Program: CWE-863
Project: CVE-2021-32701
Buggy source:
version: 2.1

orbs:
  sdk: ory/sdk@0.1.41
  changelog: ory/changelog@0.1.10
  goreleaser: ory/goreleaser@0.1.30
  slack: circleci/slack@3.4.2
  nancy: ory/nancy@0.0.18
  docs: ory/docs@0.0.11
  golangci: ory/golangci@0.0.18
  go: circleci/go@1.5.0
  prettier: ory/prettier@0.0.11

jobs:
  test:
    docker:
      - image: cimg/go:1.16-node
        environment:
        - GO111MODULE=on
    steps:
      - checkout
      - setup_remote_docker
      - go/load-cache
      - run: go mod tidy
      - go/save-cache
      - prettier/install
      - prettier/check
      - goreleaser/install
      - goreleaser/check
      - golangci/install
      - golangci/lint
      - run: go install github.com/ory/go-acc github.com/mattn/goveralls
      - run: go-acc -o coverage.txt ./... -- -failfast -timeout=20m
      - run: test -z "$CIRCLE_PR_NUMBER" && goveralls -service=circle-ci -coverprofile=coverage.txt -repotoken=$COVERALLS_REPO_TOKEN || echo "forks are not allowed to push to coveralls"
      - run: ./test/e2e/run.sh
      - run: ./test/reload/run.sh

workflows:
  "test, build, and relase":
    jobs:
      - test:
          filters:
            tags:
              only: /.*/
      - changelog/generate:
          requires:
            - test
          filters:
            tags:
              only: /.*/
            branches:
              only: master
      - sdk/generate:
          appname: Ory_Oathkeeper
          swagpath: spec/api.json
          requires:
            - test
      - sdk/release:
          swagpath: spec/api.json
          requires:
            - test
            - goreleaser/release
          filters:
            tags:
              only: /.*/
            branches:
              ignore: /.*/
      - docs/build:
          swag-spec-location: spec/api.json
          requires:
            - test
          filters:
            tags:
              only: /.*/
            branches:
              only: master
      -
        goreleaser/release:
          requires:
            - test
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /.*/
      -
        goreleaser/render-version-schema:
          requires:
            - goreleaser/release
          filters:
            tags:
              only: /.*/
      -
        goreleaser/newsletter-draft:
          chimp-list: f605a41b53
          chimp-segment: 6479485
          requires:
            - goreleaser/release
          filters:
            tags:
              only: /.*/
      -
        slack/approval-notification:
          message: Pending approval
          channel: release-automation
          requires:
            - goreleaser/newsletter-draft
          filters:
            tags:
              only: /.*/
      -
        newsletter-approval:
          type: approval
          requires:
            - goreleaser/newsletter-draft
          filters:
            tags:
              only: /.*/
      -
        goreleaser/newsletter-send:
          chimp-list: f605a41b53
          requires:
            - newsletter-approval
          filters:
            tags:
              only: /.*/


Fixed version (ground truth):
version: 2.1

orbs:
  sdk: ory/sdk@0.1.41
  changelog: ory/changelog@0.1.10
  goreleaser: ory/goreleaser@0.1.30
  slack: circleci/slack@3.4.2
  nancy: ory/nancy@0.0.18
  docs: ory/docs@0.0.11
  golangci: ory/golangci@0.0.18
  go: circleci/go@1.5.0
  prettier: ory/prettier@0.0.11

jobs:
  test:
    docker:
      - image: cimg/go:1.16-node
        environment:
        - GO111MODULE=on
    steps:
      - checkout
      - setup_remote_docker
      - go/load-cache
      - run: go mod tidy
      - go/save-cache
      - prettier/install
      - prettier/check
      - goreleaser/install
      - goreleaser/check
      - golangci/install
      - golangci/lint
      - run: go install github.com/ory/go-acc github.com/mattn/goveralls
      - run: go-acc -o coverage.out ./... -- -failfast -timeout=20m
      - run: |
          bash <(curl -s https://codecov.io/bash)
      - run: ./test/e2e/run.sh
      - run: ./test/reload/run.sh

workflows:
  "test, build, and relase":
    jobs:
      - test:
          filters:
            tags:
              only: /.*/
      - changelog/generate:
          requires:
            - test
          filters:
            tags:
              only: /.*/
            branches:
              only: master
      - sdk/generate:
          appname: Ory_Oathkeeper
          swagpath: spec/api.json
          requires:
            - test
      - sdk/release:
          swagpath: spec/api.json
          requires:
            - test
            - goreleaser/release
          filters:
            tags:
              only: /.*/
            branches:
              ignore: /.*/
      - docs/build:
          swag-spec-location: spec/api.json
          requires:
            - test
          filters:
            tags:
              only: /.*/
            branches:
              only: master
      -
        goreleaser/release:
          requires:
            - test
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /.*/
      -
        goreleaser/render-version-schema:
          requires:
            - goreleaser/release
          filters:
            tags:
              only: /.*/
      -
        goreleaser/newsletter-draft:
          chimp-list: f605a41b53
          chimp-segment: 6479485
          requires:
            - goreleaser/release
          filters:
            tags:
              only: /.*/
      -
        slack/approval-notification:
          message: Pending approval
          channel: release-automation
          requires:
            - goreleaser/newsletter-draft
          filters:
            tags:
              only: /.*/
      -
        newsletter-approval:
          type: approval
          requires:
            - goreleaser/newsletter-draft
          filters:
            tags:
              only: /.*/
      -
        goreleaser/newsletter-send:
          chimp-list: f605a41b53
          requires:
            - newsletter-approval
          filters:
            tags:
              only: /.*/