nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: microcosm-cc/bluemonday
Pull request #87 (2019-08-09 19:37:51)

Fixed issue with default handler for font-family not validating correctly
Found/fixed an issue with the default handler for the Font-Family css property not working properly in cases including dashes, or spaces when not inside quotes


Patch:
diff --git a/handlers.go b/handlers.go
index 807f009..1ef4c8a 100644
--- a/handlers.go
+++ b/handlers.go
@@ -1143,7 +1143,7 @@ func FontFamilyHandler(value string) bool {
 	if in(splitVals, values) {
 		return true
 	}
-	reg := regexp.MustCompile(`('[a-z ]+'|[a-z]+)`)
+	reg := regexp.MustCompile(`('[a-z \-]+'|[a-z \-]+)`)
 	reg.Longest()
 	for _, i := range splitVals {
 		i = strings.TrimSpace(i)


Test patch:
diff --git a/handlers_test.go b/handlers_test.go
index 50acf6e..317ea17 100644
--- a/handlers_test.go
+++ b/handlers_test.go
@@ -510,9 +510,11 @@ func TestDefaultHandlers(t *testing.T) {
 		},
 		{
 			in: `<div style="font-family: 'Times New Roman', Times, ` +
-				`serif"></div>`,
+				`serif"></div><span style="font-family: comic sans ms, ` +
+				`cursive, sans-serif;">aaaaaa</span></span>`,
 			expected: `<div style="font-family: &#39;Times New Roman&#39;,` +
-				` Times, serif"></div>`,
+				` Times, serif"></div><span style="font-family: comic sans` +
+				` ms, cursive, sans-serif">aaaaaa</span></span>`,
 		},
 		{
 			in:       `<div style="font-kerning: normal"></div>`,
Repository: microcosm-cc/bluemonday
Pull request #115 (2021-04-09 08:57:43)

Sanitize should not add forcibly add values to query components
Although query components are often key=value pairs - there is no absolute requirement
for the keys to have values and if there is not a value then the equal sign should not
be added.

Fixes go-gitea/gitea#15349

Signed-off-by: Andrew Thornton <art27@cantab.net>


Patch:
diff --git a/sanitize.go b/sanitize.go
index 99559bb..f4d2355 100644
--- a/sanitize.go
+++ b/sanitize.go
@@ -124,8 +124,9 @@ func escapeUrlComponent(val string) string {
 
 // Query represents a query
 type Query struct {
-	Key   string
-	Value string
+	Key      string
+	Value    string
+	HasValue bool
 }
 
 func parseQuery(query string) (values []Query, err error) {
@@ -140,8 +141,10 @@ func parseQuery(query string) (values []Query, err error) {
 			continue
 		}
 		value := ""
+		hasValue := false
 		if i := strings.Index(key, "="); i >= 0 {
 			key, value = key[:i], key[i+1:]
+			hasValue = true
 		}
 		key, err1 := url.QueryUnescape(key)
 		if err1 != nil {
@@ -158,8 +161,9 @@ func parseQuery(query string) (values []Query, err error) {
 			continue
 		}
 		values = append(values, Query{
-			Key:   key,
-			Value: value,
+			Key:      key,
+			Value:    value,
+			HasValue: hasValue,
 		})
 	}
 	return values, err
@@ -169,8 +173,10 @@ func encodeQueries(queries []Query) string {
 	var b strings.Builder
 	for i, query := range queries {
 		b.WriteString(url.QueryEscape(query.Key))
-		b.WriteString("=")
-		b.WriteString(url.QueryEscape(query.Value))
+		if query.HasValue {
+			b.WriteString("=")
+			b.WriteString(url.QueryEscape(query.Value))
+		}
 		if i < len(queries)-1 {
 			b.WriteString("&")
 		}
@@ -965,7 +971,6 @@ func (p *Policy) matchRegex(elementName string) (map[string]attrPolicy, bool) {
 	return aps, matched
 }
 
-
 // normaliseElementName takes a HTML element like <script> which is user input
 // and returns a lower case version of it that is immune to UTF-8 to ASCII
 // conversion tricks (like the use of upper case cyrillic i scrİpt which a
@@ -983,4 +988,4 @@ func normaliseElementName(str string) string {
 			`"`),
 		`"`,
 	)
-}
\ No newline at end of file
+}


Test patch:
diff --git a/sanitize_test.go b/sanitize_test.go
index 708bacd..a6aa3d9 100644
--- a/sanitize_test.go
+++ b/sanitize_test.go
@@ -152,8 +152,8 @@ func TestLinks(t *testing.T) {
 			expected: `<img src="giraffe.gif"/>`,
 		},
 		{
-			in:       `<img src="giraffe.gif?height=500&width=500" />`,
-			expected: `<img src="giraffe.gif?height=500&width=500"/>`,
+			in:       `<img src="giraffe.gif?height=500&width=500&flag" />`,
+			expected: `<img src="giraffe.gif?height=500&width=500&flag"/>`,
 		},
 	}
Repository: microcosm-cc/bluemonday
Pull request #138 (2022-02-06 22:44:36)

Fix incorrect handling of iframe SandboxValues
Follow up fix for https://github.com/microcosm-cc/bluemonday/pull/136.

`RequireSandboxOnIFrame` was incorrectly using the _index_ of the passed in sandbox values instead of the actual value. :/


Patch:
diff --git a/policy.go b/policy.go
index 8a08163..1a5e00c 100644
--- a/policy.go
+++ b/policy.go
@@ -707,7 +707,7 @@ func (p *Policy) AllowURLSchemeWithCustomPolicy(
 func (p *Policy) RequireSandboxOnIFrame(vals ...SandboxValue) {
 	p.requireSandboxOnIFrame = make(map[string]bool)
 
-	for val := range vals {
+	for _, val := range vals {
 		switch SandboxValue(val) {
 		case SandboxAllowDownloads:
 			p.requireSandboxOnIFrame["allow-downloads"] = true


Test patch:
diff --git a/sanitize_test.go b/sanitize_test.go
index fa9e641..a90248e 100644
--- a/sanitize_test.go
+++ b/sanitize_test.go
@@ -1874,10 +1874,10 @@ func TestIssue107(t *testing.T) {
 func TestIFrameSandbox(t *testing.T) {
 	p := NewPolicy()
 	p.AllowAttrs("sandbox").OnElements("iframe")
-	p.RequireSandboxOnIFrame(SandboxAllowDownloads)
+	p.RequireSandboxOnIFrame(SandboxAllowForms, SandboxAllowPopups)
 
-	in := `<iframe src="http://example.com" sandbox="allow-forms allow-downloads allow-downloads"></iframe>`
-	expected := `<iframe sandbox="allow-downloads"></iframe>`
+	in := `<iframe src="http://example.com" sandbox="allow-forms allow-downloads allow-downloads allow-popups"></iframe>`
+	expected := `<iframe sandbox="allow-forms allow-popups"></iframe>`
 	out := p.Sanitize(in)
 	if out != expected {
 		t.Errorf(
Repository: microcosm-cc/bluemonday
Pull request #151 (2022-10-01 19:07:34)

Don't write self-closing tag with empty attributes
- Currently the code will write self-closing tags with empty attributes to the output, even when the element isn't allowed to have empty attributes.
- Move to `break` to one outer scope to fix it.


Patch:
diff --git a/sanitize.go b/sanitize.go
index 904ee82..1046145 100644
--- a/sanitize.go
+++ b/sanitize.go
@@ -440,8 +440,8 @@ func (p *Policy) sanitize(r io.Reader, w io.Writer) error {
 					if _, err := buff.WriteString(" "); err != nil {
 						return err
 					}
-					break
 				}
+				break
 			}
 			if !skipElementContent {
 				if _, err := buff.WriteString(token.String()); err != nil {


Test patch:
diff --git a/sanitize_test.go b/sanitize_test.go
index 3a0345d..721e961 100644
--- a/sanitize_test.go
+++ b/sanitize_test.go
@@ -3913,3 +3913,21 @@ func TestIssue147(t *testing.T) {
 			expected)
 	}
 }
+
+func TestRemovingEmptySelfClosingTag(t *testing.T) {
+	p := NewPolicy()
+
+	// Only broke when attribute policy was specified.
+	p.AllowAttrs("type").OnElements("input")
+
+	input := `<input/>`
+	out := p.Sanitize(input)
+	expected := ``
+	if out != expected {
+		t.Errorf(
+			"test failed;\ninput   : %s\noutput  : %s\nexpected: %s",
+			input,
+			out,
+			expected)
+	}
+}
Repository: microcosm-cc/bluemonday
Pull request #165 (2023-03-06 16:50:55)

Upgrade golang.org/x/net to 0.8.0
Upgrade (to at least 0.7.0+) needed because of CVE-2022-41723

0.8.0 satisfies the original test that was changed in https://github.com/microcosm-cc/bluemonday/pull/148/files



Patch:
diff --git a/go.mod b/go.mod
index 5f1ea10..d121174 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.19
 
 require (
 	github.com/aymerick/douceur v0.2.0
-	golang.org/x/net v0.0.0-20221002022538-bcab6841153b
+	golang.org/x/net v0.8.0
 )
 
 require github.com/gorilla/css v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index f13abe0..0de18c6 100644
--- a/go.sum
+++ b/go.sum
@@ -2,5 +2,5 @@ github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuP
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY=
 github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
-golang.org/x/net v0.0.0-20221002022538-bcab6841153b h1:6e93nYa3hNqAvLr0pD4PN1fFS+gKzp2zAXqrnTCstqU=
-golang.org/x/net v0.0.0-20221002022538-bcab6841153b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
+golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=


Test patch:
diff --git a/sanitize_test.go b/sanitize_test.go
index ca4a94b..ee2596e 100644
--- a/sanitize_test.go
+++ b/sanitize_test.go
@@ -1612,7 +1612,7 @@ func TestComments(t *testing.T) {
 		// for every user of bluemonday that utilises .AllowComments()
 		{
 			in:       `<!--[if gte mso 9]>Hello<![endif]-->`,
-			expected: `<!--[if gte mso 9]&gt;Hello&lt;![endif]-->`,
+			expected: `<!--[if gte mso 9]>Hello<![endif]-->`,
 		},
 	}
Repository: microcosm-cc/bluemonday
Pull request #182 (2023-07-18 06:19:41)

Prefer explicit rules over regexp
#175 introduced a potential dangerous change. If a user registers the regexp `.+` for scheme validation (as written in the comment) to allow all possible schemes, a link like `<a href="javascript:...">` is valid too. The Go regexp module does not implement negative lookaheads, so you can't write "all but xyz" (`(?!javascript|vbscript)`).

This PR moves the regexp check a little bit down to be only executed if there was no other explicit scheme registration was found. So now
```go
p.AllowURLSchemesMatching(regexp.MustCompile(`.+`))
p.AllowURLSchemeWithCustomPolicy("javascript", func(*url.URL) bool {
	return false
})
```
will allow every scheme but `javascript`.

An alternative would be to drop `AllowURLSchemesMatching` again and add methods `DisallowURLSchemes` and `DisallowURLSchemeWithCustomPolicy`.


Patch:
diff --git a/policy.go b/policy.go
index 995f46c..c5bb0ff 100644
--- a/policy.go
+++ b/policy.go
@@ -118,7 +118,11 @@ type Policy struct {
 	allowURLSchemes map[string][]urlPolicy
 
 	// These regexps are used to match allowed URL schemes, for example
-	// if one would want to allow all URL schemes, they would add `.+`
+	// if one would want to allow all URL schemes, they would add `.+`.
+	// However pay attention as this can lead to XSS being rendered thus
+	// defeating the purpose of using a HTML sanitizer.
+	// The regexps are only considered if a schema was not explicitly
+	// handled by `AllowURLSchemes` or `AllowURLSchemeWithCustomPolicy`.
 	allowURLSchemeRegexps []*regexp.Regexp
 
 	// If an element has had all attributes removed as a result of a policy
diff --git a/sanitize.go b/sanitize.go
index 9121aef..bdb1dfa 100644
--- a/sanitize.go
+++ b/sanitize.go
@@ -970,14 +970,14 @@ func (p *Policy) validURL(rawurl string) (string, bool) {
 		}
 
 		if u.Scheme != "" {
-			for _, r := range p.allowURLSchemeRegexps {
-				if r.MatchString(u.Scheme) {
-					return u.String(), true
-				}
-			}
-
 			urlPolicies, ok := p.allowURLSchemes[u.Scheme]
 			if !ok {
+				for _, r := range p.allowURLSchemeRegexps {
+					if r.MatchString(u.Scheme) {
+						return u.String(), true
+					}
+				}
+
 				return "", false
 			}
 


Test patch:
diff --git a/sanitize_test.go b/sanitize_test.go
index 4e3a08f..511b961 100644
--- a/sanitize_test.go
+++ b/sanitize_test.go
@@ -4007,4 +4007,22 @@ func TestIssue174(t *testing.T) {
 			out,
 			expected)
 	}
+
+	// Custom handling of specific URL schemes even if the regex allows all
+	p.AllowURLSchemeWithCustomPolicy("javascript", func(*url.URL) bool {
+		return false
+	})
+
+	input = `<a href="cbthunderlink://somebase64string"></a>
+<a href="javascript:alert('test')">xss</a>`
+	out = p.Sanitize(input)
+	expected = `<a href="cbthunderlink://somebase64string" rel="nofollow"></a>
+xss`
+	if out != expected {
+		t.Errorf(
+			"test failed;\ninput   : %s\noutput  : %s\nexpected: %s",
+			input,
+			out,
+			expected)
+	}
 }
Repository: microcosm-cc/bluemonday
Pull request #207 (2024-03-31 15:24:44)

Support four-value syntax for CSS hex color
Ref: https://developer.mozilla.org/en-US/docs/Web/CSS/hex-color

> #RGB        // The three-value syntax
#RGBA       // The four-value syntax
#RRGGBB     // The six-value syntax
#RRGGBBAA   // The eight-value syntax


Patch:
diff --git a/css/handlers.go b/css/handlers.go
index f8b8b61..41a00c8 100644
--- a/css/handlers.go
+++ b/css/handlers.go
@@ -291,7 +291,7 @@ var (
 	Font              = regexp.MustCompile(`^('[a-z \-]+'|[a-z \-]+)$`)
 	Grayscale         = regexp.MustCompile(`^grayscale\(([0-9]{1,2}|100)%\)$`)
 	GridTemplateAreas = regexp.MustCompile(`^['"]?[a-z ]+['"]?$`)
-	HexRGB            = regexp.MustCompile(`^#([0-9a-f]{3}|[0-9a-f]{6}|[0-9a-f]{8})$`)
+	HexRGB            = regexp.MustCompile(`^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$`)
 	HSL               = regexp.MustCompile(`^hsl\([ ]*([012]?[0-9]{1,2}|3[0-5][0-9]|360),[ ]*([0-9]{0,2}|100)\%,[ ]*([0-9]{0,2}|100)\%\)$`)
 	HSLA              = regexp.MustCompile(`^hsla\(([ ]*[012]?[0-9]{1,2}|3[0-5][0-9]|360),[ ]*([0-9]{0,2}|100)\%,[ ]*([0-9]{0,2}|100)\%,[ ]*(1|1\.0|0|(0\.[0-9]+))\)$`)
 	HueRotate         = regexp.MustCompile(`^hue-rotate\(([12]?[0-9]{1,2}|3[0-5][0-9]|360)?\)$`)


Test patch:
diff --git a/sanitize_test.go b/sanitize_test.go
index c81aa8b..13feecf 100644
--- a/sanitize_test.go
+++ b/sanitize_test.go
@@ -2028,6 +2028,10 @@ func TestDefaultStyleHandlers(t *testing.T) {
 			in:       `<div style="column-rule-color: #ff00ff;"></div>`,
 			expected: `<div style="column-rule-color: #ff00ff"></div>`,
 		},
+		{
+			in:       `<div style="column-rule-color: #f0ff;"></div>`,
+			expected: `<div style="column-rule-color: #f0ff"></div>`,
+		},
 		{
 			in:       `<div style="column-rule: red;"></div>`,
 			expected: `<div style="column-rule: red"></div>`,
Repository: brimsec/zq
Pull request #1725 (2020-12-01 23:19:51)

allow len() function to work on IPs
This commit extends the len function to return the length of IP
addresses and networks.  This is handy for differentiating between
IPv4 (len=4) and IPv6 (len=16).  Likewise, networks are len 8 and
len 32.


Patch:
diff --git a/expr/function/function.go b/expr/function/function.go
index e789d3b31..288527a9d 100644
--- a/expr/function/function.go
+++ b/expr/function/function.go
@@ -164,7 +164,7 @@ func (l *lenFn) Call(args []zng.Value) (zng.Value, error) {
 			return zng.Value{}, err
 		}
 		return zng.Value{zng.TypeInt64, l.Int(int64(len))}, nil
-	case *zng.TypeOfString, *zng.TypeOfBstring:
+	case *zng.TypeOfString, *zng.TypeOfBstring, *zng.TypeOfIP, *zng.TypeOfNet:
 		v := len(args[0].Bytes)
 		return zng.Value{zng.TypeInt64, l.Int(int64(v))}, nil
 	default:
diff --git a/package.json b/package.json
index d64cb2a31..371f532db 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
       "bin": "dist"
   },
   "brimDependencies": {
-      "suricataTag": "v5.0.3-brimpre0",
+      "suricataTag": "v5.0.3-brimpre1",
       "zeekTag": "v3.2.1-brim5"
   }
 }
diff --git a/python/zqd/zqd.py b/python/zqd/zqd.py
index 5b3a87763..9ed6abfd6 100644
--- a/python/zqd/zqd.py
+++ b/python/zqd/zqd.py
@@ -33,9 +33,8 @@ class Client():
         r = self.session.post(self.base_url + "/search", json=body,
                               params=params, stream=True)
         r.raise_for_status()
-        for line in r.iter_lines():
-            if line:
-                yield json.loads(line)
+        # Return rather than yield to raise exceptions earlier.
+        return (json.loads(line) for line in r.iter_lines() if line)
 
     def spaces(self):
         r = self.session.get(self.base_url + "/space")
diff --git a/zng/net.go b/zng/net.go
index 6f0bd575d..4a71f60df 100644
--- a/zng/net.go
+++ b/zng/net.go
@@ -25,7 +25,7 @@ func EncodeNet(subnet *net.IPNet) zcode.Bytes {
 		}
 		return b[:8]
 	}
-	copy(b[:], ip)
+	copy(b[:], subnet.IP)
 	copy(b[16:], subnet.Mask)
 	return b[:]
 }


Test patch:
diff --git a/expr/ztests/ip-len.yaml b/expr/ztests/ip-len.yaml
new file mode 100644
index 000000000..40f33949d
--- /dev/null
+++ b/expr/ztests/ip-len.yaml
@@ -0,0 +1,11 @@
+zql: cut n1=len(addr),n2=len(n)
+
+input: |
+  #0:record[addr:ip,n:net]
+  0:[10.0.0.1;10.0.0.0/8;]
+  0:[fe80::215:17ff:fe84:c13f;2001:db8::/32;]
+
+output: |
+  #0:record[n1:int64,n2:int64]
+  0:[4;8;]
+  0:[16;32;]