
        end
      elsif type == :user
        result = result.where("topics.id IN (SELECT topic_id FROM topic_allowed_users WHERE user_id = #{user.id.to_i})")
      elsif type == :all
        result = result.where("topics.id IN (
              SELECT topic_id
              FROM topic_allowed_users
              WHERE user_id = #{user.id.to_i}
              UNION ALL
              SELECT topic_id FROM topic_allowed_groups
              WHERE group_id IN (
                SELECT group_id FROM group_users WHERE user_id = #{user.id.to_i}
              )
      )")
      end

      result = result.joins("LEFT OUTER JOIN topic_users AS tu ON (topics.id = tu.topic_id AND tu.user_id = #{user.id.to_i})")
        .order("topics.bumped_at DESC")
        .private_messages

      result = result.limit(options[:per_page]) unless options[:limit] == false
      result = result.visible if options[:visible] || @user.nil? || @user.regular?

      if options[:page]
        offset = options[:page].to_i * options[:per_page]
        result = result.offset(offset) if offset > 0
      end
      result
    end

// Vulnerability class: CWE-863
it "does not activate user invited via links" do
      invite = Fabricate(:invite, email: 'walter.white@email.com', emailed_status: Invite.emailed_status_types[:not_required])
      user = InviteRedeemer.create_user_from_invite(invite: invite, email: invite.email, username: 'walter', name: 'Walter White')

      expect(user.username).to eq('walter')
      expect(user.name).to eq('Walter White')
      expect(user.email).to eq('walter.white@email.com')
      expect(user.approved).to eq(true)
      expect(user.active).to eq(false)
    end

// Vulnerability class: CWE-863
it "should escape evil haxxor attemptes" do
    Mail.defaults do
      delivery_method :sendmail, :arguments => nil
    end
    
    mail = Mail.new do
      from    '"foo\";touch /tmp/PWNED;\""@blah.com'
      to      'marcel@test.lindsaar.net'
      subject 'invalid RFC2822'
    end
    
    Mail::Sendmail.should_receive(:call).with('/usr/sbin/sendmail', 
                                              "-f \"\\\"foo\\\\\\\"\\;touch /tmp/PWNED\\;\\\\\\\"\\\"@blah.com\"", 
                                              'marcel@test.lindsaar.net', 
                                              mail)
    mail.deliver!
  end

// Vulnerability class: CWE-20
def test_destroy
    auth_source_ldap = AuthSourceLdap.first
    User.where(:auth_source_id => auth_source_ldap.id).update_all(:auth_source_id => nil)
    delete :destroy, {:id => auth_source_ldap}, set_session_user
    assert_redirected_to auth_source_ldaps_url
    assert !AuthSourceLdap.exists?(auth_source_ldap.id)
  end

// Vulnerability class: CWE-200
def private_messages_for(user, type)
      options = @options
      options.reverse_merge!(per_page: per_page_setting)

      result = Topic.includes(:allowed_users)
      result = result.includes(:tags) if SiteSetting.tagging_enabled

      if type == :group
        result = result.joins(
          "INNER JOIN topic_allowed_groups tag ON tag.topic_id = topics.id AND tag.group_id IN (SELECT id FROM groups WHERE LOWER(name) = '#{PG::Connection.escape_string(@options[:group_name].downcase)}')"
        )

        unless user.admin?
          result = result.joins("INNER JOIN group_users gu ON gu.group_id = tag.group_id AND gu.user_id = #{user.id.to_i}")
        end
      elsif type == :user
        result = result.where("topics.id IN (SELECT topic_id FROM topic_allowed_users WHERE user_id = #{user.id.to_i})")
      elsif type == :all
        group_ids = group_with_messages_ids(user)

        result = result.joins(<<~SQL)
        LEFT JOIN topic_allowed_users tau
          ON tau.topic_id = topics.id
          AND tau.user_id = #{user.id.to_i}
        LEFT JOIN topic_allowed_groups tag
          ON tag.topic_id = topics.id
          #{group_ids.present? ? "AND tag.group_id IN (#{group_ids.join(",")})" : ""}
        SQL

        result = result
          .where("tag.topic_id IS NOT NULL OR tau.topic_id IS NOT NULL")
          .distinct
      end

      result = result.joins("LEFT OUTER JOIN topic_users AS tu ON (topics.id = tu.topic_id AND tu.user_id = #{user.id.to_i})")
        .order("topics.bumped_at DESC")
        .private_messages

      result = result.limit(options[:per_page]) unless options[:limit] == false
      result = result.visible if options[:visible] || @user.nil? || @user.regular?

      if options[:page]
        offset = options[:page].to_i * options[:per_page]
        result = result.offset(offset) if offset > 0
      end
      result
    end

// Vulnerability class: CWE-863
def create
      @application = Doorkeeper.config.application_model.new(application_params)

      if @application.save
        flash[:notice] = I18n.t(:notice, scope: %i[doorkeeper flash applications create])
        flash[:application_secret] = @application.plaintext_secret

        respond_to do |format|
          format.html { redirect_to oauth_application_url(@application) }
          format.json { render json: @application }
        end
      else
        respond_to do |format|
          format.html { render :new }
          format.json do
            errors = @application.errors.full_messages

            render json: { errors: errors }, status: :unprocessable_entity
          end
        end
      end
    end

// Vulnerability class: CWE-862
it 'should not overwrite an existing file if overwrite_stored_key is not set' do
          @plugin.stubs(:lookup_config_option).with('learn_public_keys').returns('1')
          @plugin.stubs(:lookup_config_option).with('publickey_dir').returns('ssh/pkd')
          @plugin.stubs(:lookup_config_option).with('overwrite_stored_keys', 'n').returns('n')
          File.stubs(:directory?).with('ssh/pkd').returns(true)
          File.stubs(:exists?).with('ssh/pkd/rspec_pub.pem').returns(true)
          File.stubs(:read).with('ssh/pkd/rspec_pub.pem').returns('ssh-rsa dcba')
          Log.expects(:warn)
          File.expects(:open).never
          @plugin.send(:write_key_to_disk, 'ssh-rsa abcd', 'rspec')
        end

// Vulnerability class: CWE-20
it "approves user if invited by staff" do
      SiteSetting.must_approve_users = true

      invite = Fabricate(:invite, email: 'test@example.com', invited_by: Fabricate(:admin))
      user = InviteRedeemer.create_user_from_invite(invite: invite, email: invite.email, username: 'test')
      expect(user.approved).to eq(true)
    end

// Vulnerability class: CWE-863
def deliver!(mail)
      envelope_from = mail.return_path || mail.sender || mail.from_addrs.first
      return_path = "-f \"#{envelope_from.to_s.shellescape}\"" if envelope_from
      arguments = [settings[:arguments], return_path].compact.join(" ")
      self.class.call(settings[:location], arguments, mail)
    end

// Vulnerability class: CWE-20