Program: CWE-94
Project: CVE-2021-23390
Buggy source:
========================
0.0.43
========================

- improved `flowinstance.newmessage(data)` method

========================
0.0.42
========================

- added support for JSON schemas
- added Total Messaging Service
- added `jsonschemas` directory
- added `schema.jsonschema(name)` method
- added `JSONSCHEMA()` method
- added `NEWJSONSCHEMA()` method
- added `NEWPUBLISH()` method
- added `NEWSUBSCRIBE()` method
- added `PUBLISH()` method
- added `SUBSCRIBE()` method
- added `UNSUBSCRIBE()` method
- added `watcher` event for the main process in `debug` or `release` mode with the watcher
- added HTML escaping for meta tags
- added `WebSocketClient.destroy()` method
- added new command `refresh_cmd`
- added `allow_totalapilogger {Boolean}` option to the configuration
- added `allow_totalapi {Boolean}` option to the configuration
- added `allow_tms {Boolean}` option to the configuration
- added `secret_tms {String}` option to the configuration
- added `schema.jsonschema_define()` method
- added `flowstream.load(components, design, [callback])` method
- added `flowstream.unload(components, design, [callback])` method
- added new delegate `flowstream.onreconfigure = function(instance) {}`
- added new delegate `flowstream.onconnect = function(instance) {}`
- added new delegate `flowstream.ondisconnect = function(instance) {}`
- added new delegate `flowstream.onregister = function(component) {}`
- added new delegate `flowstream.onunregister = function(component) {}`
- added `uistream.load(components, design, [callback])` method
- added `uistream.unload(components, design, [callback])` method
- added new delegate `uistream.onreconfigure = function(instance) {}`
- added new delegate `uistream.onconnect = function(instance) {}`
- added new delegate `uistream.ondisconnect = function(instance) {}`
- added new delegate `uistream.onregister = function(component) {}`
- added new delegate `uistream.onunregister = function(component) {}`
- fixed `Mail.attachmentfs()`
- fixed dynamic routing
- fixed security issue when parsing query arguments (reported by <https://github.com/fl4x>)
- extended `schema.addTask()` by adding a new argument `callback`
- added new method `flowstream.newmessage(data)`
- added new method `flowstream_instance.newmessage(data)`
- added `String.toJSONSchema(name, url)`
- added `bundles.debug` enables watcher for `.src` directory only

========================
0.0.41
========================

- added TypeScript support
- added support for static files in threads
- fixed logging in threads by Tomas Novak
- added `insecure` option to the `REQUEST()` method
- added `builder.insecure()` method to the `RESTBuilder` instance
- added `profile` type to the LDAP options
- extended `base64` by adding support for `content-type;base64,data` format
- updated `schema.define(key, type, required, [default_error_message])`
- fixed `String.encrypt_uid()`
- fixed `$.keys` in schemas with multiple operations
- fixed wildcard routing combinated with dynamic arguments

========================
0.0.40
========================

- added `U.reader().list()` method
- added `Array.findValue()`
- added async/await mechanism to TextDB
- added async/await mechanism to RESTBuilder
- threads supports views
- improved error handling in `TotalAPI()`
- improved `Database.scalar()` by adding new argument
- improved `QueryBuilder.in()` and `QueryBuilder.notin()`
- fixed UTF8 chars in multi-part parser
- fixed `NOSQL().autofill()`
- fixed converting date via `Date.setTimeZone()`
- fixed XML comments in `String.parseXML()`
- fixed `Name` type in `Schemas`
- fixed sorting in `U.reader()`

========================
0.0.39
========================

- added a new alias `request.proxy()` to `response.proxy()`
- added `LDAP(opt, callback)` method for obtaining of users, groups or user profile (experimental)
- added `U.normalize(path)` that normalizes path by adding `/` to begin and end of the phrase
- added `U.link(path1, path2, pathN)` for creating of links
- added `PATH.join()` alias to `Path.join()`
- added `DEF.blacklist` object that performs IP blacklist
- updated `filestorage.save()` by adding support for importing files from URL address
- updated built-in session `AUTH()` mechanism by adding `options.strict {Boolean}` option
- updated `$.extend([data], [callback])` method in SchemaOptions by adding `callback` argument that enables async processing
- removed `allow_debug` option
- fixed `abort` event for incoming `request`
- fixed `controller.json()` method
- fixed `array.quicksort()` method
- fixed `controller.invalid()`, added missing second argument called `error` (optional)
- fixed error handling in `TotalAPI`
- fixed cookies transfering while redirecting in the `REQUEST()` method (can be disable via `opt.nocookies = true`)
- fixed `language` in `WebSocketClient`
- fixed merging files with the `auto` value defined in `versions`
- fixed encoding in `content-disposition` header
- fixed `UNAUTHORIZED()`
- fixed `after` argument in the `PROXY()` and `res.proxy()` methods
- improved error handling in WebSocket
- improved HTTP caching in merged files
- improved unit-testing
- improved timeouts in the API endpoints

========================
0.0.38
========================

- added `PAUSE(is_paused)` method that can pause loading of all Total.js dependencies
- added dynamic delegates for receiving of messages in FlowStream in the form `instance.mesage_<INPUT_NAME>`
- added `response.proxy(target, [copypath], [after], [timeout])`
- improved some parts of code
- improved `MIDDLEWARE(name, fn, [assign], [first])` method
- fixed measuring dimension for `.gif` images
- fixed `BACKUP()` method (a problem with sockets)
- fixed potential remote code execution in `U.set()` founded by [Snyk](https://snyk.io/vuln)
- fixed routing with camel-Case URL addresses
- fixed sending of messages via inline registered components in FlowStream
- fixed a problem with FileStorage and opened file descriptors

========================
0.0.37
========================

- added CSRF
	- `CONF.secret_csrf`
	- `CONF.default_csrf_maxage`
	- `DEF.onCSRFcreate(req)`
	- `DEF.onCSRFcheck(req)`
	- `req.csrf()` generates a token
	- `controller.csrf()` generates a token
	- `@{csrf}` generates a token in View engine
	- `schema.csrf()` enables csrf for schemas and their routes
	- new `csrf` flag in `ROUTE()` method
	- `csrf` verification via `x-csrf-token` header or via URL argument `?csrf=TOKEN`
	- `RESTBuilder.csrf(token)`
- added `HTMLMAIL(address, subject, body, [language], [callback])` for sending of raw HTML mail messages
- added `NPMINSTALL(name, callback)` for installing of 3rd party NPM dependencies
- added `FILESTORAGE().image()` method for reading of images
- `CONF.default_errorbuilder_errors` for handling of all HTTP errors via ErrorBuilder
- decreased `default_interval_websocket_ping` to `1` minute (from `3`)
- improved image cache in `FILESTORAGE()`
- fixed `message` with `closing bytes` in WebSocket and `WEBSOCKETCLIENT()`
- fixed `@{resource()}` method in View engine
- fixed read stream in `FILESTORAGE()`

========================
0.0.36
========================

- improved HTTP cache
- fixed parsing of schema keys in `PATCH` method
- fixed predefined session functionality (a problem with cache)
- fixed `API` routes with empty model

========================
0.0.35
========================

- extended `EXEC()` by adding support for `Tasks` and `Operations`
- fixed `DELETE` method for the schemas, now it works same like `PATCH` method
- fixed `FlowStream.use()` method
- fixed pausing of outputs/inputs in `FlowStream`
- fixed inputs in `FlowStream`
- fixed command injection in `Image.pipe()` and `Image.stream()`
- fixed parsing of uploaded files (sometimes was the writeable stream unclosed)
- fixed execution of system routes

========================
0.0.31
========================

- added `CONF.default_errorbuilder_forxhr` key (default: `true`)
- errors in requests with `xhr` are serialized via ErrorBuilder
- fixed reconnecting in `WEBSOCKETCLIENT()`
- fixed `$.success()` and `$.done()` used in chaining

Fixed version (ground truth):
========================
0.0.43
========================

- improved `flowinstance.newmessage(data)` method
- removed method `U.set()`
- removed method `U.get()`
- removed method `U.sync()` and `global.sync()`
- removed method `U.sync2()` and `global.sync2()`

========================
0.0.42
========================

- added support for JSON schemas
- added Total Messaging Service
- added `jsonschemas` directory
- added `schema.jsonschema(name)` method
- added `JSONSCHEMA()` method
- added `NEWJSONSCHEMA()` method
- added `NEWPUBLISH()` method
- added `NEWSUBSCRIBE()` method
- added `PUBLISH()` method
- added `SUBSCRIBE()` method
- added `UNSUBSCRIBE()` method
- added `watcher` event for the main process in `debug` or `release` mode with the watcher
- added HTML escaping for meta tags
- added `WebSocketClient.destroy()` method
- added new command `refresh_cmd`
- added `allow_totalapilogger {Boolean}` option to the configuration
- added `allow_totalapi {Boolean}` option to the configuration
- added `allow_tms {Boolean}` option to the configuration
- added `secret_tms {String}` option to the configuration
- added `schema.jsonschema_define()` method
- added `flowstream.load(components, design, [callback])` method
- added `flowstream.unload(components, design, [callback])` method
- added new delegate `flowstream.onreconfigure = function(instance) {}`
- added new delegate `flowstream.onconnect = function(instance) {}`
- added new delegate `flowstream.ondisconnect = function(instance) {}`
- added new delegate `flowstream.onregister = function(component) {}`
- added new delegate `flowstream.onunregister = function(component) {}`
- added `uistream.load(components, design, [callback])` method
- added `uistream.unload(components, design, [callback])` method
- added new delegate `uistream.onreconfigure = function(instance) {}`
- added new delegate `uistream.onconnect = function(instance) {}`
- added new delegate `uistream.ondisconnect = function(instance) {}`
- added new delegate `uistream.onregister = function(component) {}`
- added new delegate `uistream.onunregister = function(component) {}`
- fixed `Mail.attachmentfs()`
- fixed dynamic routing
- fixed security issue when parsing query arguments (reported by <https://github.com/fl4x>)
- extended `schema.addTask()` by adding a new argument `callback`
- added new method `flowstream.newmessage(data)`
- added new method `flowstream_instance.newmessage(data)`
- added `String.toJSONSchema(name, url)`
- added `bundles.debug` enables watcher for `.src` directory only

========================
0.0.41
========================

- added TypeScript support
- added support for static files in threads
- fixed logging in threads by Tomas Novak
- added `insecure` option to the `REQUEST()` method
- added `builder.insecure()` method to the `RESTBuilder` instance
- added `profile` type to the LDAP options
- extended `base64` by adding support for `content-type;base64,data` format
- updated `schema.define(key, type, required, [default_error_message])`
- fixed `String.encrypt_uid()`
- fixed `$.keys` in schemas with multiple operations
- fixed wildcard routing combinated with dynamic arguments

========================
0.0.40
========================

- added `U.reader().list()` method
- added `Array.findValue()`
- added async/await mechanism to TextDB
- added async/await mechanism to RESTBuilder
- threads supports views
- improved error handling in `TotalAPI()`
- improved `Database.scalar()` by adding new argument
- improved `QueryBuilder.in()` and `QueryBuilder.notin()`
- fixed UTF8 chars in multi-part parser
- fixed `NOSQL().autofill()`
- fixed converting date via `Date.setTimeZone()`
- fixed XML comments in `String.parseXML()`
- fixed `Name` type in `Schemas`
- fixed sorting in `U.reader()`

========================
0.0.39
========================

- added a new alias `request.proxy()` to `response.proxy()`
- added `LDAP(opt, callback)` method for obtaining of users, groups or user profile (experimental)
- added `U.normalize(path)` that normalizes path by adding `/` to begin and end of the phrase
- added `U.link(path1, path2, pathN)` for creating of links
- added `PATH.join()` alias to `Path.join()`
- added `DEF.blacklist` object that performs IP blacklist
- updated `filestorage.save()` by adding support for importing files from URL address
- updated built-in session `AUTH()` mechanism by adding `options.strict {Boolean}` option
- updated `$.extend([data], [callback])` method in SchemaOptions by adding `callback` argument that enables async processing
- removed `allow_debug` option
- fixed `abort` event for incoming `request`
- fixed `controller.json()` method
- fixed `array.quicksort()` method
- fixed `controller.invalid()`, added missing second argument called `error` (optional)
- fixed error handling in `TotalAPI`
- fixed cookies transfering while redirecting in the `REQUEST()` method (can be disable via `opt.nocookies = true`)
- fixed `language` in `WebSocketClient`
- fixed merging files with the `auto` value defined in `versions`
- fixed encoding in `content-disposition` header
- fixed `UNAUTHORIZED()`
- fixed `after` argument in the `PROXY()` and `res.proxy()` methods
- improved error handling in WebSocket
- improved HTTP caching in merged files
- improved unit-testing
- improved timeouts in the API endpoints

========================
0.0.38
========================

- added `PAUSE(is_paused)` method that can pause loading of all Total.js dependencies
- added dynamic delegates for receiving of messages in FlowStream in the form `instance.mesage_<INPUT_NAME>`
- added `response.proxy(target, [copypath], [after], [timeout])`
- improved some parts of code
- improved `MIDDLEWARE(name, fn, [assign], [first])` method
- fixed measuring dimension for `.gif` images
- fixed `BACKUP()` method (a problem with sockets)
- fixed potential remote code execution in `U.set()` founded by [Snyk](https://snyk.io/vuln)
- fixed routing with camel-Case URL addresses
- fixed sending of messages via inline registered components in FlowStream
- fixed a problem with FileStorage and opened file descriptors

========================
0.0.37
========================

- added CSRF
	- `CONF.secret_csrf`
	- `CONF.default_csrf_maxage`
	- `DEF.onCSRFcreate(req)`
	- `DEF.onCSRFcheck(req)`
	- `req.csrf()` generates a token
	- `controller.csrf()` generates a token
	- `@{csrf}` generates a token in View engine
	- `schema.csrf()` enables csrf for schemas and their routes
	- new `csrf` flag in `ROUTE()` method
	- `csrf` verification via `x-csrf-token` header or via URL argument `?csrf=TOKEN`
	- `RESTBuilder.csrf(token)`
- added `HTMLMAIL(address, subject, body, [language], [callback])` for sending of raw HTML mail messages
- added `NPMINSTALL(name, callback)` for installing of 3rd party NPM dependencies
- added `FILESTORAGE().image()` method for reading of images
- `CONF.default_errorbuilder_errors` for handling of all HTTP errors via ErrorBuilder
- decreased `default_interval_websocket_ping` to `1` minute (from `3`)
- improved image cache in `FILESTORAGE()`
- fixed `message` with `closing bytes` in WebSocket and `WEBSOCKETCLIENT()`
- fixed `@{resource()}` method in View engine
- fixed read stream in `FILESTORAGE()`

========================
0.0.36
========================

- improved HTTP cache
- fixed parsing of schema keys in `PATCH` method
- fixed predefined session functionality (a problem with cache)
- fixed `API` routes with empty model

========================
0.0.35
========================

- extended `EXEC()` by adding support for `Tasks` and `Operations`
- fixed `DELETE` method for the schemas, now it works same like `PATCH` method
- fixed `FlowStream.use()` method
- fixed pausing of outputs/inputs in `FlowStream`
- fixed inputs in `FlowStream`
- fixed command injection in `Image.pipe()` and `Image.stream()`
- fixed parsing of uploaded files (sometimes was the writeable stream unclosed)
- fixed execution of system routes

========================
0.0.31
========================

- added `CONF.default_errorbuilder_forxhr` key (default: `true`)
- errors in requests with `xhr` are serialized via ErrorBuilder
- fixed reconnecting in `WEBSOCKETCLIENT()`
- fixed `$.success()` and `$.done()` used in chaining