nus-yam/ex-repair huggingface dataset:
Program: CWE-78
Project: CVE-2021-43779
Buggy source:
<?php
/*
 * @version $Id$
 -------------------------------------------------------------------------
 addressing plugin for GLPI
 Copyright (C) 2009-2016 by the addressing Development Team.

 https://github.com/pluginsGLPI/addressing
 -------------------------------------------------------------------------

 LICENSE

 This file is part of addressing.

 addressing is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.

 addressing is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.

 You should have received a copy of the GNU General Public License
 along with addressing. If not, see <http://www.gnu.org/licenses/>.
 --------------------------------------------------------------------------
 */

include ('../../../inc/includes.php');

$reserveip = new PluginAddressingReserveip();

if (isset($_POST['add'])) {
   $reserveip->check(-1, CREATE, $_POST);
   $reserveip->reserveip($_POST);
   Html::back();
} else {
   Html::header(PluginAddressingReserveip::getTypeName(), '', "tools", "pluginaddressingmenu");
   $reserveip->showReservationForm($_REQUEST["ip"], $_REQUEST["id_addressing"], $_REQUEST['rand']);
   Html::footer();
}


Fixed version (ground truth):
<?php
/*
 * @version $Id$
 -------------------------------------------------------------------------
 addressing plugin for GLPI
 Copyright (C) 2009-2016 by the addressing Development Team.

 https://github.com/pluginsGLPI/addressing
 -------------------------------------------------------------------------

 LICENSE

 This file is part of addressing.

 addressing is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.

 addressing is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.

 You should have received a copy of the GNU General Public License
 along with addressing. If not, see <http://www.gnu.org/licenses/>.
 --------------------------------------------------------------------------
 */

include ('../../../inc/includes.php');

$reserveip = new PluginAddressingReserveip();

if (isset($_POST['add'])) {
   $reserveip->check(-1, CREATE, $_POST);
   $reserveip->reserveip($_POST);
   Html::back();
} else {
   Html::header(PluginAddressingReserveip::getTypeName(), '', "tools", "pluginaddressingmenu");
   if(filter_var($_REQUEST["ip"], FILTER_VALIDATE_IP)) {
      $reserveip->showReservationForm($_REQUEST["ip"], $_REQUEST["id_addressing"], $_REQUEST['rand']);
   }
   Html::footer();
}
Program: CWE-78
Project: CVE-2022-1440
Buggy source:
{
	"name": "git-interface",
	"version": "2.1.1",
	"description": "some interfaces for work with git repository",
	"main": "dist/index",
	"typings": "dist/index",
	"scripts": {
		"clean": "rm -rf ./dist",
		"build": "npm run clean && npm run ts",
		"dev": "npm run clean &&  ./node_modules/.bin/tsc -w",
		"ts": "./node_modules/.bin/tsc",
		"prepublish": "npm run build"
	},
	"repository": {
		"type": "git",
		"url": "git://github.com/yarkeev/git-interface.git"
	},
	"keywords": [
		"git",
		"hash",
		"pull",
		"push",
		"commit",
		"last changes",
		"checkout",
		"merge",
		"conflicts",
		"cvs"
	],
	"author": "Yarkeev Denis <denis.yarkeev@gmail.com>",
	"license": "MIT",
	"bugs": {
		"url": "https://github.com/yarkeev/git-interface/issues"
	},
	"homepage": "https://github.com/yarkeev/git-interface",
	"devDependencies": {
		"@types/node": "^10.10.3",
		"typescript": "^3.0.3"
	}
}


Fixed version (ground truth):
{
	"name": "git-interface",
	"version": "2.1.2",
	"description": "some interfaces for work with git repository",
	"main": "dist/index",
	"typings": "dist/index",
	"scripts": {
		"clean": "rm -rf ./dist",
		"build": "npm run clean && npm run ts",
		"dev": "npm run clean &&  ./node_modules/.bin/tsc -w",
		"ts": "./node_modules/.bin/tsc",
		"prepublishOnly": "npm run build && bump"
	},
	"repository": {
		"type": "git",
		"url": "git://github.com/yarkeev/git-interface.git"
	},
	"keywords": [
		"git",
		"hash",
		"pull",
		"push",
		"commit",
		"last changes",
		"checkout",
		"merge",
		"conflicts",
		"cvs"
	],
	"author": "Yarkeev Denis <denis.yarkeev@gmail.com>",
	"license": "MIT",
	"bugs": {
		"url": "https://github.com/yarkeev/git-interface/issues"
	},
	"homepage": "https://github.com/yarkeev/git-interface",
	"devDependencies": {
		"@types/node": "^10.10.3",
		"typescript": "^3.0.3",
		"version-bump-prompt": "^6.1.0"
	}
}
Program: CWE-20
Project: CVE-2012-5646
Buggy source:
<?php

list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]);
shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");

sleep(2);
$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
header("Location: $url");

?>


Fixed version (ground truth):
<?php

list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]);
if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
    sleep(2);
    $host = $_SERVER['HTTP_HOST'];
    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
    header("Location: $proto$host$url");
} else {
    // someone is trying to attack
    error_log("Invalid uuid $uuid given to restorer.php");
    header('HTTP/1.0 403 Forbidden');
}
?>
Program: CWE-20
Project: CVE-2012-5647
Buggy source:
<?php

list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]);
shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");

sleep(2);
$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
header("Location: $url");

?>


Fixed version (ground truth):
<?php

list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]);
if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
    sleep(2);
    $host = $_SERVER['HTTP_HOST'];
    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
    header("Location: $proto$host$url");
} else {
    // someone is trying to attack
    error_log("Invalid uuid $uuid given to restorer.php");
    header('HTTP/1.0 403 Forbidden');
}
?>
Program: CWE-20
Project: CVE-2013-7176
Buggy source:
# per https://github.com/fail2ban/fail2ban/issues/125
# and https://github.com/fail2ban/fail2ban/issues/126
# failJSON: { "time": "2005-02-21T09:21:54", "match": true , "host": "192.0.43.10" }
Feb 21 09:21:54 xxx postfix/smtpd[14398]: NOQUEUE: reject: RCPT from example.com[192.0.43.10]: 450 4.7.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo=
# failJSON: { "time": "2005-07-12T07:47:48", "match": true , "host": "1.2.3.4" }
Jul 12 07:47:48 saturn postfix/smtpd[8738]: NOQUEUE: reject: RCPT from 1-2-3-4-example.com[1.2.3.4]: 554 5.7.1 <smtp@example.com>: Relay access denied; from=<john@example.com> to=<smtp@example.org> proto=SMTP helo=<198.51.100.17>


Fixed version (ground truth):
# per https://github.com/fail2ban/fail2ban/issues/125
# and https://github.com/fail2ban/fail2ban/issues/126
# failJSON: { "time": "2005-02-21T09:21:54", "match": true , "host": "192.0.43.10" }
Feb 21 09:21:54 xxx postfix/smtpd[14398]: NOQUEUE: reject: RCPT from example.com[192.0.43.10]: 450 4.7.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo=
# failJSON: { "time": "2005-07-12T07:47:48", "match": true , "host": "1.2.3.4" }
Jul 12 07:47:48 saturn postfix/smtpd[8738]: NOQUEUE: reject: RCPT from 1-2-3-4-example.com[1.2.3.4]: 554 5.7.1 <smtp@example.com>: Relay access denied; from=<john@example.com> to=<smtp@example.org> proto=SMTP helo=<198.51.100.17>
# failJSON: { "time": "2005-07-18T23:12:56", "match": true , "host": "192.51.100.65" }
Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.65]: 554 5.7.1 <bad.domain>: Helo command rejected: match bad.domain; from=<foo@good.domain> to=<foo@porcupine.org> proto=SMTP helo=<bad.domain>
# failJSON: { "time": "2005-07-18T23:12:56", "match": true , "host": "192.51.100.43" }
Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.43]: 554 5.7.1 <foo@bad.domain>: Sender address rejected: match bad.domain; from=<foo@bad.domain> to=<foo@porcupine.org> proto=SMTP helo=<192.51.100.43>
Program: CWE-20
Project: CVE-2013-7177
Buggy source:
None

Fixed version (ground truth):
# failJSON: { "time": "2005-01-04T21:51:05", "match": true , "host": "127.0.0.1" }
Jan 4 21:51:05 hostname cyrus/imap[5355]: badlogin: localhost.localdomain [127.0.0.1] plaintext cyrus@localdomain SASL(-13): authentication failure: checkpass failed
# failJSON: { "time": "2005-02-20T17:23:32", "match": true , "host": "198.51.100.23" }
Feb 20 17:23:32 domain cyrus/pop3[18635]: badlogin: localhost [198.51.100.23] plaintext administrator SASL(-13): authentication failure: checkpass failed
# failJSON: { "time": "2005-02-20T17:23:32", "match": true , "host": "1.2.3.4" }
Feb 20 17:23:32 cyrus/pop3[4297]: badlogin: example.com [1.2.3.4] plaintext mail0001 SASL(-13): authentication failure: checkpass failed
# failJSON: { "time": "2005-06-08T18:11:13", "match": true , "host": "198.51.100.45" }
Jun 8 18:11:13 lampserver imap[4480]: badlogin: example.com [198.51.100.45] DIGEST-MD5 [SASL(-13): authentication failure: client response doesn't match what we generated]
# failJSON: { "time": "2004-12-21T10:01:57", "match": true , "host": "198.51.100.57" }
Dec 21 10:01:57 hostname imapd[18454]: badlogin: example.com [198.51.100.57] CRAM-MD5 [SASL(-13): authentication failure: incorrect digest response]
Program: CWE-20
Project: CVE-2015-2784
Buggy source:
require "paperclip"

module Paperclip
  class Cropper < Thumbnail

    def transformation_command
      if crop_command
        crop_command + super.join(' ').sub(/ -crop \S+/, '').split(' ')
      else
        super
      end
    end


    def crop_command
      target = @attachment.instance

      if target.cropping?(@attachment.name)
        w = target.send :"#{@attachment.name}_crop_w"
        h = target.send :"#{@attachment.name}_crop_h"
        x = target.send :"#{@attachment.name}_crop_x"
        y = target.send :"#{@attachment.name}_crop_y"
        ["-crop", "#{w}x#{h}+#{x}+#{y}"]
      end
    end

  end
end

Fixed version (ground truth):
require "paperclip"

module Paperclip
  class Cropper < Thumbnail

    def transformation_command
      if crop_command
        crop_command + super.join(' ').sub(/ -crop \S+/, '').split(' ')
      else
        super
      end
    end


    def crop_command
      target = @attachment.instance

      if target.cropping?(@attachment.name)
        begin
          w = Integer(target.send :"#{@attachment.name}_crop_w")
          h = Integer(target.send :"#{@attachment.name}_crop_h")
          x = Integer(target.send :"#{@attachment.name}_crop_x")
          y = Integer(target.send :"#{@attachment.name}_crop_y")
          ["-crop", "#{w}x#{h}+#{x}+#{y}"]
        rescue
          Paperclip.log("[papercrop] #{@attachment.name} crop w/h/x/y were non-integer")
          return
        end
      end
    end

  end
end
Program: CWE-20
Project: CVE-2015-3183
Buggy source:
2901


Fixed version (ground truth):
2902
Program: CWE-20
Project: CVE-2015-4410
Buggy source:
None

Fixed version (ground truth):
module Support

  # Module for recording operations.
  #
  #   Support::Stats.install!
  #
  #   stats = Support::Stats.collect do
  #     session.with(safe: true)[:users].insert({})
  #   end
  #
  #   ops = stats["127.0.0.1:27017"]
  #   ops.size # => 2
  #   ops[0].class # => Moped::Protocol::Insert
  #   ops[1].class # => Moped::Protocol::Command
  #
  module Stats
    extend self

    def record(node, operations)
      key = if node.primary?
        :primary
      elsif node.secondary?
        :secondary
      else
        :other
      end

      @stats[key].concat(operations) if @stats
    end

    def collect
      @stats = Hash.new { |hash, key| hash[key] = [] }
      yield
      @stats
    ensure
      @stats = nil
    end

    def install!
      Moped::Node.class_eval <<-EOS
        alias _logging logging

        def logging(operations, &block)
          Support::Stats.record(self, operations)
          _logging(operations, &block)
        end
      EOS
    end

  end
end
Program: CWE-20
Project: CVE-2016-7417
Buggy source:
None

Fixed version (ground truth):
--TEST--
Bug #73029: Missing type check when unserializing SplArray
--FILE--
<?php
try {
$a = 'C:11:"ArrayObject":19:0x:i:0;r:2;;m:a:0:{}}';
$m = unserialize($a);
$x = $m[2];
} catch(UnexpectedValueException $e) {
	print $e->getMessage() . "\n";
}
?>
DONE
--EXPECTF--
Error at offset 10 of 19 bytes
DONE
Program: CWE-20
Project: CVE-2016-9395
Buggy source:
# All directories
core
*.o
*.a
*.la
*.lo
.deps
.libs
Makefile
Makefile.in
*.trs
*.log

# Top-level directory
/autom4te.cache
/ac_aux
/aclocal.m4
/config.log
/config.status
/configure
/jasper.spec
/libtool

# ac_m4 directory
/ac_m4/libtool.m4
/ac_m4/ltoptions.m4
/ac_m4/ltsugar.m4
/ac_m4/ltversion.m4
/ac_m4/lt~obsolete.m4

# pkgconfig directory
/pkgconfig/jasper.pc

# /src/appl directory
/src/appl/imgcmp
/src/appl/imginfo
/src/appl/jasper
/src/appl/jiv
/src/appl/tmrdemo

# ./src/libjasper/include/jasper directory
/src/libjasper/include/jasper/jas_config.h
/src/libjasper/include/jasper/jas_config.h.in
/src/libjasper/include/jasper/jas_config.h.in~
/src/libjasper/include/jasper/stamp-h1


Fixed version (ground truth):
# All directories
core
*.o
*.a
*.la
*.lo
.deps
.libs
Makefile
Makefile.in
*.trs
*.log

# Top-level directory
/autom4te.cache
/ac_aux
/aclocal.m4
/config.log
/config.status
/configure
/jasper.spec
/libtool

# ac_m4 directory
/ac_m4/libtool.m4
/ac_m4/ltoptions.m4
/ac_m4/ltsugar.m4
/ac_m4/ltversion.m4
/ac_m4/lt~obsolete.m4

# pkgconfig directory
/pkgconfig/jasper.pc

# /src/appl directory
/src/appl/imgcmp
/src/appl/imginfo
/src/appl/jasper
/src/appl/jiv
/src/appl/tmrdemo

# ./src/libjasper/include/jasper directory
/src/libjasper/include/jasper/jas_config.h
/src/libjasper/include/jasper/jas_pconf.h
/src/libjasper/include/jasper/jas_pconf.h.in
/src/libjasper/include/jasper/jas_pconf.h.in~
/src/libjasper/include/jasper/stamp-h1
Program: CWE-20
Project: CVE-2017-1001004
Buggy source:
None

Fixed version (ground truth):
var assert = require('assert');
var typed = require('../typed-function');

describe('security', function () {

  it ('should not allow bad code in the function name', function () {
    // simple example:
    // var fn = typed("(){}+console.log('hacked...');function a", {     
    //   "": function () {} 
    // });

    // example resulting in throwing an error
    var fn = typed("(){}+(function(){throw new Error('Hacked... should not have executed this function!!!')})();function a", { 
      "": function () {} 
    });
  })
})
Program: CWE-20
Project: CVE-2017-5605
Buggy source:
<?php
/*
 * @file Carbons.php
 *
 * @brief Handle incoming carbons messages
 *
 * Copyright 2014 edhelas <edhelas@edhelas-laptop>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 * MA 02110-1301, USA.
 *
 *
 */

namespace Moxl\Xec\Payload;

class Carbons extends Payload
{
    public function handle($stanza, $parent = false)
    {
        $message = $stanza->forwarded->message;

        $jid = explode('/',(string)$message->attributes()->from);
        $to = current(explode('/',(string)$message->attributes()->to));

        if($message->composing)
            $this->event('composing', array($jid[0], $to));
        if($message->paused)
            $this->event('paused', array($jid[0], $to));
        if($message->gone)
            $this->event('gone', array($jid[0], $to));

        if($message->body || $message->subject) {
            $m = new \Modl\Message;
            $m->set($message, $stanza->forwarded);

            if(!preg_match('#^\?OTR#', $m->body)) {
                $md = new \Modl\MessageDAO;
                $md->set($m);

                $this->pack($m);
                $this->deliver();
            }
        }
    }
}


Fixed version (ground truth):
<?php

namespace Moxl\Xec\Payload;

class Carbons extends Payload
{
    public function handle($stanza, $parent = false)
    {
        $parentfrom = current(explode('/', (string)$parent->attributes()->from));

        $message = $stanza->forwarded->message;

        $from = current(explode('/',(string)$message->attributes()->from));
        $to = current(explode('/',(string)$message->attributes()->to));

        $user = new \User;
        if($parentfrom == $user->getLogin()) {
            if($message->composing)
                $this->event('composing', [$from, $to]);
            if($message->paused)
                $this->event('paused', [$from, $to]);
            if($message->gone)
                $this->event('gone', [$from, $to]);

            if($message->body || $message->subject) {
                $m = new \Modl\Message;
                $m->set($message, $stanza->forwarded);

                if(!preg_match('#^\?OTR#', $m->body)) {
                    $md = new \Modl\MessageDAO;
                    $md->set($m);

                    $this->pack($m);
                    $this->deliver();
                }
            }
        }
    }
}
Program: CWE-20
Project: CVE-2017-6815
Buggy source:
<?php
/**
 * The WordPress version string
 *
 * @global string $wp_version
 */
$wp_version = '4.8-alpha-40181';

/**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
$wp_db_version = 38590;

/**
 * Holds the TinyMCE version
 *
 * @global string $tinymce_version
 */
$tinymce_version = '4403-20160901';

/**
 * Holds the required PHP version
 *
 * @global string $required_php_version
 */
$required_php_version = '5.2.4';

/**
 * Holds the required MySQL version
 *
 * @global string $required_mysql_version
 */
$required_mysql_version = '5.0';


Fixed version (ground truth):
<?php
/**
 * The WordPress version string
 *
 * @global string $wp_version
 */
$wp_version = '4.8-alpha-40183';

/**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
$wp_db_version = 38590;

/**
 * Holds the TinyMCE version
 *
 * @global string $tinymce_version
 */
$tinymce_version = '4403-20160901';

/**
 * Holds the required PHP version
 *
 * @global string $required_php_version
 */
$required_php_version = '5.2.4';

/**
 * Holds the required MySQL version
 *
 * @global string $required_mysql_version
 */
$required_mysql_version = '5.0';
Program: CWE-20
Project: CVE-2017-7189
Buggy source:
None

Fixed version (ground truth):
--TEST--
Use of double-port in fsockopen()
--FILE--
<?php

$try = [
  '127.0.0.1:80',
  'tcp://127.0.0.1:80',
  '[::1]:80',
  'tcp://[::1]:80',
  'localhost:80',
  'tcp://localhost:80',
];

foreach ($try as $addr) {
  echo "== $addr ==\n";
  var_dump(@fsockopen($addr, 81, $errno, $errstr), $errstr);
}
--EXPECTF--
== 127.0.0.1:80 ==
bool(false)
string(41) "Failed to parse address "127.0.0.1:80:81""
== tcp://127.0.0.1:80 ==
bool(false)
string(41) "Failed to parse address "127.0.0.1:80:81""
== [::1]:80 ==
bool(false)
string(37) "Failed to parse address "[::1]:80:81""
== tcp://[::1]:80 ==
bool(false)
string(37) "Failed to parse address "[::1]:80:81""
== localhost:80 ==
bool(false)
string(41) "Failed to parse address "localhost:80:81""
== tcp://localhost:80 ==
bool(false)
string(41) "Failed to parse address "localhost:80:81""
Program: CWE-20
Project: CVE-2018-1000533
Buggy source:
None

Fixed version (ground truth):
<?php

use GitList\Git\Client;
use GitList\Git\Repository;
use PHPUnit\Framework\TestCase;
use Prophecy\Argument;

class RepositoryTest extends TestCase
{
    public function testIsSanitizingSearchWithPager()
    {
        $client = $this->prophesize(Client::class);
        $client->run(Argument::type(Repository::class), "grep -i --line-number -- '=sleep 5;' master")->shouldBeCalled();

        $repository = new Repository('/tmp', $client->reveal());
        $repository->searchTree('--open-files-in-pager=sleep 5;', 'master');
        $repository->searchTree('-O=sleep 5;', 'master');
    }

    public function testIsSanitizingSearchWithAnyOption()
    {
        $client = $this->prophesize(Client::class);
        $client->run(Argument::type(Repository::class), "grep -i --line-number -- 'foobar  =bar;' foo")->shouldBeCalled();

        $repository = new Repository('/tmp', $client->reveal());
        $repository->searchTree('foobar --bar --foo=bar;', 'foo');
    }
}
Program: CWE-20
Project: CVE-2018-1000809
Buggy source:
None

Fixed version (ground truth):
<?php

use GitList\Git\Client;
use GitList\Git\Repository;
use PHPUnit\Framework\TestCase;
use Prophecy\Argument;

class RepositoryTest extends TestCase
{
    public function testIsSanitizingSearchWithPager()
    {
        $client = $this->prophesize(Client::class);
        $client->run(Argument::type(Repository::class), "grep -i --line-number -- '=sleep 5;' master")->shouldBeCalled();

        $repository = new Repository('/tmp', $client->reveal());
        $repository->searchTree('--open-files-in-pager=sleep 5;', 'master');
        $repository->searchTree('-O=sleep 5;', 'master');
    }

    public function testIsSanitizingSearchWithAnyOption()
    {
        $client = $this->prophesize(Client::class);
        $client->run(Argument::type(Repository::class), "grep -i --line-number -- 'foobar  =bar;' foo")->shouldBeCalled();

        $repository = new Repository('/tmp', $client->reveal());
        $repository->searchTree('foobar --bar --foo=bar;', 'foo');
    }
}
Program: CWE-20
Project: CVE-2018-17019
Buggy source:
None

Fixed version (ground truth):
# @TEST-EXEC: bro -C -r $TRACES/irc-353.pcap %INPUT
# @TEST-EXEC: btest-diff weird.log

event irc_names_info(c: connection, is_orig: bool, c_type: string, channel: string, users: string_set)
	{
	print channel, users;
	}
Program: CWE-20
Project: CVE-2018-3719
Buggy source:
'use strict';

var isExtendable = require('is-extendable');
var forIn = require('for-in');

function mixinDeep(target, objects) {
  var len = arguments.length, i = 0;
  while (++i < len) {
    var obj = arguments[i];
    if (isObject(obj)) {
      forIn(obj, copy, target);
    }
  }
  return target;
}

/**
 * Copy properties from the source object to the
 * target object.
 *
 * @param  {*} `val`
 * @param  {String} `key`
 */

function copy(val, key) {
  var obj = this[key];
  if (isObject(val) && isObject(obj)) {
    mixinDeep(obj, val);
  } else {
    this[key] = val;
  }
}

/**
 * Returns true if `val` is an object or function.
 *
 * @param  {any} val
 * @return {Boolean}
 */

function isObject(val) {
  return isExtendable(val) && !Array.isArray(val);
}

/**
 * Expose `mixinDeep`
 */

module.exports = mixinDeep;


Fixed version (ground truth):
'use strict';

var isExtendable = require('is-extendable');
var forIn = require('for-in');

function mixinDeep(target, objects) {
  var len = arguments.length, i = 0;
  while (++i < len) {
    var obj = arguments[i];
    if (isObject(obj)) {
      forIn(obj, copy, target);
    }
  }
  return target;
}

/**
 * Copy properties from the source object to the
 * target object.
 *
 * @param  {*} `val`
 * @param  {String} `key`
 */

function copy(val, key) {
  if (key === '__proto__') {
    return;
  }

  var obj = this[key];
  if (isObject(val) && isObject(obj)) {
    mixinDeep(obj, val);
  } else {
    this[key] = val;
  }
}

/**
 * Returns true if `val` is an object or function.
 *
 * @param  {any} val
 * @return {Boolean}
 */

function isObject(val) {
  return isExtendable(val) && !Array.isArray(val);
}

/**
 * Expose `mixinDeep`
 */

module.exports = mixinDeep;
Program: CWE-20
Project: CVE-2018-3723
Buggy source:
/*!
 * defaults-deep <https://github.com/jonschlinkert/defaults-deep>
 *
 * Copyright (c) 2014-2015, Jon Schlinkert.
 * Licensed under the MIT License.
 */

'use strict';

var lazy = require('lazy-cache')(require);
lazy('is-extendable', 'isObject');
lazy('for-own', 'forOwn');

function defaultsDeep(target, objects) {
  target = target || {};

  function copy(target, current) {
    lazy.forOwn(current, function (value, key) {
      var val = target[key];
      // add the missing property, or allow a null property to be updated
      if (val == null) {
        target[key] = value;
      } else if (lazy.isObject(val) && lazy.isObject(value)) {
        defaultsDeep(val, value);
      }
    });
  }

  var len = arguments.length, i = 0;
  while (i < len) {
    var obj = arguments[i++];
    if (obj) {
      copy(target, obj);
    }
  }
  return target;
};

/**
 * Expose `defaultsDeep`
 */

module.exports = defaultsDeep;


Fixed version (ground truth):
/*!
 * defaults-deep <https://github.com/jonschlinkert/defaults-deep>
 *
 * Copyright (c) 2014-2015, Jon Schlinkert.
 * Licensed under the MIT License.
 */

'use strict';

var lazy = require('lazy-cache')(require);
lazy('is-extendable', 'isObject');
lazy('for-own', 'forOwn');

function defaultsDeep(target, objects) {
  target = target || {};

  function copy(target, current) {
    lazy.forOwn(current, function (value, key) {
      if (key === '__proto__') {
        return;
      }

      var val = target[key];
      // add the missing property, or allow a null property to be updated
      if (val == null) {
        target[key] = value;
      } else if (lazy.isObject(val) && lazy.isObject(value)) {
        defaultsDeep(val, value);
      }
    });
  }

  var len = arguments.length, i = 0;
  while (i < len) {
    var obj = arguments[i++];
    if (obj) {
      copy(target, obj);
    }
  }
  return target;
};

/**
 * Expose `defaultsDeep`
 */

module.exports = defaultsDeep;
Program: CWE-20
Project: CVE-2018-7560
Buggy source:
{
  "name": "aws-lambda-multipart-parser",
  "version": "0.1.1",
  "description": "Parser of multipart/form-data requests for AWS Lambda",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/myshenin/aws-lambda-multipart-parser.git"
  },
  "author": "Anton Myshenin",
  "license": "MIT",
  "bugs": {
    "url": "https://github.com/myshenin/aws-lambda-multipart-parser/issues"
  },
  "homepage": "https://github.com/myshenin/aws-lambda-multipart-parser#readme",
  "keywords": [
    "aws",
    "lambda",
    "multipart",
    "multipart/form-data",
    "multipart/formdata",
    "form-data",
    "formdata",
    "parser"
  ]
}


Fixed version (ground truth):
{
  "name": "aws-lambda-multipart-parser",
  "version": "0.1.2",
  "description": "Parser of multipart/form-data requests for AWS Lambda",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/myshenin/aws-lambda-multipart-parser.git"
  },
  "author": "Anton Myshenin",
  "license": "MIT",
  "bugs": {
    "url": "https://github.com/myshenin/aws-lambda-multipart-parser/issues"
  },
  "homepage": "https://github.com/myshenin/aws-lambda-multipart-parser#readme",
  "keywords": [
    "aws",
    "lambda",
    "multipart",
    "multipart/form-data",
    "multipart/formdata",
    "form-data",
    "formdata",
    "parser"
  ]
}
Program: CWE-20
Project: CVE-2018-7753
Buggy source:
{
  "name": "aws-lambda-multipart-parser",
  "version": "0.1.1",
  "description": "Parser of multipart/form-data requests for AWS Lambda",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/myshenin/aws-lambda-multipart-parser.git"
  },
  "author": "Anton Myshenin",
  "license": "MIT",
  "bugs": {
    "url": "https://github.com/myshenin/aws-lambda-multipart-parser/issues"
  },
  "homepage": "https://github.com/myshenin/aws-lambda-multipart-parser#readme",
  "keywords": [
    "aws",
    "lambda",
    "multipart",
    "multipart/form-data",
    "multipart/formdata",
    "form-data",
    "formdata",
    "parser"
  ]
}


Fixed version (ground truth):
{
  "name": "aws-lambda-multipart-parser",
  "version": "0.1.2",
  "description": "Parser of multipart/form-data requests for AWS Lambda",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/myshenin/aws-lambda-multipart-parser.git"
  },
  "author": "Anton Myshenin",
  "license": "MIT",
  "bugs": {
    "url": "https://github.com/myshenin/aws-lambda-multipart-parser/issues"
  },
  "homepage": "https://github.com/myshenin/aws-lambda-multipart-parser#readme",
  "keywords": [
    "aws",
    "lambda",
    "multipart",
    "multipart/form-data",
    "multipart/formdata",
    "form-data",
    "formdata",
    "parser"
  ]
}
Program: CWE-20
Project: CVE-2019-14243
Buggy source:
None

Fixed version (ground truth):
package proxyprotocol

import (
	"bufio"
	"bytes"
	"testing"

	"github.com/stretchr/testify/assert"
)

func TestParse_Malformed(t *testing.T) {
	data := []byte{
		// PROXY protocol v2 magic header
		0x0D, 0x0A, 0x0D, 0x0A, 0x00, 0x0D, 0x0A, 0x51, 0x55, 0x49, 0x54, 0x0A,
		// v2 version, PROXY cmd
		0x21,
		// TCP, IPv4 (also works with 0x13,0x21,0x22,0x31,0x32)
		0x12,
		// Length
		0x00, 0x00,
		// src/dest address data _should_ be here but is omitted.
	}

	_, err := Parse(
		bufio.NewReader(
			bytes.NewReader(data)))
	assert.Error(t, err)
}
Program: CWE-20
Project: CVE-2020-15258
Buggy source:
None

Fixed version (ground truth):
/*
 * Wire
 * Copyright (C) 2020 Wire Swiss GmbH
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see http://www.gnu.org/licenses/.
 *
 */

import {dialog, shell} from 'electron';
import * as assert from 'assert';
import * as sinon from 'sinon';

import * as WindowUtil from './WindowUtil';

describe('WindowUtil', () => {
  describe('openExternal', () => {
    let dialogStub: sinon.SinonStub;
    let shellStub: sinon.SinonStub;

    beforeEach(() => {
      shellStub = sinon.stub(shell, 'openExternal').returns(Promise.resolve());
      dialogStub = sinon.stub(dialog, 'showMessageBoxSync').returns(0);
    });

    afterEach(() => {
      dialogStub.restore();
      shellStub.restore();
    });

    it('opens secure URLs externally', async () => {
      const url = 'https://github.com/wireapp/wire-desktop';
      await WindowUtil.openExternal(url);

      assert.ok(shellStub.firstCall.calledWith(url));
      assert.ok(dialogStub.notCalled);
    });

    it('opens insecure URLs externally if allowed', async () => {
      const url = 'http://github.com/wireapp/wire-desktop';
      await WindowUtil.openExternal(url, false);

      assert.ok(shellStub.firstCall.calledWith(url));
      assert.ok(dialogStub.notCalled);
    });

    it(`doesn't open insecure URLs externally if not allowed`, async () => {
      const url = 'http://example.org';
      await WindowUtil.openExternal(url, true);

      assert.ok(shellStub.notCalled);
      assert.ok(dialogStub.called);
    });

    it(`doesn't open non-website URLs externally`, async () => {
      const url = 'smb://attacker.tld/public/pwn.desktop';
      await WindowUtil.openExternal(url);

      assert.ok(shellStub.notCalled);
      assert.ok(dialogStub.called);
    });
  });
});
Program: CWE-20
Project: CVE-2020-17479
Buggy source:

const tap = require('tap');
const { validate, is, typeOf } = require('../index.js');

const json = {
    name: 'arrays',
    items: {
        name: 'arrays',
        list: [
            {
                name: 'Bamboo',
                cost: 180000
            },
            {
                name: 'Samboo',
                cost: -50
            }
        ]
    }
};

const validPattern = {
    name: /arrays/,
    items: {
        name: typeOf('string'),
        list: [
            {
                name: is('exist'),
                cost: typeOf('number')
            }
        ]
    }
};

const invalidPattern = {
    name: /arrays/,
    items: {
        name: typeOf('string'),
        list: [
            {
                name: is('min-length(5)'),
                cost: is('gt(0)')
            }
        ]
    }
};

// Valid Case
tap.test('Arrays', function (t) {
    t.ok(validate(json, validPattern, { debug: true }), 'Valid Case');
    t.ok(!validate(json, invalidPattern, { debug: true }), 'Invalid Case');
    t.end();
});


Fixed version (ground truth):

const tap = require('tap');
const { validate, is, typeOf } = require('../index.js');

const json = {
    name: 'arrays',
    items: {
        name: 'arrays',
        list: [
            {
                name: 'Bamboo',
                cost: 180000
            },
            {
                name: 'Samboo',
                cost: -50
            }
        ]
    }
};

const validPattern = {
    name: /arrays/,
    items: {
        name: typeOf('string'),
        list: [
            {
                name: is('exist'),
                cost: typeOf('number')
            }
        ]
    }
};

const invalidPattern = {
    name: /arrays/,
    items: {
        name: typeOf('string'),
        list: [
            {
                name: is('min-length(5)'),
                cost: is('gt(0)')
            }
        ]
    }
};

// Valid Case
tap.test('Arrays', function (t) {
    t.ok(validate(json, validPattern, { debug: true }), 'Valid Case');
    t.ok(!validate(json, invalidPattern, { debug: true }), 'Invalid Case');
    t.end();
});

// Corrupted Array Cases

const corruptedArray1 = {
    name: 'Corrupted Array 1',
    items: {
        sneakyStuff: 'Don\'t tell anyone, but I\'m not actually an array.',
        constructor: [].constructor
    }
};

const corruptedArray2 = {
    name: 'Corrupted Array 2',
    items: '[object Array]'
};

const corruptedArray3 = {
    name: 'Corrupted Array 3',
    items: {
        constructor: 'Array'
    }
};

const normalArray1 = {
    items: ['Normal One', 1, {}]
};

const corruptedCheckPattern = {
    items: []
};

// Valid Case
tap.test('Arrays Corrupted case', function (t) {
    t.ok(!validate(corruptedArray1, corruptedCheckPattern, { debug: true }), 'Corrupted Array 1');
    t.ok(!validate(corruptedArray2, corruptedCheckPattern, { debug: true }), 'Corrupted Array 2');
    t.ok(!validate(corruptedArray3, corruptedCheckPattern, { debug: true }), 'Corrupted Array 3');
    t.ok(validate(normalArray1, corruptedCheckPattern, { debug: true }), 'Corrupted Array Normmal Case');
    t.end();
});
Program: CWE-20
Project: CVE-2020-24074
Buggy source:

const tap = require('tap');
const { validate, is, typeOf } = require('../index.js');

const json = {
    name: 'arrays',
    items: {
        name: 'arrays',
        list: [
            {
                name: 'Bamboo',
                cost: 180000
            },
            {
                name: 'Samboo',
                cost: -50
            }
        ]
    }
};

const validPattern = {
    name: /arrays/,
    items: {
        name: typeOf('string'),
        list: [
            {
                name: is('exist'),
                cost: typeOf('number')
            }
        ]
    }
};

const invalidPattern = {
    name: /arrays/,
    items: {
        name: typeOf('string'),
        list: [
            {
                name: is('min-length(5)'),
                cost: is('gt(0)')
            }
        ]
    }
};

// Valid Case
tap.test('Arrays', function (t) {
    t.ok(validate(json, validPattern, { debug: true }), 'Valid Case');
    t.ok(!validate(json, invalidPattern, { debug: true }), 'Invalid Case');
    t.end();
});


Fixed version (ground truth):

const tap = require('tap');
const { validate, is, typeOf } = require('../index.js');

const json = {
    name: 'arrays',
    items: {
        name: 'arrays',
        list: [
            {
                name: 'Bamboo',
                cost: 180000
            },
            {
                name: 'Samboo',
                cost: -50
            }
        ]
    }
};

const validPattern = {
    name: /arrays/,
    items: {
        name: typeOf('string'),
        list: [
            {
                name: is('exist'),
                cost: typeOf('number')
            }
        ]
    }
};

const invalidPattern = {
    name: /arrays/,
    items: {
        name: typeOf('string'),
        list: [
            {
                name: is('min-length(5)'),
                cost: is('gt(0)')
            }
        ]
    }
};

// Valid Case
tap.test('Arrays', function (t) {
    t.ok(validate(json, validPattern, { debug: true }), 'Valid Case');
    t.ok(!validate(json, invalidPattern, { debug: true }), 'Invalid Case');
    t.end();
});

// Corrupted Array Cases

const corruptedArray1 = {
    name: 'Corrupted Array 1',
    items: {
        sneakyStuff: 'Don\'t tell anyone, but I\'m not actually an array.',
        constructor: [].constructor
    }
};

const corruptedArray2 = {
    name: 'Corrupted Array 2',
    items: '[object Array]'
};

const corruptedArray3 = {
    name: 'Corrupted Array 3',
    items: {
        constructor: 'Array'
    }
};

const normalArray1 = {
    items: ['Normal One', 1, {}]
};

const corruptedCheckPattern = {
    items: []
};

// Valid Case
tap.test('Arrays Corrupted case', function (t) {
    t.ok(!validate(corruptedArray1, corruptedCheckPattern, { debug: true }), 'Corrupted Array 1');
    t.ok(!validate(corruptedArray2, corruptedCheckPattern, { debug: true }), 'Corrupted Array 2');
    t.ok(!validate(corruptedArray3, corruptedCheckPattern, { debug: true }), 'Corrupted Array 3');
    t.ok(validate(normalArray1, corruptedCheckPattern, { debug: true }), 'Corrupted Array Normmal Case');
    t.end();
});
Program: CWE-20
Project: CVE-2020-5215
Buggy source:
None

Fixed version (ground truth):
# Copyright 2020 The TensorFlow Authors. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ==============================================================================
"""Tests for tensorflow.python.framework.constant_op."""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

from absl.testing import parameterized

from tensorflow.python.framework import constant_op
from tensorflow.python.framework import dtypes
from tensorflow.python.framework import ops
from tensorflow.python.platform import test


class ConstantOpTest(test.TestCase, parameterized.TestCase):

  @parameterized.parameters(
      dtypes.bfloat16,
      dtypes.complex128,
      dtypes.complex64,
      dtypes.double,
      dtypes.float16,
      dtypes.float32,
      dtypes.float64,
      dtypes.half,
      dtypes.int16,
      dtypes.int32,
      dtypes.int64,
      dtypes.int8,
      dtypes.qint16,
      dtypes.qint32,
      dtypes.qint8,
      dtypes.quint16,
      dtypes.quint8,
      dtypes.uint16,
      dtypes.uint32,
      dtypes.uint64,
      dtypes.uint8,
  )
  def test_convert_string_to_number(self, dtype):
    with self.assertRaises(TypeError):
      constant_op.constant("hello", dtype)


if __name__ == "__main__":
  ops.enable_eager_execution()
  test.main()
Program: CWE-20
Project: CVE-2020-5238
Buggy source:
None

Fixed version (ground truth):
# Copyright 2020 The TensorFlow Authors. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ==============================================================================
"""Tests for tensorflow.python.framework.constant_op."""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

from absl.testing import parameterized

from tensorflow.python.framework import constant_op
from tensorflow.python.framework import dtypes
from tensorflow.python.framework import ops
from tensorflow.python.platform import test


class ConstantOpTest(test.TestCase, parameterized.TestCase):

  @parameterized.parameters(
      dtypes.bfloat16,
      dtypes.complex128,
      dtypes.complex64,
      dtypes.double,
      dtypes.float16,
      dtypes.float32,
      dtypes.float64,
      dtypes.half,
      dtypes.int16,
      dtypes.int32,
      dtypes.int64,
      dtypes.int8,
      dtypes.qint16,
      dtypes.qint32,
      dtypes.qint8,
      dtypes.quint16,
      dtypes.quint8,
      dtypes.uint16,
      dtypes.uint32,
      dtypes.uint64,
      dtypes.uint8,
  )
  def test_convert_string_to_number(self, dtype):
    with self.assertRaises(TypeError):
      constant_op.constant("hello", dtype)


if __name__ == "__main__":
  ops.enable_eager_execution()
  test.main()
Program: CWE-20
Project: CVE-2020-5255
Buggy source:
None

Fixed version (ground truth):
# Copyright 2020 The TensorFlow Authors. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ==============================================================================
"""Tests for tensorflow.python.framework.constant_op."""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

from absl.testing import parameterized

from tensorflow.python.framework import constant_op
from tensorflow.python.framework import dtypes
from tensorflow.python.framework import ops
from tensorflow.python.platform import test


class ConstantOpTest(test.TestCase, parameterized.TestCase):

  @parameterized.parameters(
      dtypes.bfloat16,
      dtypes.complex128,
      dtypes.complex64,
      dtypes.double,
      dtypes.float16,
      dtypes.float32,
      dtypes.float64,
      dtypes.half,
      dtypes.int16,
      dtypes.int32,
      dtypes.int64,
      dtypes.int8,
      dtypes.qint16,
      dtypes.qint32,
      dtypes.qint8,
      dtypes.quint16,
      dtypes.quint8,
      dtypes.uint16,
      dtypes.uint32,
      dtypes.uint64,
      dtypes.uint8,
  )
  def test_convert_string_to_number(self, dtype):
    with self.assertRaises(TypeError):
      constant_op.constant("hello", dtype)


if __name__ == "__main__":
  ops.enable_eager_execution()
  test.main()
Program: CWE-20
Project: CVE-2020-8815
Buggy source:
--> IT ONLY CONTAINS THE MOST RECENT CHANGES!

v0.3.0:
- Toggleable anonymous logins
- Per-IP logs (create "iplogs" folder)
- Max connections per second and max active connections are now changeable
- Buffer size can now be changed (def.8192) 
- Fixed lower-case command handling
- Final attempt to fix an encoding bug related to outputting control characters
- Changeable bantime
- Toggleable ban on big amount of errors (a.k.a some sort of service probe)
- Moved default config to Resources

Fixed version (ground truth):
--> IT ONLY CONTAINS THE MOST RECENT CHANGES!

v0.3.1:
- Fixed AllowAnonymous handling (oops)
- One more attempt to fix encoding break on some characters (only affects console)
- Fixed improper handling of incoming data on base socket (a.k.a base socket thread overuse fix)