rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: XSS via prototype pollution in NodeBB  ### Impact
A prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report.

### Patches
The vulnerability has been patched as of v1.18.5.

### Workarounds
Cherry-pick commit hash 1783f918bc19568f421473824461ff2ed7755e4c to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
Vulnerability ID: GHSA-wx69-rvg3-x7fc
CWE: CWE-79
Severity score: 9
Project: https://github.com/NodeBB/NodeBB
Published: 2021-11-30
File: src/socket.io/uploads.js
Commit message: fix: guard against prototype pollution
Commit author: Barış Soner Uşaklı

Vulnerable version (before fix):
 uploads.upload = async function (socket, data) { 		'user.updateCover': socketUser.updateCover, 		'groups.cover.update': socketGroup.cover.update, 	}; 	if (!socket.uid || !data || !data.chunk || !data.params || !data.params.method || !methodToFunc[data.params.method]) { 		throw new Error('[[error:invalid-data]]'); 	}  	inProgress[socket.id] = inProgress[socket.id] || {}; 	const socketUploads = inProgress[socket.id]; 	const { method } = data.params; 

Fixed version (after fix):
 uploads.upload = async function (socket, data) { 		'user.updateCover': socketUser.updateCover, 		'groups.cover.update': socketGroup.cover.update, 	}; 	if (!socket.uid || !data || !data.chunk || 		!data.params || !data.params.method || !methodToFunc.hasOwnProperty(data.params.method)) { 		throw new Error('[[error:invalid-data]]'); 	}  	inProgress[socket.id] = inProgress[socket.id] || Object.create(null); 	const socketUploads = inProgress[socket.id]; 	const { method } = data.params; 

Patch:
patch: @@ -15,11 +15,12 @@ uploads.upload = async function (socket, data) {
 		'user.updateCover': socketUser.updateCover,
 		'groups.cover.update': socketGroup.cover.update,
 	};
-	if (!socket.uid || !data || !data.chunk || !data.params || !data.params.method || !methodToFunc[data.params.method]) {
+	if (!socket.uid || !data || !data.chunk ||
+		!data.params || !data.params.method || !methodToFunc.hasOwnProperty(data.params.method)) {
 		throw new Error('[[error:invalid-data]]');
 	}
 
-	inProgress[socket.id] = inProgress[socket.id] || {};
+	inProgress[socket.id] = inProgress[socket.id] || Object.create(null);
 	const socketUploads = inProgress[socket.id];
 	const { method } = data.params;
path: src/socket.io/uploads.js
Vulnerability: Static Code Injection in Microweber Microweber is a new generation CMS with drag and drop. Prior to version 1.3, Microweber is vulnerable to static code injection.
Vulnerability ID: GHSA-x28w-hvwc-mp75
CWE: CWE-94
Severity score: 7.7
Project: https://github.com/microweber/microweber
Published: 2022-03-11
File: src/MicroweberPackages/Checkout/Http/Controllers/Traits/ContactInformationTrait.php
Commit message: Update ContactInformationTrait.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 public function contactInformation() {      public function contactInformationSave(Request $request) {          session_append_array('checkout_v2', [             'first_name'=> $request->get('first_name'),             'last_name'=> $request->get('last_name'),             'email'=> $request->get('email'),             'phone'=> $request->get('phone')         ]);          $validate = $this->_validateContactInformation($request->all());

Fixed version (after fix):
 public function contactInformation() {      public function contactInformationSave(Request $request) {          $firstName = strip_tags($request->get('first_name'));         $lastName = strip_tags($request->get('last_name'));         $email = strip_tags($request->get('email'));         $phone = strip_tags($request->get('phone'));          session_append_array('checkout_v2', [             'first_name'=> $firstName,             'last_name'=> $lastName,             'email'=> $email,             'phone'=> $phone         ]);          $validate = $this->_validateContactInformation($request->all());

Patch:
patch: @@ -36,11 +36,16 @@ public function contactInformation() {
 
     public function contactInformationSave(Request $request) {
 
+        $firstName = strip_tags($request->get('first_name'));
+        $lastName = strip_tags($request->get('last_name'));
+        $email = strip_tags($request->get('email'));
+        $phone = strip_tags($request->get('phone'));
+
         session_append_array('checkout_v2', [
-            'first_name'=> $request->get('first_name'),
-            'last_name'=> $request->get('last_name'),
-            'email'=> $request->get('email'),
-            'phone'=> $request->get('phone')
+            'first_name'=> $firstName,
+            'last_name'=> $lastName,
+            'email'=> $email,
+            'phone'=> $phone
         ]);
 
         $validate = $this->_validateContactInformation($request->all());
path: src/MicroweberPackages/Checkout/Http/Controllers/Traits/ContactInformationTrait.php
Vulnerability: SQL Injection in sequelize Affected versions of `sequelize` use MySQL's backslash-based escape syntax when connecting to SQLite, despite the fact that SQLite uses PostgreSQL's escape syntax, which can result in a SQL Injection vulnerability.


## Recommendation

Update to version 1.7.0-alpha3 or later.
Vulnerability ID: GHSA-x2jc-pwfj-h9p3
CWE: CWE-89
Severity score: 0
Project: https://github.com/sequelize/sequelize
Published: 2019-02-18
File: lib/sql-string.js
Commit message: Fix string escaping for sqlite

SQLite was defaulting to the MySQL backslash-escaped style, but it uses
postgres-style escaping. This is a SQL-injection vulnerability, and
shouldn't be taken lightly (although SQLite is mostly for testing).
Commit author: Benjamin Woodruff

Vulnerable version (before fix):
 SqlString.escape = function(val, stringifyObjects, timeZone, dialect) {     }   }    if (dialect == "postgres") {     // http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS     val = val.replace(/'/g, "''");   } else {     val = val.replace(/[\0\n\r\b\t\\\'\"\x1a]/g, function(s) {

Fixed version (after fix):
 SqlString.escape = function(val, stringifyObjects, timeZone, dialect) {     }   }    if (dialect === "postgres" || dialect === "sqlite") {     // http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS     // http://stackoverflow.com/q/603572/130598     val = val.replace(/'/g, "''");   } else {     val = val.replace(/[\0\n\r\b\t\\\'\"\x1a]/g, function(s) {

Patch:
patch: @@ -37,8 +37,9 @@ SqlString.escape = function(val, stringifyObjects, timeZone, dialect) {
     }
   }
 
-  if (dialect == "postgres") {
+  if (dialect === "postgres" || dialect === "sqlite") {
     // http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS
+    // http://stackoverflow.com/q/603572/130598
     val = val.replace(/'/g, "''");
   } else {
     val = val.replace(/[\0\n\r\b\t\\\'\"\x1a]/g, function(s) {
path: lib/sql-string.js
Vulnerability: Improper Input Validation in tar-fs A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.
Vulnerability ID: GHSA-x2mc-8fgj-3wmr
CWE: CWE-20
Severity score: 7.5
Project: https://github.com/mafintosh/tar-fs
Published: 2019-05-01
File: index.js
Commit message: force hardlink targets to be in the tar
Commit author: Mathias Buus

Vulnerable version (before fix):
 exports.extract = function (cwd, opts) {     var onlink = function () {       if (win32) return next() // skip links on win for now before it can be tested       xfs.unlink(name, function () {         var srcpath = path.resolve(cwd, header.linkname)          xfs.link(srcpath, name, function (err) {           if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) {

Fixed version (after fix):
 exports.extract = function (cwd, opts) {     var onlink = function () {       if (win32) return next() // skip links on win for now before it can be tested       xfs.unlink(name, function () {         var srcpath = path.join(cwd, path.join('/', header.linkname))          xfs.link(srcpath, name, function (err) {           if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) {

Patch:
patch: @@ -261,7 +261,7 @@ exports.extract = function (cwd, opts) {
     var onlink = function () {
       if (win32) return next() // skip links on win for now before it can be tested
       xfs.unlink(name, function () {
-        var srcpath = path.resolve(cwd, header.linkname)
+        var srcpath = path.join(cwd, path.join('/', header.linkname))
 
         xfs.link(srcpath, name, function (err) {
           if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) {
path: index.js
Vulnerability: Crash due to malformed relay protocol message ### Impact

1. `syncthing` can be caused to crash and exit if sent a malformed relay
   protocol message message with a negative length field.

2. The relay server `strelaysrv` can be caused to crash and exit if sent
   a malformed relay protocol message with a negative length field.

At no point is sensitive data exposed or liable to be altered due to this
issue. Sensitive data is never exposed to relay operators. Syncthing itself
would need to be lured to connect to a malicious relay server in order to
exploit the issue.

### Patches

Fixed in version 1.15.0.

### Workarounds

1. No known workaround for `strelaysrv`.

2. `syncthing` can be configured to not use relays, or to only use specific,
   trusted relays. If Syncthing is used in a closed environment or with
   relaying disabled, i.e., it does not communicate with unknown relays,
   Syncthing is not vulnerable.

### For more information

If you have any questions or comments about this advisory, please discuss it [on the forum](https://forum.syncthing.net/).

Thanks to Wojciech Paciorek for discovering and reporting this issue.
Vulnerability ID: GHSA-x462-89pf-6r5h
CWE: CWE-20
Severity score: 7.5
Project: https://github.com/syncthing/syncthing
Published: 2021-05-21
File: lib/relay/protocol/protocol.go
Commit message: Merge pull request from GHSA-x462-89pf-6r5h
Commit author: Jakob Borg

Vulnerable version (before fix):
 package protocol  import ( 	"errors" 	"io" )  func ReadMessage(r io.Reader) (interface{}, error) { 	if header.magic != magic { 		return nil, errors.New("magic mismatch") 	}  	buf = make([]byte, int(header.messageLength)) 	if _, err := io.ReadFull(r, buf); err != nil {

Fixed version (after fix):
 package protocol  import ( 	"errors" 	"fmt" 	"io" )  func ReadMessage(r io.Reader) (interface{}, error) { 	if header.magic != magic { 		return nil, errors.New("magic mismatch") 	} 	if header.messageLength < 0 || header.messageLength > 1024 { 		return nil, fmt.Errorf("bad length (%d)", header.messageLength) 	}  	buf = make([]byte, int(header.messageLength)) 	if _, err := io.ReadFull(r, buf); err != nil {

Patch:
patch: @@ -4,6 +4,7 @@ package protocol
 
 import (
 	"errors"
+	"fmt"
 	"io"
 )
 
@@ -86,6 +87,9 @@ func ReadMessage(r io.Reader) (interface{}, error) {
 	if header.magic != magic {
 		return nil, errors.New("magic mismatch")
 	}
+	if header.messageLength < 0 || header.messageLength > 1024 {
+		return nil, fmt.Errorf("bad length (%d)", header.messageLength)
+	}
 
 	buf = make([]byte, int(header.messageLength))
 	if _, err := io.ReadFull(r, buf); err != nil {
path: lib/relay/protocol/protocol.go
Vulnerability: Cross-site Scripting in OctoPrint Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. The login endpoint allows for javascript injection which may lead to account takeover in a phishing scenario.
Vulnerability ID: GHSA-x7r7-wmj8-vv5g
CWE: CWE-79
Severity score: 7.5
Project: https://github.com/octoprint/octoprint
Published: 2022-05-19
File: src/octoprint/server/views.py
Commit message: 🔒️ Sanitize and validate login redirect

Fixes an XSS and an open redirect issue.
Commit author: Gina Häußge

Vulnerable version (before fix):
 import os import re from collections import defaultdict  from flask import (     Response, def _add_additional_assets(hook): def login():     from flask_login import current_user      redirect_url = request.args.get("redirect", request.script_root + url_for("index"))     permissions = sorted(         filter(             lambda x: x is not None and isinstance(x, OctoPrintPermission),

Fixed version (after fix):
 import os import re from collections import defaultdict from urllib.parse import urlparse  from flask import (     Response, def _add_additional_assets(hook): def login():     from flask_login import current_user      default_redirect_url = request.script_root + url_for("index")     redirect_url = request.args.get("redirect", default_redirect_url)      parsed = urlparse(redirect_url)  # check if redirect url is valid     if parsed.scheme != "" or parsed.netloc != "":         _logger.warning(             f"Got an invalid redirect URL with the login attempt, misconfiguration or attack attempt: {redirect_url}"         )         redirect_url = default_redirect_url      permissions = sorted(         filter(             lambda x: x is not None and isinstance(x, OctoPrintPermission),

Patch:
patch: @@ -8,6 +8,7 @@
 import os
 import re
 from collections import defaultdict
+from urllib.parse import urlparse
 
 from flask import (
     Response,
@@ -170,7 +171,16 @@ def _add_additional_assets(hook):
 def login():
     from flask_login import current_user
 
-    redirect_url = request.args.get("redirect", request.script_root + url_for("index"))
+    default_redirect_url = request.script_root + url_for("index")
+    redirect_url = request.args.get("redirect", default_redirect_url)
+
+    parsed = urlparse(redirect_url)  # check if redirect url is valid
+    if parsed.scheme != "" or parsed.netloc != "":
+        _logger.warning(
+            f"Got an invalid redirect URL with the login attempt, misconfiguration or attack attempt: {redirect_url}"
+        )
+        redirect_url = default_redirect_url
+
     permissions = sorted(
         filter(
             lambda x: x is not None and isinstance(x, OctoPrintPermission),
path: src/octoprint/server/views.py
Vulnerability: Improper Input Validation in libpam4j It was found that libpam4j prior to 1.10 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
Vulnerability ID: GHSA-x9rg-q5fx-fx66
CWE: CWE-20
Severity score: 6.5
Project: https://github.com/kohsuke/libpam4j
Published: 2022-05-13
File: src/main/java/org/jvnet/libpam/PAM.java
Commit message: call pam_acct_mgmt to verify whether the user account is valid.

This fixes issue #18 and thus CVE-2017-12197
Commit author: Kohsuke Kawaguchi

Vulnerable version (before fix):
 public UnixUser authenticate(String username, String password) throws PAMExcepti             check(libpam.pam_authenticate(pht,0),"pam_authenticate failed");             check(libpam.pam_setcred(pht,0),"pam_setcred failed");             // several different error code seem to be used to represent authentication failures //            check(libpam.pam_acct_mgmt(pht,0),"pam_acct_mgmt failed");              PointerByReference r = new PointerByReference();             check(libpam.pam_get_item(pht,PAM_USER,r),"pam_get_item failed");

Fixed version (after fix):
 public UnixUser authenticate(String username, String password) throws PAMExcepti             check(libpam.pam_authenticate(pht,0),"pam_authenticate failed");             check(libpam.pam_setcred(pht,0),"pam_setcred failed");             // several different error code seem to be used to represent authentication failures             check(libpam.pam_acct_mgmt(pht,0),"pam_acct_mgmt failed");              PointerByReference r = new PointerByReference();             check(libpam.pam_get_item(pht,PAM_USER,r),"pam_get_item failed");

Patch:
patch: @@ -124,7 +124,7 @@ public UnixUser authenticate(String username, String password) throws PAMExcepti
             check(libpam.pam_authenticate(pht,0),"pam_authenticate failed");
             check(libpam.pam_setcred(pht,0),"pam_setcred failed");
             // several different error code seem to be used to represent authentication failures
-//            check(libpam.pam_acct_mgmt(pht,0),"pam_acct_mgmt failed");
+            check(libpam.pam_acct_mgmt(pht,0),"pam_acct_mgmt failed");
 
             PointerByReference r = new PointerByReference();
             check(libpam.pam_get_item(pht,PAM_USER,r),"pam_get_item failed");
path: src/main/java/org/jvnet/libpam/PAM.java
Vulnerability: Memory Exposure in tunnel-agent Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Proof-of-concept:
```js
require('request')({
  method: 'GET',
  uri: 'http://www.example.com',
  tunnel: true,
  proxy:{
    protocol: 'http:',
    host:'127.0.0.1',
    port:8080,
    auth:USERSUPPLIEDINPUT // number
  }
});
```


## Recommendation

Update to version 0.6.0 or later.
Vulnerability ID: GHSA-xc7v-wxcw-j472
CWE: CWE-200
Severity score: 0
Project: https://github.com/request/tunnel-agent
Published: 2019-06-03
File: index.js
Commit message: Use .from
Commit author: Mikeal Rogers

Vulnerable version (before fix):
 TunnelingAgent.prototype.createSocket = function createSocket(options, cb) {   if (connectOptions.proxyAuth) {     connectOptions.headers = connectOptions.headers || {}     connectOptions.headers['Proxy-Authorization'] = 'Basic ' +         new Buffer(connectOptions.proxyAuth).toString('base64')   }    debug('making CONNECT request')

Fixed version (after fix):
 TunnelingAgent.prototype.createSocket = function createSocket(options, cb) {   if (connectOptions.proxyAuth) {     connectOptions.headers = connectOptions.headers || {}     connectOptions.headers['Proxy-Authorization'] = 'Basic ' +         Buffer.from(connectOptions.proxyAuth).toString('base64')   }    debug('making CONNECT request')

Patch:
patch: @@ -128,7 +128,7 @@ TunnelingAgent.prototype.createSocket = function createSocket(options, cb) {
   if (connectOptions.proxyAuth) {
     connectOptions.headers = connectOptions.headers || {}
     connectOptions.headers['Proxy-Authorization'] = 'Basic ' +
-        new Buffer(connectOptions.proxyAuth).toString('base64')
+        Buffer.from(connectOptions.proxyAuth).toString('base64')
   }
 
   debug('making CONNECT request')
path: index.js
Vulnerability: Regular Expression Denial of Service (ReDoS) The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.
Vulnerability ID: GHSA-xfhp-gmh8-r8v2
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/adaltas/node-printf
Published: 2021-03-19
File: lib/printf.js
Commit message: Fix ReDoS
Commit author: Yeting Li

Vulnerable version (before fix):
 var Formatter = function(/*String*/ format){   this._tokens = tokenize(format, this._re, this._parseDelim, this); };  Formatter.prototype._re = /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\#]*)([\*1-9]0*)*(?:(\.)(\*|\d+)?)?[hlL]?([\%bscdeEfFgGioOuxX])/g; Formatter.prototype._parseDelim = function(mapping, intmapping, flags, minWidth, period, precision, specifier){   if(mapping){     this._mapped = true;

Fixed version (after fix):
 var Formatter = function(/*String*/ format){   this._tokens = tokenize(format, this._re, this._parseDelim, this); };  Formatter.prototype._re = /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\#]*)(\*|\d+)?(?:(\.)(\*|\d+)?)?[hlL]?([\%bscdeEfFgGioOuxX])/g; Formatter.prototype._parseDelim = function(mapping, intmapping, flags, minWidth, period, precision, specifier){   if(mapping){     this._mapped = true;

Patch:
patch: @@ -41,7 +41,7 @@ var Formatter = function(/*String*/ format){
   this._tokens = tokenize(format, this._re, this._parseDelim, this);
 };
 
-Formatter.prototype._re = /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\#]*)([\*1-9]0*)*(?:(\.)(\*|\d+)?)?[hlL]?([\%bscdeEfFgGioOuxX])/g;
+Formatter.prototype._re = /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\#]*)(\*|\d+)?(?:(\.)(\*|\d+)?)?[hlL]?([\%bscdeEfFgGioOuxX])/g;
 Formatter.prototype._parseDelim = function(mapping, intmapping, flags, minWidth, period, precision, specifier){
   if(mapping){
     this._mapped = true;
path: lib/printf.js
Vulnerability: Microweber Stored Cross-site Scripting before v1.2.20 Microwerber prior to version 1.2.20 is vulnerable to stored Cross-site Scripting (XSS).
Vulnerability ID: GHSA-xg72-6c83-ghh4
CWE: CWE-79
Severity score: 4.8
Project: https://github.com/microweber/microweber
Published: 2022-07-23
File: src/MicroweberPackages/App/functions/plupload.php
Commit message: update
Commit author: Peter Ivanov

Vulnerable version (before fix):
                 }              } else if ($ext === 'svg') {                  if (is_file($filePath)) {                     $sanitizer = new \enshrined\svgSanitize\Sanitizer();                     // Load the dirty svg                     $dirtySVG = file_get_contents($filePath);                      // Pass it to the sanitizer and get it back clean                     $cleanSVG = $sanitizer->sanitize($dirtySVG);                     file_put_contents($filePath, $cleanSVG);                  }                $valid = true;              } else {                 $valid = false;

Fixed version (after fix):
                 }              } else if ($ext === 'svg') {                 $valid = false;                 if (is_file($filePath)) {                     $sanitizer = new \enshrined\svgSanitize\Sanitizer();                     // Load the dirty svg                     $dirtySVG = file_get_contents($filePath);                      // Pass it to the sanitizer and get it back clean                     try {                         $cleanSVG = $sanitizer->sanitize($dirtySVG);                         $valid = true;                     } catch (\Exception $e) {                         $valid = false;                     }                      if ($valid) {                         file_put_contents($filePath, $cleanSVG);                     }                  }               } else {                 $valid = false;

Patch:
patch: @@ -563,17 +563,25 @@
                 }
 
             } else if ($ext === 'svg') {
-
+                $valid = false;
                 if (is_file($filePath)) {
                     $sanitizer = new \enshrined\svgSanitize\Sanitizer();
                     // Load the dirty svg
                     $dirtySVG = file_get_contents($filePath);
                      // Pass it to the sanitizer and get it back clean
-                    $cleanSVG = $sanitizer->sanitize($dirtySVG);
-                    file_put_contents($filePath, $cleanSVG);
+                    try {
+                        $cleanSVG = $sanitizer->sanitize($dirtySVG);
+                        $valid = true;
+                    } catch (\Exception $e) {
+                        $valid = false;
+                    }
+
+                    if ($valid) {
+                        file_put_contents($filePath, $cleanSVG);
+                    }
 
                 }
-               $valid = true;
+
 
             } else {
                 $valid = false;
path: src/MicroweberPackages/App/functions/plupload.php