nus-yam/ex-repair huggingface dataset:
Program: CWE-77
Project: CVE-2015-7541
Buggy source:
module Colorscore
  class Histogram
    def initialize(image_path, colors=16, depth=8)
      output = `convert #{image_path} -resize 400x400 -format %c -dither None -quantize YIQ -colors #{colors} -depth #{depth} histogram:info:-`
      @lines = output.lines.sort.reverse.map(&:strip).reject(&:empty?)
    end

    # Returns an array of colors in descending order of occurances.
    def colors
      hex_values = @lines.map { |line| line[/#([0-9A-F]{6}) /, 1] }.compact
      hex_values.map { |hex| Color::RGB.from_html(hex) }
    end

    def color_counts
      @lines.map { |line| line.split(':')[0].to_i }
    end

    def scores
      total = color_counts.inject(:+).to_f
      scores = color_counts.map { |count| count / total }
      scores.zip(colors)
    end
  end
end


Fixed version (ground truth):
require "shellwords"

module Colorscore
  class Histogram
    def initialize(image_path, colors=16, depth=8)
      output = `convert #{image_path.shellescape} -resize 400x400 -format %c -dither None -quantize YIQ -colors #{colors.to_i} -depth #{depth.to_i} histogram:info:-`
      @lines = output.lines.sort.reverse.map(&:strip).reject(&:empty?)
    end

    # Returns an array of colors in descending order of occurances.
    def colors
      hex_values = @lines.map { |line| line[/#([0-9A-F]{6}) /, 1] }.compact
      hex_values.map { |hex| Color::RGB.from_html(hex) }
    end

    def color_counts
      @lines.map { |line| line.split(':')[0].to_i }
    end

    def scores
      total = color_counts.inject(:+).to_f
      scores = color_counts.map { |count| count / total }
      scores.zip(colors)
    end
  end
end
Program: CWE-77
Project: CVE-2020-11079
Buggy source:
'use strict';

var util = require('util'),
    path = require('path'),
    shell = require('shelljs'),
    debug = require('debug')('dns-sync');

//source - http://stackoverflow.com/questions/106179/regular-expression-to-match-dns-hostname-or-ip-address
var ValidHostnameRegex = new RegExp("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$");

function isValidHostName(hostname) {
    return ValidHostnameRegex.test(hostname);
}
/**
 * Resolve hostname to IP address,
 * returns null in case of error
 */
module.exports = {
    lookup: function lookup(hostname) {
        return module.exports.resolve(hostname);
    },
    resolve: function resolve(hostname, type) {
        var nodeBinary = process.execPath;

        if (!isValidHostName(hostname)) {
            console.error('Invalid hostname:', hostname);
            return null;
        }

        var scriptPath = path.join(__dirname, "../scripts/dns-lookup-script"),
            response,
            cmd = util.format('"%s" "%s" %s %s', nodeBinary, scriptPath, hostname, type || '');

        response = shell.exec(cmd, {silent: true});
        if (response && response.code === 0) {
            return JSON.parse(response.stdout);
        }
        debug('hostname', "fail to resolve hostname " + hostname);
        return null;
    }
};


Fixed version (ground truth):
'use strict';

var util = require('util'),
    path = require('path'),
    shell = require('shelljs'),
    debug = require('debug')('dns-sync');

//source - http://stackoverflow.com/questions/106179/regular-expression-to-match-dns-hostname-or-ip-address
var ValidHostnameRegex = new RegExp("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$");

// https://nodejs.org/api/dns.html#dns_dns_resolve_hostname_rrtype_callback
var RRecordTypes = [
    'A',
    'AAAA',
    'NS',
    'NAPTR',
    'CNAME',
    'SOA',
    'SRV',
    'PTR',
    'MX',
    'TXT',
    'ANY'];

function isValidHostName(hostname) {
    return ValidHostnameRegex.test(hostname);
}
/**
 * Resolve hostname to IP address,
 * returns null in case of error
 */
module.exports = {
    lookup: function lookup(hostname) {
        return module.exports.resolve(hostname);
    },
    resolve: function resolve(hostname, type) {
        var nodeBinary = process.execPath;

        if (!isValidHostName(hostname)) {
            console.error('Invalid hostname:', hostname);
            return null;
        }
        if (typeof type !== 'undefined' && RRecordTypes.indexOf(type) === -1) {
            console.error('Invalid rrtype:', type);
            return null;
        }

        var scriptPath = path.join(__dirname, "../scripts/dns-lookup-script"),
            response,
            cmd = util.format('"%s" "%s" %s %s', nodeBinary, scriptPath, hostname, type || '');

        response = shell.exec(cmd, {silent: true});
        if (response && response.code === 0) {
            return JSON.parse(response.stdout);
        }
        debug('hostname', "fail to resolve hostname " + hostname);
        return null;
    }
};
Program: CWE-77
Project: CVE-2020-28446
Buggy source:
{
  "name": "ntesseract",
  "version": "0.2.8",
  "authors": [
    "Tao Yuan <towyuan@outlook.com>",
    "Desmond Morris <hi@desmondmorris.com>"
  ],
  "description": "A simple wrapper for the Tesseract OCR package",
  "main": "index.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/taoyuan/ntesseract/"
  },
  "keywords": [
    "tesseract",
    "ocr",
    "text recognition"
  ],
  "dependencies": {
    "glob": "^7.1.6",
    "lodash.assign": "^4.2.0",
    "node-uuid": "^1.4.7"
  },
  "devDependencies": {
    "chai": "^4.2.0",
    "mocha": "~8.2.1"
  },
  "scripts": {
    "test": "mocha"
  },
  "license": "MIT",
  "engine": {
    "node": ">=0.6"
  }
}


Fixed version (ground truth):
{
  "name": "ntesseract",
  "version": "0.2.8",
  "authors": [
    "Tao Yuan <towyuan@outlook.com>",
    "Desmond Morris <hi@desmondmorris.com>"
  ],
  "description": "A simple wrapper for the Tesseract OCR package",
  "main": "index.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/taoyuan/ntesseract/"
  },
  "keywords": [
    "tesseract",
    "ocr",
    "text recognition"
  ],
  "dependencies": {
    "glob": "^7.1.6",
    "lodash.assign": "^4.2.0",
    "node-uuid": "^1.4.7"
  },
  "devDependencies": {
    "chai": "^4.2.0",
    "mocha": "~8.2.1"
  },
  "scripts": {
    "test": "mocha"
  },
  "license": "MIT",
  "engine": {
    "node": ">=8.0"
  }
}
Program: CWE-77
Project: CVE-2020-28451
Buggy source:
/*global jasmine*/
var fs = require('fs');
var execSync = require('child_process').execSync;
var rimraf = require('rimraf');
var expectImagesToBeTheSame = require('./expectImagesToBeTheSame.helper.js').expectImagesToBeTheSame;

jasmine.DEFAULT_TIMEOUT_INTERVAL = 600000;
var tmpDir = process.env.TMPDIR || '/tmp';
var tempDir = tmpDir + '/imagetiler_spec_' + process.pid;

describe('image-tiler cli', function () {
    beforeEach(function () {
        fs.mkdirSync(tempDir);
    });
    describe('When used on an image smaller than the tile size', function () {
        it('should output the same image', function (done) {
            execSync('node bin/image-tiler spec/small.png ' + tempDir + ' small_test_result_{z}_{x}_{y}.png');
            expectImagesToBeTheSame(tempDir + '/small_test_result_0_0_0.png', 'spec/expected/small-test.png')
            .then(done)
            .catch(done.fail);
        });
    });

    afterEach(function () {
        rimraf.sync(tempDir);
    });

});




Fixed version (ground truth):
/*global jasmine*/
var fs = require('fs');
var execFileSync = require('child_process').execFileSync;
var rimraf = require('rimraf');
var expectImagesToBeTheSame = require('./expectImagesToBeTheSame.helper.js').expectImagesToBeTheSame;

jasmine.DEFAULT_TIMEOUT_INTERVAL = 600000;
var tmpDir = process.env.TMPDIR || '/tmp';
var tempDir = tmpDir + '/imagetiler_spec_' + process.pid;

describe('image-tiler cli', function () {
    beforeEach(function () {
        fs.mkdirSync(tempDir);
    });
    describe('When used on an image smaller than the tile size', function () {
        it('should output the same image', function (done) {
            execFileSync('node', ['bin/image-tiler', 'spec/small.png', tempDir, 'small_test_result_{z}_{x}_{y}.png']);
            expectImagesToBeTheSame(tempDir + '/small_test_result_0_0_0.png', 'spec/expected/small-test.png')
                .then(done)
                .catch(done.fail);
        });
    });

    afterEach(function () {
        rimraf.sync(tempDir);
    });

});
Program: CWE-77
Project: CVE-2020-7795
Buggy source:
module.exports = function (packageName, { registry = '', timeout = null } = {}) {
    try {
        let version;

        const config = {
            stdio: ['pipe', 'pipe', 'ignore']
        };

        if (timeout) {
            config.timeout = timeout;
        }

        if (registry) {
            version = require('child_process').execSync(`npm view ${packageName} version --registry ${registry}`, config);
        } else {
            version = require('child_process').execSync(`npm view ${packageName} version`, config);
        }

        if (version) {
            return version.toString().trim().replace(/^\n*/, '').replace(/\n*$/, '');
        } else {
            return null;
        }

    } catch(err) {
        return null;
    }
}


Fixed version (ground truth):
module.exports = function (packageName, { registry = '', timeout = null } = {}) {
    try {
        if (/[`$&{}[;|]/g.test(packageName) || /[`$&{}[;|]/g.test(registry)) {
            return null
        }
        let version;

        const config = {
            stdio: ['pipe', 'pipe', 'ignore']
        };

        if (timeout) {
            config.timeout = timeout;
        }

        if (registry) {
            version = require('child_process').execSync(`npm view ${packageName} version --registry ${registry}`, config);
        } else {
            version = require('child_process').execSync(`npm view ${packageName} version`, config);
        }

        if (version) {
            return version.toString().trim().replace(/^\n*/, '').replace(/\n*$/, '');
        } else {
            return null;
        }

    } catch(err) {
        return null;
    }
}
Program: CWE-77
Project: CVE-2020-8298
Buggy source:
{
  "name": "fs-path",
  "version": "0.0.24",
  "main": "lib/index.js",
  "author": {
    "name": "pillys",
    "email": "pillys@163.com",
    "url": "http://www.qque.com"
  },
  "keywords": [
    "fs-path",
    "file",
    "directory"
  ],
  "repository": {
    "url": "https://github.com/pillys/fs-path",
    "type": "git"
  },
  "bugs": {
    "url": "https://github.com/pillys/fs-path/issues"
  },
  "homepage": "https://github.com/pillys/fs-path",
  "dependencies": {
    "async": "~0.9.0"
  },
  "description": "file and directory op libs, find, findSync, mkdir, mkdirSync, copy, copySync, remove, removeSync, writeFile, writeFileSync",
  "readmeFilename": "README.md",
  "license": "MIT"
}

Fixed version (ground truth):
{
  "name": "fs-path",
  "version": "0.0.24",
  "main": "lib/index.js",
  "author": {
    "name": "pillys",
    "email": "pillys@163.com",
    "url": "http://www.qque.com"
  },
  "keywords": [
    "fs-path",
    "file",
    "directory"
  ],
  "repository": {
    "url": "https://github.com/pillys/fs-path",
    "type": "git"
  },
  "bugs": {
    "url": "https://github.com/pillys/fs-path/issues"
  },
  "homepage": "https://github.com/pillys/fs-path",
  "dependencies": {
    "async": "~0.9.0",
    "shell-escape": "^0.2.0"
  },
  "description": "file and directory op libs, find, findSync, mkdir, mkdirSync, copy, copySync, remove, removeSync, writeFile, writeFileSync",
  "readmeFilename": "README.md",
  "license": "MIT"
}
Program: CWE-77
Project: CVE-2021-27185
Buggy source:
{
  "name": "fs-path",
  "version": "0.0.24",
  "main": "lib/index.js",
  "author": {
    "name": "pillys",
    "email": "pillys@163.com",
    "url": "http://www.qque.com"
  },
  "keywords": [
    "fs-path",
    "file",
    "directory"
  ],
  "repository": {
    "url": "https://github.com/pillys/fs-path",
    "type": "git"
  },
  "bugs": {
    "url": "https://github.com/pillys/fs-path/issues"
  },
  "homepage": "https://github.com/pillys/fs-path",
  "dependencies": {
    "async": "~0.9.0"
  },
  "description": "file and directory op libs, find, findSync, mkdir, mkdirSync, copy, copySync, remove, removeSync, writeFile, writeFileSync",
  "readmeFilename": "README.md",
  "license": "MIT"
}

Fixed version (ground truth):
{
  "name": "fs-path",
  "version": "0.0.24",
  "main": "lib/index.js",
  "author": {
    "name": "pillys",
    "email": "pillys@163.com",
    "url": "http://www.qque.com"
  },
  "keywords": [
    "fs-path",
    "file",
    "directory"
  ],
  "repository": {
    "url": "https://github.com/pillys/fs-path",
    "type": "git"
  },
  "bugs": {
    "url": "https://github.com/pillys/fs-path/issues"
  },
  "homepage": "https://github.com/pillys/fs-path",
  "dependencies": {
    "async": "~0.9.0",
    "shell-escape": "^0.2.0"
  },
  "description": "file and directory op libs, find, findSync, mkdir, mkdirSync, copy, copySync, remove, removeSync, writeFile, writeFileSync",
  "readmeFilename": "README.md",
  "license": "MIT"
}
Program: CWE-77
Project: CVE-2022-25866
Buggy source:
<?php

use Tester\Assert;
use CzProject\GitPhp\Git;
use CzProject\GitPhp\GitException;
use CzProject\GitPhp\Tests\AssertRunner;

require __DIR__ . '/bootstrap.php';

$runner = new AssertRunner(__DIR__);
$git = new Git($runner);

$runner->assert(['clone', '-q', 'git@github.com:czproject/git-php.git', __DIR__]);
$runner->assert(['remote', 'add', 'origin2', 'git@github.com:czproject/git-php.git']);
$runner->assert(['remote', 'add', 'remote', 'git@github.com:czproject/git-php.git']);
$runner->assert(['remote', 'add', [
	'--mirror=push',
], 'only-push', 'test-url']);
$runner->assert(['remote', 'rename', 'remote', 'origin3']);
$runner->assert(['remote', 'set-url', [
	'--push',
], 'origin3', 'test-url']);
$runner->assert(['remote', 'remove', 'origin2']);

$repo = $git->cloneRepository('git@github.com:czproject/git-php.git', __DIR__);
$repo->addRemote('origin2', 'git@github.com:czproject/git-php.git');
$repo->addRemote('remote', 'git@github.com:czproject/git-php.git');
$repo->addRemote('only-push', 'test-url', [
	'--mirror=push',
]);
$repo->renameRemote('remote', 'origin3');
$repo->setRemoteUrl('origin3', 'test-url', [
	'--push',
]);
$repo->removeRemote('origin2');

$runner->assert(['push', 'origin']);
$runner->assert(['fetch', 'origin']);
$runner->assert(['pull', 'origin']);
$repo->push('origin');
$repo->fetch('origin');
$repo->pull('origin');


Fixed version (ground truth):
<?php

use Tester\Assert;
use CzProject\GitPhp\Git;
use CzProject\GitPhp\GitException;
use CzProject\GitPhp\Tests\AssertRunner;

require __DIR__ . '/bootstrap.php';

$runner = new AssertRunner(__DIR__);
$git = new Git($runner);

$runner->assert(['clone', '-q', '--end-of-options', 'git@github.com:czproject/git-php.git', __DIR__]);
$runner->assert(['remote', 'add', '--end-of-options', 'origin2', 'git@github.com:czproject/git-php.git']);
$runner->assert(['remote', 'add', '--end-of-options', 'remote', 'git@github.com:czproject/git-php.git']);
$runner->assert(['remote', 'add', [
	'--mirror=push',
], '--end-of-options', 'only-push', 'test-url']);
$runner->assert(['remote', 'rename', '--end-of-options', 'remote', 'origin3']);
$runner->assert(['remote', 'set-url', [
	'--push',
], '--end-of-options', 'origin3', 'test-url']);
$runner->assert(['remote', 'remove', '--end-of-options', 'origin2']);

$repo = $git->cloneRepository('git@github.com:czproject/git-php.git', __DIR__);
$repo->addRemote('origin2', 'git@github.com:czproject/git-php.git');
$repo->addRemote('remote', 'git@github.com:czproject/git-php.git');
$repo->addRemote('only-push', 'test-url', [
	'--mirror=push',
]);
$repo->renameRemote('remote', 'origin3');
$repo->setRemoteUrl('origin3', 'test-url', [
	'--push',
]);
$repo->removeRemote('origin2');

$runner->assert(['push', '--end-of-options', 'origin']);
$runner->assert(['fetch', '--end-of-options', 'origin']);
$runner->assert(['pull', '--end-of-options', 'origin']);
$repo->push('origin');
$repo->fetch('origin');
$repo->pull('origin');
Program: CWE-119
Project: CVE-2012-1176
Buggy source:

/*
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/* Copyright (C) 2005,2006,2010 Yaacov Zamir, Nir Soffer */

/* 	FriBidi python binding:
    
    Install:
	python setup.py install
    
 */

#ifndef __PYFRIBIDI_H__
#define __PYFRIBIDI_H__

static PyObject *_pyfribidi_log2vis (PyObject * self, PyObject * args,
				     PyObject * kw);

static PyObject *log2vis_unicode (PyObject * unicode,
				  FriBidiParType base_direction, int clean, int reordernsm);

static PyObject *log2vis_encoded_string (PyObject * string,
					 const char *encoding,
					 FriBidiParType base_direction, int clean, int reordernsm);

static PyObject *log2vis_utf8 (PyObject * string, int unicode_length,
			       FriBidiParType base_direction, int clean, int reordernsm);

PyMODINIT_FUNC initpyfribidi (void);

PyDoc_STRVAR (_pyfribidi__doc__,
	      "simple Python binding for fribidi.\n\n"
	      "pyfribidi uses libfribidi to order text visually using the unicode\n"
	      "algorithm. pyfribidi can also convert text from visual order to\n"
	      "logical order, but the conversion may be wrong in certain cases.\n");

/* Based on fribidi-0.10.7 README */
PyDoc_STRVAR (_pyfribidi_log2vis__doc__,
	      "log2vis(logical, base_direction=RTL , encoding='utf-8') -> visual\n\n"
	      "Return string reordered visually according to base direction.\n"
	      "Return the same type of input string, either unicode or string using\n"
	      "encoding.\n\n"
	      "Note that this function does not handle line breaking. You should\n"
	      "call log2vis with each line.\n\n"
	      "Arguments:\n\n"
	      "- logical: unicode or encoded string\n"
	      "- base_direction: optional logical base direction. Accepts one of\n"
	      "  the constants LTR, RTL or ON, defined in this module. ON calculate\n"
	      "  the base direction according to the BiDi algorithm.\n"
	      "- encoding: optional string encoding (ignored for unicode input)\n");

#endif /* __PYFRIBIDI_H__ */


Fixed version (ground truth):
None
Program: CWE-119
Project: CVE-2015-8869
Buggy source:
4.03.0+dev10-2015-07-29

# The version string is the first line of this file.
# It must be in the format described in stdlib/sys.mli


Fixed version (ground truth):
4.03.0+dev11-2015-10-19

# The version string is the first line of this file.
# It must be in the format described in stdlib/sys.mli
Program: CWE-119
Project: CVE-2016-10375
Buggy source:
#define VERSION "3.06.00"
#define YEARS   "1996-2015"


Fixed version (ground truth):
#define VERSION "3.07.00"
#define YEARS   "1996-2016"
Program: CWE-119
Project: CVE-2016-2533
Buggy source:
/*
 * The Python Imaging Library.
 * $Id$
 *
 * decoder for uncompressed PCD image data.
 *
 * history:
 *	96-05-10 fl	Created
 *	96-05-18 fl	New tables
 *	97-01-25 fl	Use PhotoYCC unpacker
 *
 * notes:
 *	This driver supports uncompressed PCD modes only
 *	(resolutions up to 768x512).
 *
 * Copyright (c) Fredrik Lundh 1996-97.
 * Copyright (c) Secret Labs AB 1997.
 *
 * See the README file for information on usage and redistribution.
 */


#include "Imaging.h"


int
ImagingPcdDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
{
    int x;
    int chunk;
    UINT8* out;
    UINT8* ptr;

    ptr = buf;

    chunk = 3 * state->xsize;

    for (;;) {

	/* We need data for two full lines before we can do anything */
	if (bytes < chunk)
	    return ptr - buf;

	/* Unpack first line */
	out = state->buffer;
	for (x = 0; x < state->xsize; x++) {
	    out[0] = ptr[x];
	    out[1] = ptr[(x+4*state->xsize)/2];
	    out[2] = ptr[(x+5*state->xsize)/2];
	    out += 4;
	}

	state->shuffle((UINT8*) im->image[state->y],
		       state->buffer, state->xsize);

	if (++state->y >= state->ysize)
	    return -1; /* This can hardly happen */

	/* Unpack second line */
	out = state->buffer;
	for (x = 0; x < state->xsize; x++) {
	    out[0] = ptr[x+state->xsize];
	    out[1] = ptr[(x+4*state->xsize)/2];
	    out[2] = ptr[(x+5*state->xsize)/2];
	    out += 4;
	}

	state->shuffle((UINT8*) im->image[state->y],
		       state->buffer, state->xsize);

	if (++state->y >= state->ysize)
	    return -1;

	ptr += chunk;
	bytes -= chunk;

    }
}


Fixed version (ground truth):
/*
 * The Python Imaging Library.
 * $Id$
 *
 * decoder for uncompressed PCD image data.
 *
 * history:
 *	96-05-10 fl	Created
 *	96-05-18 fl	New tables
 *	97-01-25 fl	Use PhotoYCC unpacker
 *
 * notes:
 *	This driver supports uncompressed PCD modes only
 *	(resolutions up to 768x512).
 *
 * Copyright (c) Fredrik Lundh 1996-97.
 * Copyright (c) Secret Labs AB 1997.
 *
 * See the README file for information on usage and redistribution.
 */


#include "Imaging.h"


int
ImagingPcdDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
{
    int x;
    int chunk;
    UINT8* out;
    UINT8* ptr;

    ptr = buf;

    chunk = 3 * state->xsize;

    for (;;) {

	/* We need data for two full lines before we can do anything */
	if (bytes < chunk)
	    return ptr - buf;

	/* Unpack first line */
	out = state->buffer;
	for (x = 0; x < state->xsize; x++) {
	    out[0] = ptr[x];
	    out[1] = ptr[(x+4*state->xsize)/2];
	    out[2] = ptr[(x+5*state->xsize)/2];
	    out += 3;
	}

	state->shuffle((UINT8*) im->image[state->y],
		       state->buffer, state->xsize);

	if (++state->y >= state->ysize)
	    return -1; /* This can hardly happen */

	/* Unpack second line */
	out = state->buffer;
	for (x = 0; x < state->xsize; x++) {
	    out[0] = ptr[x+state->xsize];
	    out[1] = ptr[(x+4*state->xsize)/2];
	    out[2] = ptr[(x+5*state->xsize)/2];
	    out += 3;
	}

	state->shuffle((UINT8*) im->image[state->y],
		       state->buffer, state->xsize);

	if (++state->y >= state->ysize)
	    return -1;

	ptr += chunk;
	bytes -= chunk;

    }
}
Program: CWE-119
Project: CVE-2016-7418
Buggy source:
None

Fixed version (ground truth):
--TEST--
Bug #73065: Out-Of-Bounds Read in php_wddx_push_element of wddx.c
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml1 = <<<XML
<?xml version='1.0' ?>
    <!DOCTYPE et SYSTEM 'w'>
    <wddxPacket ven='1.0'>
        <array>
            <var Name="name">
                <boolean value="keliu"></boolean>
            </var>
            <var name="1111">
                <var name="2222">
                    <var name="3333"></var>
                </var>
            </var>
        </array>
    </wddxPacket>
XML;
    
$xml2 = <<<XML
<?xml version='1.0' ?>
    <!DOCTYPE et SYSTEM 'w'>
    <wddxPacket ven='1.0'>
        <array>
            <char Name="code">
                <boolean value="keliu"></boolean>
            </char>
        </array>
    </wddxPacket>
XML;

$xml3 = <<<XML
<?xml version='1.0' ?>
    <!DOCTYPE et SYSTEM 'w'>
    <wddxPacket ven='1.0'>
        <array>
            <boolean Name="value">
                <boolean value="keliu"></boolean>
            </boolean>
        </array>
    </wddxPacket>
XML;

$xml4 = <<<XML
<?xml version='1.0' ?>
    <!DOCTYPE et SYSTEM 'w'>
    <wddxPacket ven='1.0'>
        <array>
            <recordset Name="fieldNames">
                <boolean value="keliu"></boolean>
            </recordset>
        </array>
    </wddxPacket>
XML;

$xml5 = <<<XML
<?xml version='1.0' ?>
    <!DOCTYPE et SYSTEM 'w'>
    <wddxPacket ven='1.0'>
        <array>
            <field Name="name">
                <boolean value="keliu"></boolean>
            </field>
        </array>
    </wddxPacket>
XML;

for($i=1;$i<=5;$i++) {
	$xmlvar = "xml$i";
    $array = wddx_deserialize($$xmlvar);
    var_dump($array);
}
?>
DONE
--EXPECTF--
array(0) {
}
array(0) {
}
array(0) {
}
array(1) {
  [0]=>
  array(0) {
  }
}
array(0) {
}
DONE
Program: CWE-119
Project: CVE-2016-8860
Buggy source:
None

Fixed version (ground truth):
  o Major features (security fixes):

    - Prevent a class of security bugs caused by treating the contents
      of a buffer chunk as if they were a NUL-terminated string.  At
      least one such bug seems to be present in all currently used
      versions of Tor, and would allow an attacker to remotely crash
      most Tor instances, especially those compiled with extra compiler
      hardening. With this defense in place, such bugs can't crash Tor,
      though we should still fix them as they occur. Closes ticket 20384
      (TROVE-2016-10-001).
Program: CWE-119
Project: CVE-2017-0028
Buggy source:
//-------------------------------------------------------------------------------------------------------
// Copyright (C) Microsoft. All rights reserved.
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
//-------------------------------------------------------------------------------------------------------

var count = 0;
class A {
    constructor() { count++; }
    increment() { count++; }
}
class B extends A {
    constructor() {
        super();
        ((B) => { super.increment() })();
        (A=> { super.increment() })();
        let C = async (B) => { B };
        let D = async A => { A };
    }
}
let b = new B();
if (count !== 3) {
    WScript.Echo('fail');
}

WScript.Echo('pass');


Fixed version (ground truth):
//-------------------------------------------------------------------------------------------------------
// Copyright (C) Microsoft. All rights reserved.
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
//-------------------------------------------------------------------------------------------------------

var count = 0;
class A {
    constructor() { count++; }
    increment() { count++; }
}
class B extends A {
    constructor() {
        super();
        ((B) => { super.increment() })();
        (A=> { super.increment() })();
        let C = async (B) => { B };
        let D = async A => { A };
    }
}
let b = new B();
class async extends A {
    constructor() {
        super();
        let Q = async A => { A };
    }
}
let a = new async();
if (count !== 4) {
    WScript.Echo('fail');
}

WScript.Echo('pass');
Program: CWE-119
Project: CVE-2017-16931
Buggy source:
None

Fixed version (ground truth):
<!ENTITY % ent "value">
%ä%ent;
Program: CWE-119
Project: CVE-2018-7584
Buggy source:
None

Fixed version (ground truth):
--TEST--
Bug #75981 (stack-buffer-overflow while parsing HTTP response)
--INI--
allow_url_fopen=1
--SKIPIF--
<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?>
--FILE--
<?php
require 'server.inc';

$options = [
  'http' => [
    'protocol_version' => '1.1',
    'header' => 'Connection: Close'
  ],
];

$ctx = stream_context_create($options);

$responses = [
	"data://text/plain,000000000100\xA\xA"
];
$pid = http_server('tcp://127.0.0.1:12342', $responses);

echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx);

http_server_kill($pid);

?>
DONE
--EXPECT--
DONE
Program: CWE-119
Project: CVE-2019-11929
Buggy source:
None

Fixed version (ground truth):
<?hh
// Copyright 2004-present Facebook. All Rights Reserved.

<<__EntryPoint>>
function main() {
  $bin_repr = "\x00\x00\x00\x00\x00\x00\x00\x80";
  $double_num = unpack("dnum", $bin_repr)['num'];
  var_dump(number_format($double_num, 100));
}
Program: CWE-119
Project: CVE-2020-1899
Buggy source:
None

Fixed version (ground truth):
Notice: Unable to unserialize: [O:3:"foo":1:{S:]. Unknown type 'S'. in %s/no-apc-string-pointer.php on line 10
bool(false)
Program: CWE-119
Project: CVE-2020-24074
Buggy source:
None

Fixed version (ground truth):
Notice: Unable to unserialize: [O:3:"foo":1:{S:]. Unknown type 'S'. in %s/no-apc-string-pointer.php on line 10
bool(false)
Program: CWE-798
Project: CVE-2019-15075
Buggy source:
; ASTPP Database Connection Information
dbhost = 127.0.0.1
dbname = astpp
dbuser = astppuser
dbpass = <PASSSWORD>


; Database type:  ASTPP was designed for a MySQL database initially.  Valid options are:
; MySQL. Pgsql is coming but is not ready yet.
astpp_dbengine = MySQLi

; Do we want the startup of ASTPP debugged?
debug = 0

;Define Baseurl
;Note : Default we are running ASTPP on 8089. So, please do not remove 8089 from url.
base_url=http://localhost:8089/


Fixed version (ground truth):
; ASTPP Database Connection Information
dbhost = 127.0.0.1
dbname = astpp
dbuser = astppuser
dbpass = <PASSSWORD>
PRIVATE_KEY = <PR_KEY>
ENCRYPTION_KEY = <EN_KEY>

; Database type:  ASTPP was designed for a MySQL database initially.  Valid options are:
; MySQL. Pgsql is coming but is not ready yet.
astpp_dbengine = MySQLi

; Do we want the startup of ASTPP debugged?
debug = 0

;Define Baseurl
;Note : Default we are running ASTPP on 8089. So, please do not remove 8089 from url.
base_url=http://localhost:8089/
Program: CWE-918
Project: CVE-2017-7272
Buggy source:
None

Fixed version (ground truth):
--TEST--
Use of double-port in fsockopen()
--FILE--
<?php

$try = [
  '127.0.0.1:80',
  'tcp://127.0.0.1:80',
  '[::1]:80',
  'tcp://[::1]:80',
  'localhost:80',
  'tcp://localhost:80',
];

foreach ($try as $addr) {
  echo "== $addr ==\n";
  var_dump(@fsockopen($addr, 81, $errno, $errstr), $errstr);
}
--EXPECTF--
== 127.0.0.1:80 ==
bool(false)
string(41) "Failed to parse address "127.0.0.1:80:81""
== tcp://127.0.0.1:80 ==
bool(false)
string(41) "Failed to parse address "127.0.0.1:80:81""
== [::1]:80 ==
bool(false)
string(37) "Failed to parse address "[::1]:80:81""
== tcp://[::1]:80 ==
bool(false)
string(37) "Failed to parse address "[::1]:80:81""
== localhost:80 ==
bool(false)
string(41) "Failed to parse address "localhost:80:81""
== tcp://localhost:80 ==
bool(false)
string(41) "Failed to parse address "localhost:80:81""
Program: CWE-918
Project: CVE-2019-17670
Buggy source:
<?php
/**
 * WordPress Version
 *
 * Contains version information for the current WordPress release.
 *
 * @package WordPress
 * @since 1.1.0
 */

/**
 * The WordPress version string
 *
 * @global string $wp_version
 */
$wp_version = '5.3-beta3-46471';

/**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
$wp_db_version = 45805;

/**
 * Holds the TinyMCE version
 *
 * @global string $tinymce_version
 */
$tinymce_version = '4960-20190918';

/**
 * Holds the required PHP version
 *
 * @global string $required_php_version
 */
$required_php_version = '5.6.20';

/**
 * Holds the required MySQL version
 *
 * @global string $required_mysql_version
 */
$required_mysql_version = '5.0';


Fixed version (ground truth):
<?php
/**
 * WordPress Version
 *
 * Contains version information for the current WordPress release.
 *
 * @package WordPress
 * @since 1.1.0
 */

/**
 * The WordPress version string
 *
 * @global string $wp_version
 */
$wp_version = '5.3-beta3-46472';

/**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
$wp_db_version = 45805;

/**
 * Holds the TinyMCE version
 *
 * @global string $tinymce_version
 */
$tinymce_version = '4960-20190918';

/**
 * Holds the required PHP version
 *
 * @global string $required_php_version
 */
$required_php_version = '5.6.20';

/**
 * Holds the required MySQL version
 *
 * @global string $required_mysql_version
 */
$required_mysql_version = '5.0';
Program: CWE-918
Project: CVE-2020-15152
Buggy source:
const Promise = require('bluebird');
const {expect} = require('chai');
const sinon = require('sinon');

const CMD = 'OPTS';
describe(CMD, function () {
  let sandbox;
  const mockClient = {
    reply: () => Promise.resolve()
  };
  const cmdFn = require(`../../../src/commands/registration/${CMD.toLowerCase()}`).handler.bind(mockClient);

  beforeEach(() => {
    sandbox = sinon.sandbox.create().usingPromise(Promise);

    sandbox.spy(mockClient, 'reply');
  });
  afterEach(() => {
    sandbox.restore();
  });

  it('// unsuccessful', () => {
    return cmdFn()
    .then(() => {
      expect(mockClient.reply.args[0][0]).to.equal(501);
    });
  });

  it('BAD // unsuccessful', () => {
    return cmdFn({command: {arg: 'BAD', directive: CMD}})
    .then(() => {
      expect(mockClient.reply.args[0][0]).to.equal(500);
    });
  });

  it('UTF8 BAD // unsuccessful', () => {
    return cmdFn({command: {arg: 'UTF8 BAD', directive: CMD}})
    .then(() => {
      expect(mockClient.reply.args[0][0]).to.equal(501);
    });
  });

  it('UTF8 OFF // successful', () => {
    return cmdFn({command: {arg: 'UTF8 OFF', directive: CMD}})
    .then(() => {
      expect(mockClient.encoding).to.equal('ascii');
      expect(mockClient.reply.args[0][0]).to.equal(200);
    });
  });

  it('UTF8 ON // successful', () => {
    return cmdFn({command: {arg: 'UTF8 ON', directive: CMD}})
    .then(() => {
      expect(mockClient.encoding).to.equal('utf8');
      expect(mockClient.reply.args[0][0]).to.equal(200);
    });
  });
});


Fixed version (ground truth):
const Promise = require('bluebird');
const {expect} = require('chai');
const sinon = require('sinon');

const CMD = 'OPTS';
describe(CMD, function () {
  let sandbox;
  const mockClient = {
    reply: () => Promise.resolve()
  };
  const cmdFn = require(`../../../src/commands/registration/${CMD.toLowerCase()}`).handler.bind(mockClient);

  beforeEach(() => {
    sandbox = sinon.sandbox.create().usingPromise(Promise);

    sandbox.spy(mockClient, 'reply');
  });
  afterEach(() => {
    sandbox.restore();
  });

  it('// unsuccessful', () => {
    return cmdFn()
    .then(() => {
      expect(mockClient.reply.args[0][0]).to.equal(501);
    });
  });

  it('BAD // unsuccessful', () => {
    return cmdFn({command: {arg: 'BAD', directive: CMD}})
    .then(() => {
      expect(mockClient.reply.args[0][0]).to.equal(501);
    });
  });

  it('UTF8 BAD // unsuccessful', () => {
    return cmdFn({command: {arg: 'UTF8 BAD', directive: CMD}})
    .then(() => {
      expect(mockClient.reply.args[0][0]).to.equal(501);
    });
  });

  it('UTF8 OFF // successful', () => {
    return cmdFn({command: {arg: 'UTF8 OFF', directive: CMD}})
    .then(() => {
      expect(mockClient.encoding).to.equal('ascii');
      expect(mockClient.reply.args[0][0]).to.equal(200);
    });
  });

  it('UTF8 ON // successful', () => {
    return cmdFn({command: {arg: 'UTF8 ON', directive: CMD}})
    .then(() => {
      expect(mockClient.encoding).to.equal('utf8');
      expect(mockClient.reply.args[0][0]).to.equal(200);
    });
  });
});
Program: CWE-918
Project: CVE-2021-37711
Buggy source:
<?php declare(strict_types=1);

namespace Shopware\Core\Content\Media\File;

use Shopware\Core\System\Annotation\Concept\ExtensionPattern\Decoratable;

/**
 * @Decoratable
 */
class FileUrlValidator implements FileUrlValidatorInterface
{
    public function isValid(string $source): bool
    {
        $host = parse_url($source, \PHP_URL_HOST);
        $ip = gethostbyname($host);

        // Potentially IPv6
        $ip = trim($ip, '[]');

        $ip = filter_var(
            $ip,
            \FILTER_VALIDATE_IP,
            \FILTER_FLAG_NO_PRIV_RANGE | \FILTER_FLAG_NO_RES_RANGE
        );

        if (!$ip) {
            return false;
        }

        return true;
    }
}


Fixed version (ground truth):
<?php declare(strict_types=1);

namespace Shopware\Core\Content\Media\File;

use Shopware\Core\System\Annotation\Concept\ExtensionPattern\Decoratable;

/**
 * @Decoratable
 */
class FileUrlValidator implements FileUrlValidatorInterface
{
    public function isValid(string $source): bool
    {
        $host = parse_url($source, \PHP_URL_HOST);
        $ip = gethostbyname($host);

        // Potentially IPv6
        $ip = trim($ip, '[]');

        return $this->validateIp($ip);
    }

    private function validateIp(string $ip): bool
    {
        $ip = filter_var(
            $ip,
            \FILTER_VALIDATE_IP,
            \FILTER_FLAG_NO_PRIV_RANGE | \FILTER_FLAG_NO_RES_RANGE
        );

        if (!$ip) {
            return false;
        }

        if (!filter_var($ip, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV6)) {
            return true;
        }

        // Convert IPv6 to packed format and back so we can check if there is a IPv4 representation of the IP
        $packedIp = inet_pton($ip);
        if (!$packedIp) {
            return false;
        }
        $convertedIp = inet_ntop($packedIp);
        if (!$convertedIp) {
            return false;
        }
        $convertedIp = explode(':', $convertedIp);
        $ipv4 = array_pop($convertedIp);

        // Additionally filter IPv4 representation of the IP
        if (filter_var($ipv4, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV4)) {
            return $this->validateIp($ipv4);
        }

        return true;
    }
}
Program: CWE-918
Project: CVE-2022-0508
Buggy source:
None

Fixed version (ground truth):
import { lookup } from 'dns'
import { parse as parseIP } from 'ipaddr.js'

function dnsLookupAll (hostname: string) {
  return new Promise<string[]>((res, rej) => {
    lookup(hostname, { family: 0, all: true }, (err, adresses) => {
      if (err) return rej(err)

      return res(adresses.map(a => a.address))
    })
  })
}

async function isResolvingToUnicastOnly (hostname: string) {
  const addresses = await dnsLookupAll(hostname)

  for (const address of addresses) {
    const parsed = parseIP(address)

    if (parsed.range() !== 'unicast') return false
  }

  return true
}

export {
  dnsLookupAll,
  isResolvingToUnicastOnly
}
Program: CWE-918
Project: CVE-2022-1767
Buggy source:
name: Build & Release

on:
  push:
      
jobs:
  build:
    runs-on: ubuntu-18.04
    if: github.ref == 'refs/heads/release'
    steps:
    - name: Checkout reposistory
      uses: actions/checkout@v2
      with:
        ref: 'release'
    - name: Get Submodule
      run: |
        git submodule init
        git config submodule.src/main/webapp/resources.url  https://${{secrets.I18N_USERNAME}}:${{secrets.I18N_ACCESS_KEY}}@github.com/jgraph/drawio-i18n.git
        git submodule update --init --recursive
    - name: Installing Node
      uses: actions/setup-node@v2
      with:
        node-version: 14
    - name: Build
      run: |
        cd etc/build
        npm install workbox-cli@6.3.0 --global
        ln -s `which workbox` /usr/local/bin/workbox
        ant
    - name: Tag and Push
      run: |
        export VERSION=`cat VERSION`
        git config user.name github-actions
        git config user.email github-actions@github.com
        git add .
        git commit -a -m "Ready for $VERSION"
        git push
        git tag "diagramly-${VERSION//\./_}"
        git push origin "diagramly-${VERSION//\./_}"


Fixed version (ground truth):
name: Build & Release

on:
  push:
    paths:
      - VERSION
jobs:
  build:
    runs-on: ubuntu-18.04
    if: github.ref == 'refs/heads/release'
    steps:
    - name: Checkout reposistory
      uses: actions/checkout@v2
      with:
        ref: 'release'
    - name: Get Submodule
      run: |
        git submodule init
        git config submodule.src/main/webapp/resources.url  https://${{secrets.I18N_USERNAME}}:${{secrets.I18N_ACCESS_KEY}}@github.com/jgraph/drawio-i18n.git
        git submodule update --init --recursive
    - name: Installing Node
      uses: actions/setup-node@v2
      with:
        node-version: 14
    - name: Build
      run: |
        cd etc/build
        npm install workbox-cli@6.3.0 --global
        ln -s `which workbox` /usr/local/bin/workbox
        ant
    - name: Tag and Push
      run: |
        export VERSION=`cat VERSION`
        git config user.name github-actions
        git config user.email github-actions@github.com
        git add .
        git commit -a -m "Ready for $VERSION"
        git push
        git tag "diagramly-${VERSION//\./_}"
        git push origin "diagramly-${VERSION//\./_}"
Program: CWE-918
Project: CVE-2022-1784
Buggy source:
name: Build & Release

on:
  push:
      
jobs:
  build:
    runs-on: ubuntu-18.04
    if: github.ref == 'refs/heads/release'
    steps:
    - name: Checkout reposistory
      uses: actions/checkout@v2
      with:
        ref: 'release'
    - name: Get Submodule
      run: |
        git submodule init
        git config submodule.src/main/webapp/resources.url  https://${{secrets.I18N_USERNAME}}:${{secrets.I18N_ACCESS_KEY}}@github.com/jgraph/drawio-i18n.git
        git submodule update --init --recursive
    - name: Installing Node
      uses: actions/setup-node@v2
      with:
        node-version: 14
    - name: Build
      run: |
        cd etc/build
        npm install workbox-cli@6.3.0 --global
        ln -s `which workbox` /usr/local/bin/workbox
        ant
    - name: Tag and Push
      run: |
        export VERSION=`cat VERSION`
        git config user.name github-actions
        git config user.email github-actions@github.com
        git add .
        git commit -a -m "Ready for $VERSION"
        git push
        git tag "diagramly-${VERSION//\./_}"
        git push origin "diagramly-${VERSION//\./_}"


Fixed version (ground truth):
name: Build & Release

on:
  push:
    paths:
      - VERSION
jobs:
  build:
    runs-on: ubuntu-18.04
    if: github.ref == 'refs/heads/release'
    steps:
    - name: Checkout reposistory
      uses: actions/checkout@v2
      with:
        ref: 'release'
    - name: Get Submodule
      run: |
        git submodule init
        git config submodule.src/main/webapp/resources.url  https://${{secrets.I18N_USERNAME}}:${{secrets.I18N_ACCESS_KEY}}@github.com/jgraph/drawio-i18n.git
        git submodule update --init --recursive
    - name: Installing Node
      uses: actions/setup-node@v2
      with:
        node-version: 14
    - name: Build
      run: |
        cd etc/build
        npm install workbox-cli@6.3.0 --global
        ln -s `which workbox` /usr/local/bin/workbox
        ant
    - name: Tag and Push
      run: |
        export VERSION=`cat VERSION`
        git config user.name github-actions
        git config user.email github-actions@github.com
        git add .
        git commit -a -m "Ready for $VERSION"
        git push
        git tag "diagramly-${VERSION//\./_}"
        git push origin "diagramly-${VERSION//\./_}"
Program: CWE-918
Project: CVE-2022-24856
Buggy source:
FROM node:16 as builder
LABEL org.opencontainers.image.source https://github.com/lyft/flyteconsole

WORKDIR /code/flyteconsole
COPY package*.json yarn.lock ./
RUN : \
  # install production dependencies
  && yarn install --production \
  # move the production dependencies to the /app folder
  && mkdir /app \
  && mv node_modules /app \
  # install development dependencies so we can build
  && yarn install

COPY . .
RUN : \
  # build
  && make build_prod \
  # place the runtime application in /app
  && mv dist corsProxy.js index.js env.js plugins.js /app

FROM gcr.io/distroless/nodejs
LABEL org.opencontainers.image.source https://github.com/lyft/flyteconsole

COPY --from=builder /app app
WORKDIR /app
ENV NODE_ENV=production PORT=8080
EXPOSE 8080

USER 1000

CMD ["index.js"]


Fixed version (ground truth):
FROM node:16 as builder
LABEL org.opencontainers.image.source https://github.com/lyft/flyteconsole

WORKDIR /code/flyteconsole
COPY package*.json yarn.lock ./
RUN : \
  # install production dependencies
  && yarn install --production \
  # move the production dependencies to the /app folder
  && mkdir /app \
  && mv node_modules /app \
  # install development dependencies so we can build
  && yarn install

COPY . .
RUN : \
  # build
  && make build_prod \
  # place the runtime application in /app
  && mv dist index.js env.js plugins.js /app

FROM gcr.io/distroless/nodejs
LABEL org.opencontainers.image.source https://github.com/lyft/flyteconsole

COPY --from=builder /app app
WORKDIR /app
ENV NODE_ENV=production PORT=8080
EXPOSE 8080

USER 1000

CMD ["index.js"]
Program: CWE-918
Project: CVE-2022-25850
Buggy source:
package main

import (
	"flag"
	"log"

	"github.com/hoppscotch/proxyscotch/libproxy"
)

func main() {
	hostPtr := flag.String("host", "localhost:9159", "the hostname that the server should listen on.")
	tokenPtr := flag.String("token", "", "the Proxy Access Token used to restrict access to the server.")
	allowedOriginsPtr := flag.String("allowed-origins", "*", "a comma separated list of allowed origins.")
	bannedOutputsPtr := flag.String("banned-outputs", "", "a comma separated list of banned outputs.")
	flag.Parse()

	finished := make(chan bool)
	libproxy.Initialize(*tokenPtr, *hostPtr, *allowedOriginsPtr, *bannedOutputsPtr, onProxyStateChangeServer, false, finished)

	<-finished
}

func onProxyStateChangeServer(status string, isListening bool) {
	log.Printf("[ready=%v] %s", isListening, status)
}


Fixed version (ground truth):
package main

import (
	"flag"
	"log"

	"github.com/hoppscotch/proxyscotch/libproxy"
)

func main() {
	hostPtr := flag.String("host", "localhost:9159", "the hostname that the server should listen on.")
	tokenPtr := flag.String("token", "", "the Proxy Access Token used to restrict access to the server.")
	allowedOriginsPtr := flag.String("allowed-origins", "*", "a comma separated list of allowed origins.")
	bannedOutputsPtr := flag.String("banned-outputs", "", "a comma separated list of banned outputs.")
	bannedDestsPtr := flag.String("banned-dests", "", "a comma separated list of banned proxy destinations.")

	flag.Parse()

	finished := make(chan bool)
	libproxy.Initialize(*tokenPtr, *hostPtr, *allowedOriginsPtr, *bannedOutputsPtr, *bannedDestsPtr, onProxyStateChangeServer, false, finished)

	<-finished
}

func onProxyStateChangeServer(status string, isListening bool) {
	log.Printf("[ready=%v] %s", isListening, status)
}
Program: CWE-918
Project: CVE-2022-2756
Buggy source:
﻿using System.IO;
using API.Services;
using Microsoft.AspNetCore.Mvc;

namespace API.Controllers
{
    public class FallbackController : Controller
    {
        // ReSharper disable once S4487
        // ReSharper disable once NotAccessedField.Local
        private readonly ITaskScheduler _taskScheduler;

        public FallbackController(ITaskScheduler taskScheduler)
        {
            // This is used to load TaskScheduler on startup without having to navigate to a Controller that uses.
            _taskScheduler = taskScheduler;
        }

        public ActionResult Index()
        {
            return PhysicalFile(Path.Combine(Directory.GetCurrentDirectory(), "wwwroot", "index.html"), "text/HTML");
        }
    }
}


Fixed version (ground truth):
﻿using System.IO;
using API.Services;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace API.Controllers;

[AllowAnonymous]
public class FallbackController : Controller
{
    // ReSharper disable once S4487
    // ReSharper disable once NotAccessedField.Local
    private readonly ITaskScheduler _taskScheduler;

    public FallbackController(ITaskScheduler taskScheduler)
    {
        // This is used to load TaskScheduler on startup without having to navigate to a Controller that uses.
        _taskScheduler = taskScheduler;
    }

    public ActionResult Index()
    {
        return PhysicalFile(Path.Combine(Directory.GetCurrentDirectory(), "wwwroot", "index.html"), "text/HTML");
    }
}
Program: CWE-918
Project: CVE-2022-29188
Buggy source:
---
    version: v1
    services:
      - name: test-trusted-srv
        project: security
        action: enforce
        allowed_domains:
          - notarealhost.test
          - httpbin.org
      - name: test-local-srv
        project: security
        action: open
        allowed_domains:
          - 127.0.0.1


Fixed version (ground truth):
---
version: v1
services:
  - name: test-trusted-srv
    project: security
    action: enforce
    allowed_domains:
      - notarealhost.test
      - httpbin.org
  - name: test-local-srv
    project: security
    action: open
    allowed_domains:
      - 127.0.0.1
  - name: test-open-srv
    project: security
    action: open

global_deny_list:
  - stripe.com