rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Improper Neutralization of Input During Web Page Generation in Jenkins jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388).
Vulnerability ID: GHSA-jff5-55xj-4jcq
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/jenkinsci/jenkins
Published: 2022-05-13
File: war/src/main/webapp/scripts/hudson-behavior.js
Commit message: Merge pull request #98 from jenkinsci-cert/SECURITY-388

[SECURITY-388] Escape metacharacters in the search box
Commit author: Jesse Glick

Vulnerable version (before fix):
 function createSearchBox(searchURL) {     var ac = new YAHOO.widget.AutoComplete("search-box","search-box-completion",ds);     ac.typeAhead = false;     ac.autoHighlight = false;      var box   = $("search-box");     var sizer = $("search-box-sizer");

Fixed version (after fix):
 function createSearchBox(searchURL) {     var ac = new YAHOO.widget.AutoComplete("search-box","search-box-completion",ds);     ac.typeAhead = false;     ac.autoHighlight = false;     ac.formatResult = ac.formatEscapedResult;      var box   = $("search-box");     var sizer = $("search-box-sizer");

Patch:
patch: @@ -2168,6 +2168,7 @@ function createSearchBox(searchURL) {
     var ac = new YAHOO.widget.AutoComplete("search-box","search-box-completion",ds);
     ac.typeAhead = false;
     ac.autoHighlight = false;
+    ac.formatResult = ac.formatEscapedResult;
 
     var box   = $("search-box");
     var sizer = $("search-box-sizer");
path: war/src/main/webapp/scripts/hudson-behavior.js
Vulnerability: tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion nodejs-tmpl is simple string formatting. tmpl is vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion.
Vulnerability ID: GHSA-jgrx-mgxx-jf9v
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/daaku/nodejs-tmpl
Published: 2021-09-20
File: lib/tmpl.js
Commit message: fix potential dos in regex
Commit author: Naitik Shah

Vulnerable version (before fix):
 var INTERPOLATE = /{([\s\S]+?)}/g  module.exports = function(str, data) {   var tmpl = 'var __p=[],print=function(){__p.push.apply(__p,arguments);};' +

Fixed version (after fix):
 var INTERPOLATE = /{([^{]+?)}/g  module.exports = function(str, data) {   var tmpl = 'var __p=[],print=function(){__p.push.apply(__p,arguments);};' +

Patch:
patch: @@ -1,4 +1,4 @@
-var INTERPOLATE = /{([\s\S]+?)}/g
+var INTERPOLATE = /{([^{]+?)}/g
 
 module.exports = function(str, data) {
   var tmpl = 'var __p=[],print=function(){__p.push.apply(__p,arguments);};' +
path: lib/tmpl.js
Vulnerability: Denial-of-Service within Docker container ### Impact
If you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) because it doesn't get process ID and process group ID of teler properly to kills.

### Patches
Upgrade to the >= 0.0.1 version.

### Workarounds
N/A

### References
- https://github.com/kitabisa/teler/commit/ec6082049dba9e44a21f35fb7b123d42ce1a1a7e

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Issues Section](https://github.com/kitabisa/teler/issues)
* Email us at [infosec@kitabisa.com](mailto:infosec@kitabisa.com)
Vulnerability ID: GHSA-jhj6-5mh6-4pvf
CWE: CWE-476
Severity score: 7.5
Project: https://github.com/kitabisa/teler
Published: 2021-05-24
File: pkg/errors/abort.go
Commit message: :hammer: Fix segmentation fault of syscall

If teler is run via the docker image, the syscall function cannot allocate and return a nil pointer to address.
Commit author: Dwi Siswanto

Vulnerable version (before fix):
  package errors  import "syscall"  // Abort will terminate & sends SIGTERM to process func Abort(i ...int) { 	pgid, err := syscall.Getpgid(syscall.Getpid()) 	if err != nil { 		Exit(err.Error())

Fixed version (after fix):
  package errors  import ( 	"os" 	"syscall" )  // Abort will terminate & sends SIGTERM to process func Abort(i ...int) { 	if _, err := os.Stat("/.dockerenv"); err == nil { 		os.Exit(i[0]) 	}  	pgid, err := syscall.Getpgid(syscall.Getpid()) 	if err != nil { 		Exit(err.Error())

Patch:
patch: @@ -2,10 +2,17 @@
 
 package errors
 
-import "syscall"
+import (
+	"os"
+	"syscall"
+)
 
 // Abort will terminate & sends SIGTERM to process
 func Abort(i ...int) {
+	if _, err := os.Stat("/.dockerenv"); err == nil {
+		os.Exit(i[0])
+	}
+
 	pgid, err := syscall.Getpgid(syscall.Getpid())
 	if err != nil {
 		Exit(err.Error())
path: pkg/errors/abort.go
Vulnerability: Improper Input Validation in Firefly III Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
Vulnerability ID: GHSA-jjcx-999m-35hc
CWE: CWE-20
Severity score: 3.3
Project: https://github.com/firefly-iii/firefly-iii
Published: 2021-09-08
File: app/Support/Import/JobConfiguration/FinTS/NewFinTSJobHandler.php
Commit message: Fix #2367
Commit author: James Cole

Vulnerable version (before fix):
 public function configureJob(array $data): MessageBag         $config['fints_password']  = (string)(Crypt::encrypt($data['fints_password']) ?? '');         $config['apply-rules']     = 1 === (int)$data['apply_rules'];          $this->repository->setConfiguration($this->importJob, $config);   public function setImportJob(ImportJob $importJob): void         $this->repository->setUser($importJob->user);     }  }

Fixed version (after fix):
 public function configureJob(array $data): MessageBag         $config['fints_password']  = (string)(Crypt::encrypt($data['fints_password']) ?? '');         $config['apply-rules']     = 1 === (int)$data['apply_rules'];          // sanitize FinTS URL.         $config['fints_url'] = $this->validURI($config['fints_url']) ? $config['fints_url'] : '';          $this->repository->setConfiguration($this->importJob, $config);   public function setImportJob(ImportJob $importJob): void         $this->repository->setUser($importJob->user);     }      /**      * @param string $fints_url      *      * @return bool      */     private function validURI(string $fintsUri): bool     {         $res = filter_var($fintsUri, FILTER_VALIDATE_URL);         if (false === $res) {             return false;         }         $scheme = parse_url($fintsUri, PHP_URL_SCHEME);          return 'https' === $scheme;     }   }

Patch:
patch: @@ -60,6 +60,9 @@ public function configureJob(array $data): MessageBag
         $config['fints_password']  = (string)(Crypt::encrypt($data['fints_password']) ?? '');
         $config['apply-rules']     = 1 === (int)$data['apply_rules'];
 
+        // sanitize FinTS URL.
+        $config['fints_url'] = $this->validURI($config['fints_url']) ? $config['fints_url'] : '';
+
         $this->repository->setConfiguration($this->importJob, $config);
 
 
@@ -108,4 +111,21 @@ public function setImportJob(ImportJob $importJob): void
         $this->repository->setUser($importJob->user);
     }
 
+    /**
+     * @param string $fints_url
+     *
+     * @return bool
+     */
+    private function validURI(string $fintsUri): bool
+    {
+        $res = filter_var($fintsUri, FILTER_VALIDATE_URL);
+        if (false === $res) {
+            return false;
+        }
+        $scheme = parse_url($fintsUri, PHP_URL_SCHEME);
+
+        return 'https' === $scheme;
+    }
+
+
 }
path: app/Support/Import/JobConfiguration/FinTS/NewFinTSJobHandler.php
Vulnerability: Moderate severity vulnerability that affects rails CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
Vulnerability ID: GHSA-jmgf-p46x-982h
CWE: CWE-352
Severity score: 0
Project: http://github.com/rails/rails
Published: 2017-10-24
File: actionpack/lib/action_controller/response.rb
Commit message: Sanitize the URLs passed to redirect_to to prevent a potential response spli

CGI.rb and mongrel don't do any sanitization of the contents of HTTP headers
Commit author: Michael Koziarski

Vulnerable version (before fix):
 def charset      def redirect(to_url, response_status)       self.headers["Status"] = response_status       self.headers["Location"] = to_url        self.body = "<html><body>You are being <a href=\"#{to_url}\">redirected</a>.</body></html>"     end      def prepare!

Fixed version (after fix):
 def charset      def redirect(to_url, response_status)       self.headers["Status"] = response_status       self.headers["Location"] = to_url.gsub(/[\r\n]/, '')        self.body = "<html><body>You are being <a href=\"#{CGI.escapeHTML(to_url)}\">redirected</a>.</body></html>"     end      def prepare!

Patch:
patch: @@ -30,9 +30,9 @@ def charset
 
     def redirect(to_url, response_status)
       self.headers["Status"] = response_status
-      self.headers["Location"] = to_url
+      self.headers["Location"] = to_url.gsub(/[\r\n]/, '')
 
-      self.body = "<html><body>You are being <a href=\"#{to_url}\">redirected</a>.</body></html>"
+      self.body = "<html><body>You are being <a href=\"#{CGI.escapeHTML(to_url)}\">redirected</a>.</body></html>"
     end
 
     def prepare!
path: actionpack/lib/action_controller/response.rb
Vulnerability: Sensitive information exposure through logs in npm-registry-fetch Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.
Vulnerability ID: GHSA-jmqm-f2gx-4fjv
CWE: CWE-352
Severity score: 5.3
Project: https://github.com/npm/npm-registry-fetch
Published: 2020-07-07
File: check-response.js
Commit message: chore: remove auth data from logs (#29)
Commit author: Claudia Hernández

Vulnerable version (before fix):
 function logRequest (method, res, startTime, opts) {   const attempt = res.headers.get('x-fetch-attempts')   const attemptStr = attempt && attempt > 1 ? ` attempt #${attempt}` : ''   const cacheStr = res.headers.get('x-local-cache') ? ' (from cache)' : ''   opts.log.http(     'fetch',     `${method.toUpperCase()} ${res.status} ${res.url} ${elapsedTime}ms${attemptStr}${cacheStr}`   ) } 

Fixed version (after fix):
 function logRequest (method, res, startTime, opts) {   const attempt = res.headers.get('x-fetch-attempts')   const attemptStr = attempt && attempt > 1 ? ` attempt #${attempt}` : ''   const cacheStr = res.headers.get('x-local-cache') ? ' (from cache)' : ''    let urlStr   try {     const url = new URL(res.url)     urlStr = res.url.replace(url.password, '***')   } catch {     urlStr = res.url   }    opts.log.http(     'fetch',     `${method.toUpperCase()} ${res.status} ${urlStr} ${elapsedTime}ms${attemptStr}${cacheStr}`   ) } 

Patch:
patch: @@ -30,9 +30,18 @@ function logRequest (method, res, startTime, opts) {
   const attempt = res.headers.get('x-fetch-attempts')
   const attemptStr = attempt && attempt > 1 ? ` attempt #${attempt}` : ''
   const cacheStr = res.headers.get('x-local-cache') ? ' (from cache)' : ''
+
+  let urlStr
+  try {
+    const url = new URL(res.url)
+    urlStr = res.url.replace(url.password, '***')
+  } catch {
+    urlStr = res.url
+  }
+
   opts.log.http(
     'fetch',
-    `${method.toUpperCase()} ${res.status} ${res.url} ${elapsedTime}ms${attemptStr}${cacheStr}`
+    `${method.toUpperCase()} ${res.status} ${urlStr} ${elapsedTime}ms${attemptStr}${cacheStr}`
   )
 }
path: check-response.js
Vulnerability: Cross-site Scripting in Alist Alist versions 2.0.10 through 2.1.0 were discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. This issue was fixed in version 2.1.1.
Vulnerability ID: GHSA-jpj5-hg26-6jgc
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/Xhofe/alist
Published: 2022-03-13
File: server/controllers/other.go
Commit message: :lock: fix #645 xss vulnerability
Commit author: Xhofe

Vulnerable version (before fix):
 import ( 	"github.com/Xhofe/alist/server/common" 	"github.com/Xhofe/alist/utils" 	"github.com/gin-gonic/gin" 	"strings" )  func Plist(c *gin.Context) { 		return 	} 	u := string(bytes) 	name := utils.Base(u) 	ipaIndex := strings.Index(name, ".ipa") 	if ipaIndex != -1 { 		name = name[:ipaIndex] 	} 	plist := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">     <dict>

Fixed version (after fix):
 import ( 	"github.com/Xhofe/alist/server/common" 	"github.com/Xhofe/alist/utils" 	"github.com/gin-gonic/gin" 	"net/url" 	"strings" )  func Plist(c *gin.Context) { 		return 	} 	u := string(bytes) 	uUrl, err := url.Parse(u) 	if err != nil { 		common.ErrorResp(c, err, 500) 		return 	} 	name := utils.Base(u) 	u = uUrl.String() 	ipaIndex := strings.Index(name, ".ipa") 	if ipaIndex != -1 { 		name = name[:ipaIndex] 	} 	name = strings.ReplaceAll(name, "<", "[") 	name = strings.ReplaceAll(name, ">", "]") 	plist := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">     <dict>

Patch:
patch: @@ -7,6 +7,7 @@ import (
 	"github.com/Xhofe/alist/server/common"
 	"github.com/Xhofe/alist/utils"
 	"github.com/gin-gonic/gin"
+	"net/url"
 	"strings"
 )
 
@@ -24,11 +25,19 @@ func Plist(c *gin.Context) {
 		return
 	}
 	u := string(bytes)
+	uUrl, err := url.Parse(u)
+	if err != nil {
+		common.ErrorResp(c, err, 500)
+		return
+	}
 	name := utils.Base(u)
+	u = uUrl.String()
 	ipaIndex := strings.Index(name, ".ipa")
 	if ipaIndex != -1 {
 		name = name[:ipaIndex]
 	}
+	name = strings.ReplaceAll(name, "<", "[")
+	name = strings.ReplaceAll(name, ">", "]")
 	plist := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
     <dict>
path: server/controllers/other.go
Vulnerability: OS Command Injection in Rake There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
Vulnerability ID: GHSA-jppv-gw3r-w3q8
CWE: CWE-78
Severity score: 0
Project: https://github.com/ruby/rake
Published: 2020-02-28
File: lib/rake/file_list.rb
Commit message: Use File.open explicitly.
Commit author: Hiroshi SHIBATA

Vulnerable version (before fix):
 def egrep(pattern, *options)       matched = 0       each do |fn|         begin           open(fn, "r", *options) do |inf|             count = 0             inf.each do |line|               count += 1

Fixed version (after fix):
 def egrep(pattern, *options)       matched = 0       each do |fn|         begin           File.open(fn, "r", *options) do |inf|             count = 0             inf.each do |line|               count += 1

Patch:
patch: @@ -294,7 +294,7 @@ def egrep(pattern, *options)
       matched = 0
       each do |fn|
         begin
-          open(fn, "r", *options) do |inf|
+          File.open(fn, "r", *options) do |inf|
             count = 0
             inf.each do |line|
               count += 1
path: lib/rake/file_list.rb
Vulnerability: Cross-site Scripting in DayByDay CRM In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
Vulnerability ID: GHSA-jr37-66pj-36v7
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/Bottelet/DaybydayCRM
Published: 2022-01-08
File: app/Http/Controllers/TasksController.php
Commit message: fix xss for tasks index
Commit author: Casper Bottelet

Vulnerable version (before fix):
 public function anyData()             })             ->addColumn('view', function ($tasks) {                 return '<a href="' . route("tasks.show", $tasks->external_id) . '" class="btn btn-link">' . __('View') .'</a>'                 . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-title="'. $tasks->title . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'                 ;             })             ->rawColumns(['titlelink','view', 'status_id'])

Fixed version (after fix):
 public function anyData()             })             ->addColumn('view', function ($tasks) {                 return '<a href="' . route("tasks.show", $tasks->external_id) . '" class="btn btn-link">' . __('View') .'</a>'                 . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'                 ;             })             ->rawColumns(['titlelink','view', 'status_id'])

Patch:
patch: @@ -82,7 +82,7 @@ public function anyData()
             })
             ->addColumn('view', function ($tasks) {
                 return '<a href="' . route("tasks.show", $tasks->external_id) . '" class="btn btn-link">' . __('View') .'</a>'
-                . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-title="'. $tasks->title . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'
+                . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'
                 ;
             })
             ->rawColumns(['titlelink','view', 'status_id'])
path: app/Http/Controllers/TasksController.php
Vulnerability: Moderate severity vulnerability that affects gollum The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Vulnerability ID: GHSA-m2q3-53fq-7h66
CWE: CWE-200
Severity score: 0
Project: https://github.com/gollum/gollum
Published: 2018-08-28
File: lib/gollum/app.rb
Commit message: Added security check.
Commit author: Bart Kamphorst

Vulnerable version (before fix):
 def wiki_new         fullname = params[:file][:filename]         tempfile = params[:file][:tempfile]       end        # Remove page file dir prefix from upload path if necessary -- committer handles this itself       dir      = wiki.per_page_uploads ? params[:upload_dest].match(/^(#{wiki.page_file_dir}\/+)?(.*)/)[2] : 'uploads'

Fixed version (after fix):
 def wiki_new         fullname = params[:file][:filename]         tempfile = params[:file][:tempfile]       end       halt 500 unless tempfile.is_a? Tempfile        # Remove page file dir prefix from upload path if necessary -- committer handles this itself       dir      = wiki.per_page_uploads ? params[:upload_dest].match(/^(#{wiki.page_file_dir}\/+)?(.*)/)[2] : 'uploads'

Patch:
patch: @@ -176,6 +176,7 @@ def wiki_new
         fullname = params[:file][:filename]
         tempfile = params[:file][:tempfile]
       end
+      halt 500 unless tempfile.is_a? Tempfile
 
       # Remove page file dir prefix from upload path if necessary -- committer handles this itself
       dir      = wiki.per_page_uploads ? params[:upload_dest].match(/^(#{wiki.page_file_dir}\/+)?(.*)/)[2] : 'uploads'
path: lib/gollum/app.rb
Vulnerability: Server-side Template Injection in nystudio107/craft-seomatic A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic prior to 3.4.12 in src/helpers/UrlHelper.php via the host header.
Vulnerability ID: GHSA-m3xv-x3ph-mq22
CWE: CWE-94
Severity score: 9.8
Project: https://github.com/nystudio107/craft-seomatic
Published: 2022-03-12
File: src/helpers/UrlHelper.php
Commit message: Sanitize all URLs

Signed-off-by: Andrew Welch <andrew@nystudio107.com>
Commit author: Andrew Welch

Vulnerable version (before fix):
 public static function siteUrl(string $path = '', $params = null, string $scheme             return $url;         }          return parent::siteUrl($path, $params, $scheme, $siteId);     }      /** public static function absoluteUrlWithProtocol($url): string             $url = rtrim($url, '/');         }          return $url;     }      /**

Fixed version (after fix):
 public static function siteUrl(string $path = '', $params = null, string $scheme             return $url;         }          return DynamicMeta::sanitizeUrl(parent::siteUrl($path, $params, $scheme, $siteId));     }      /** public static function absoluteUrlWithProtocol($url): string             $url = rtrim($url, '/');         }          return DynamicMeta::sanitizeUrl($url);     }      /**

Patch:
patch: @@ -56,7 +56,7 @@ public static function siteUrl(string $path = '', $params = null, string $scheme
             return $url;
         }
 
-        return parent::siteUrl($path, $params, $scheme, $siteId);
+        return DynamicMeta::sanitizeUrl(parent::siteUrl($path, $params, $scheme, $siteId));
     }
 
     /**
@@ -130,7 +130,7 @@ public static function absoluteUrlWithProtocol($url): string
             $url = rtrim($url, '/');
         }
 
-        return $url;
+        return DynamicMeta::sanitizeUrl($url);
     }
 
     /**
path: src/helpers/UrlHelper.php
Vulnerability: Integer Overflow or Wraparound in OpenCV. In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 (corresponding with OpenCV-Python 3.3.0.9) and earlier.
Vulnerability ID: GHSA-m43c-649m-pm48
CWE: CWE-190
Severity score: 8.8
Project: https://github.com/opencv/opencv
Published: 2021-10-12
File: modules/imgcodecs/src/grfmt_bmp.cpp
Commit message: Fix out of bounds write
Commit author: blendin

Vulnerable version (before fix):
 decode_rle4_bad: ;                                                 gray_palette[code] );                          line_end_flag = y - prev_y;                     }                     else if( code > 2 ) // absolute mode                     {

Fixed version (after fix):
 decode_rle4_bad: ;                                                 gray_palette[code] );                          line_end_flag = y - prev_y;                          if( y >= m_height )                             break;                     }                     else if( code > 2 ) // absolute mode                     {

Patch:
patch: @@ -375,6 +375,9 @@ decode_rle4_bad: ;
                                                 gray_palette[code] );
 
                         line_end_flag = y - prev_y;
+
+                        if( y >= m_height )
+                            break;
                     }
                     else if( code > 2 ) // absolute mode
                     {
path: modules/imgcodecs/src/grfmt_bmp.cpp