rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Regular Expression Denial of Service in postcss The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Vulnerability ID: GHSA-566m-qj78-rww5
CWE: CWE-400
Severity score: 5.3
Project: https://github.com/postcss/postcss
Published: 2022-01-07
File: lib/previous-map.js
Commit message: Merge pull request #1567 from yetingli/main

Fix ReDoS in previous-map
Commit author: Andrey Sitnik

Vulnerable version (before fix):
 class PreviousMap {   }    getAnnotationURL(sourceMapString) {     return sourceMapString.match(/\/\*\s*# sourceMappingURL=(.*)\*\//)[1].trim()   }    loadAnnotation(css) {     let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\*\//gm)      if (annotations && annotations.length > 0) {       // Locate the last sourceMappingURL to avoid picking up

Fixed version (after fix):
 class PreviousMap {   }    getAnnotationURL(sourceMapString) {     return sourceMapString.match(/\/\*\s*# sourceMappingURL=((?:(?!sourceMappingURL=).)*)\*\//)[1].trim()   }    loadAnnotation(css) {     let annotations = css.match(/\/\*\s*# sourceMappingURL=(?:(?!sourceMappingURL=).)*\*\//gm)      if (annotations && annotations.length > 0) {       // Locate the last sourceMappingURL to avoid picking up

Patch:
patch: @@ -48,11 +48,11 @@ class PreviousMap {
   }
 
   getAnnotationURL(sourceMapString) {
-    return sourceMapString.match(/\/\*\s*# sourceMappingURL=(.*)\*\//)[1].trim()
+    return sourceMapString.match(/\/\*\s*# sourceMappingURL=((?:(?!sourceMappingURL=).)*)\*\//)[1].trim()
   }
 
   loadAnnotation(css) {
-    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\*\//gm)
+    let annotations = css.match(/\/\*\s*# sourceMappingURL=(?:(?!sourceMappingURL=).)*\*\//gm)
 
     if (annotations && annotations.length > 0) {
       // Locate the last sourceMappingURL to avoid picking up
path: lib/previous-map.js
Vulnerability: Regular Expression Denial of Service (ReDoS) This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.
Vulnerability ID: GHSA-57f3-gghm-9mhc
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/MrRio/jsPDF
Published: 2021-03-12
File: src/modules/addimage.js
Commit message: fix ReDoS-vulnerable regexp in addImage (#3091)
Commit author: Yeting Li

Vulnerable version (before fix):
 import { atob, btoa } from "../libs/AtobBtoa.js";     var result = null;      if (dataUrlParts.length === 2) {       var extractedInfo = /^data:(\w*\/\w*);*(charset=[\w=-]*)*;*$/.exec(         dataUrlParts[0]       );       if (Array.isArray(extractedInfo)) {

Fixed version (after fix):
 import { atob, btoa } from "../libs/AtobBtoa.js";     var result = null;      if (dataUrlParts.length === 2) {       var extractedInfo = /^data:(\w*\/\w*);*(charset=(?!charset=)[\w=-]*)*;*$/.exec(         dataUrlParts[0]       );       if (Array.isArray(extractedInfo)) {

Patch:
patch: @@ -630,7 +630,7 @@ import { atob, btoa } from "../libs/AtobBtoa.js";
     var result = null;
 
     if (dataUrlParts.length === 2) {
-      var extractedInfo = /^data:(\w*\/\w*);*(charset=[\w=-]*)*;*$/.exec(
+      var extractedInfo = /^data:(\w*\/\w*);*(charset=(?!charset=)[\w=-]*)*;*$/.exec(
         dataUrlParts[0]
       );
       if (Array.isArray(extractedInfo)) {
path: src/modules/addimage.js
Vulnerability: Cross-site Scripting in teddy Teddy is a readable and easy to learn templating language. This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).
Vulnerability ID: GHSA-5f38-9jw2-6r6h
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/rooseveltframework/teddy
Published: 2021-10-12
File: utils.js
Commit message: Merge pull request #518 from kethinov/refactor-escape-entities

refactor escape entities for better type checking
Commit author: Eric Newport

Vulnerable version (before fix):
 function escapeEntities (value) {   let i   let j    if (value === undefined || typeof value === 'boolean' || typeof value === 'object') { // Cannot escape on these values     return value   } else if (typeof value === 'number') { // Value is a number, no reason to escape     return `${value}`   } else {     // Loop through value to find HTML entities     for (i = 0; i < value.length; i++) {

Fixed version (after fix):
 function escapeEntities (value) {   let i   let j    if (typeof value === 'object') { // Cannot escape on this value     if (!value) {       return false // it is falsey to return false     } else if (Array.isArray(value)) {       if (value.length === 0) {         return false // empty arrays are falsey       } else {         return '[Array]' // print that it is an array with content in it, but do not print the contents       }     }     return '[Object]' // just print that it is an object, do not print the contents   } else if (value === undefined) { // Cannot escape on this value     return false // undefined is falsey   } else if (typeof value === 'boolean' || typeof value === 'number') { // Cannot escape on these values     return value // if it's already a boolean or a number just return it   } else {     // Loop through value to find HTML entities     for (i = 0; i < value.length; i++) {

Patch:
patch: @@ -96,10 +96,21 @@ function escapeEntities (value) {
   let i
   let j
 
-  if (value === undefined || typeof value === 'boolean' || typeof value === 'object') { // Cannot escape on these values
-    return value
-  } else if (typeof value === 'number') { // Value is a number, no reason to escape
-    return `${value}`
+  if (typeof value === 'object') { // Cannot escape on this value
+    if (!value) {
+      return false // it is falsey to return false
+    } else if (Array.isArray(value)) {
+      if (value.length === 0) {
+        return false // empty arrays are falsey
+      } else {
+        return '[Array]' // print that it is an array with content in it, but do not print the contents
+      }
+    }
+    return '[Object]' // just print that it is an object, do not print the contents
+  } else if (value === undefined) { // Cannot escape on this value
+    return false // undefined is falsey
+  } else if (typeof value === 'boolean' || typeof value === 'number') { // Cannot escape on these values
+    return value // if it's already a boolean or a number just return it
   } else {
     // Loop through value to find HTML entities
     for (i = 0; i < value.length; i++) {
path: utils.js
Vulnerability: Directory traversal in Rack::Directory app bundled with Rack A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.
Vulnerability ID: GHSA-5f9h-9pjv-v6j7
CWE: CWE-22
Severity score: 8.6
Project: https://github.com/rack/rack
Published: 2020-07-06
File: lib/rack/directory.rb
Commit message: Use Dir.entries instead of Dir[glob] to prevent user-specified glob metacharacters

[CVE-2020-8161]
Commit author: Jack McCracken

Vulnerable version (before fix):
 def check_forbidden(path_info)      def list_directory(path_info, path, script_name)       files = [['../', 'Parent Directory', '', '', '']]       glob = ::File.join(path, '*')        url_head = (script_name.split('/') + path_info.split('/')).map do |part|         Rack::Utils.escape_path part       end        Dir[glob].sort.each do |node|         stat = stat(node)         next unless stat         basename = ::File.basename(node)

Fixed version (after fix):
 def check_forbidden(path_info)      def list_directory(path_info, path, script_name)       files = [['../', 'Parent Directory', '', '', '']]        url_head = (script_name.split('/') + path_info.split('/')).map do |part|         Rack::Utils.escape_path part       end        Dir.entries(path).reject { |e| e.start_with?('.') }.sort.each do |node|         stat = stat(node)         next unless stat         basename = ::File.basename(node)

Patch:
patch: @@ -106,13 +106,12 @@ def check_forbidden(path_info)
 
     def list_directory(path_info, path, script_name)
       files = [['../', 'Parent Directory', '', '', '']]
-      glob = ::File.join(path, '*')
 
       url_head = (script_name.split('/') + path_info.split('/')).map do |part|
         Rack::Utils.escape_path part
       end
 
-      Dir[glob].sort.each do |node|
+      Dir.entries(path).reject { |e| e.start_with?('.') }.sort.each do |node|
         stat = stat(node)
         next unless stat
         basename = ::File.basename(node)
path: lib/rack/directory.rb
Vulnerability: snipe-it is vulnerable to Cross-site Scripting snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability ID: GHSA-5fh3-25xr-g85h
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/snipe/snipe-it
Published: 2021-12-03
File: app/Http/Transformers/AccessoriesTransformer.php
Commit message: Merge pull request #10361 from snipe/fixes/xss_in_accessories_checkout_notes

Escape notes in transformCheckedOutAccessory
Commit author: snipe

Vulnerable version (before fix):
 public function transformCheckedoutAccessory ($accessory, $accessory_users, $tot                 'first_name'=> e($user->first_name),                 'last_name'=> e($user->last_name),                 'employee_number' =>  e($user->employee_num),                 'checkout_notes' => $user->pivot->note,                 'last_checkout' => Helper::getFormattedDateObject($user->pivot->created_at, 'datetime'),                 'type' => 'user',                 'available_actions' => ['checkin' => true]

Fixed version (after fix):
 public function transformCheckedoutAccessory ($accessory, $accessory_users, $tot                 'first_name'=> e($user->first_name),                 'last_name'=> e($user->last_name),                 'employee_number' =>  e($user->employee_num),                 'checkout_notes' => e($user->pivot->note),                 'last_checkout' => Helper::getFormattedDateObject($user->pivot->created_at, 'datetime'),                 'type' => 'user',                 'available_actions' => ['checkin' => true]

Patch:
patch: @@ -82,7 +82,7 @@ public function transformCheckedoutAccessory ($accessory, $accessory_users, $tot
                 'first_name'=> e($user->first_name),
                 'last_name'=> e($user->last_name),
                 'employee_number' =>  e($user->employee_num),
-                'checkout_notes' => $user->pivot->note,
+                'checkout_notes' => e($user->pivot->note),
                 'last_checkout' => Helper::getFormattedDateObject($user->pivot->created_at, 'datetime'),
                 'type' => 'user',
                 'available_actions' => ['checkin' => true]
path: app/Http/Transformers/AccessoriesTransformer.php
Vulnerability: Arbitrary JavaScript Execution in bassmaster A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.


## Recommendation

Update to bassmaster version 1.5.2 or greater.
Vulnerability ID: GHSA-5j3g-jfq3-7jwx
CWE: CWE-94
Severity score: 0
Project: https://github.com/hapijs/bassmaster
Published: 2017-10-24
File: lib/batch.js
Commit message: Remove eval statement
Commit author: nvcexploder

Vulnerable version (before fix):
 internals.batch = function (batchRequest, resultsData, pos, parts, callback) {             var ref = resultsData.resultsMap[parts[i].index];              if (ref) {                 var value = null;                  try {                     eval('value = ref.' + parts[i].value + ';');                 }                 catch (e) {                     error = new Error(e.message);                 }                  if (value) {                     if (value.match && value.match(/^[\w:]+$/)) {                         path += value;                     }

Fixed version (after fix):
 internals.batch = function (batchRequest, resultsData, pos, parts, callback) {             var ref = resultsData.resultsMap[parts[i].index];              if (ref) {                 var value = ref[parts[i].value]||null;                  if (value) {                      if (value.match && value.match(/^[\w:]+$/)) {                         path += value;                     }

Patch:
patch: @@ -146,16 +146,10 @@ internals.batch = function (batchRequest, resultsData, pos, parts, callback) {
             var ref = resultsData.resultsMap[parts[i].index];
 
             if (ref) {
-                var value = null;
-
-                try {
-                    eval('value = ref.' + parts[i].value + ';');
-                }
-                catch (e) {
-                    error = new Error(e.message);
-                }
+                var value = ref[parts[i].value]||null;
 
                 if (value) {
+
                     if (value.match && value.match(/^[\w:]+$/)) {
                         path += value;
                     }
path: lib/batch.js
Vulnerability: Known vulnerable to code execution via SVG file in v1.3.1 An issue in the isSVG() function of Known v1.3.1 allows attackers to execute arbitrary code via a crafted SVG file.

The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.
Vulnerability ID: GHSA-5jgj-h9wp-53fr
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/idno/known
Published: 2022-07-09
File: Idno/Entities/File.php
Commit message: Checking for script tags in GIFs etc (#3017)
Commit author: Ben Werdmuller

Vulnerable version (before fix):
 public static function isImage($file_path)             return false;         }          /**          * Retrieve a file by ID          *

Fixed version (after fix):
 public static function isImage($file_path)             return false;         }          /**          * Detects whether the file contains PHP or script tags, eg to check for embedded code in GIFs          * @param $file_path          * @return bool          */         public static function isFileFreeFromScriptTags($file_path)         {             if ($contents = file_get_contents($file_path)) {                 if (stripos($contents, '<script') || strpos($contents, '<?')) return false;                 return true;             }             return false;         }          /**          * Retrieve a file by ID          *

Patch:
patch: @@ -285,6 +285,20 @@ public static function isImage($file_path)
             return false;
         }
 
+        /**
+         * Detects whether the file contains PHP or script tags, eg to check for embedded code in GIFs
+         * @param $file_path
+         * @return bool
+         */
+        public static function isFileFreeFromScriptTags($file_path)
+        {
+            if ($contents = file_get_contents($file_path)) {
+                if (stripos($contents, '<script') || strpos($contents, '<?')) return false;
+                return true;
+            }
+            return false;
+        }
+
         /**
          * Retrieve a file by ID
          *
path: Idno/Entities/File.php
Vulnerability: Cross-site Scripting in microweber Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
Vulnerability ID: GHSA-5pg2-qg87-vmj7
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/microweber/microweber
Published: 2022-07-02
File: src/MicroweberPackages/App/functions/plupload.php
Commit message: update
Commit author: Peter Ivanov

Vulnerable version (before fix):
 // Make sure the fileName is unique but only if chunking is disabled if ($chunks < 2 && file_exists($targetDir . DIRECTORY_SEPARATOR . $fileName)) {     $ext = strrpos($fileName, '.');     $fileName_a = substr($fileName, 0, $ext);     $fileName_b = substr($fileName, $ext);      $count = 1;     while (file_exists($targetDir . DIRECTORY_SEPARATOR . $fileName_a . '_' . $count . $fileName_b)) {         ++$count;      if (is_file($filePath) and !$chunks || $chunk == $chunks - 1) {         $ext = get_file_extension($filePath);          if (function_exists('finfo_open') and function_exists('finfo_file')) {             $finfo = finfo_open(FILEINFO_MIME_TYPE); // return mime type ala mimetype extension             $mime = @finfo_file($finfo, $filePath);

Fixed version (after fix):
 // Make sure the fileName is unique but only if chunking is disabled if ($chunks < 2 && file_exists($targetDir . DIRECTORY_SEPARATOR . $fileName)) {     $ext = strrpos($fileName, '.');      $fileName_a = substr($fileName, 0, $ext);     $fileName_b = substr($fileName, $ext);      $fileName_b = strtolower($fileName_b);      $count = 1;     while (file_exists($targetDir . DIRECTORY_SEPARATOR . $fileName_a . '_' . $count . $fileName_b)) {         ++$count;      if (is_file($filePath) and !$chunks || $chunk == $chunks - 1) {         $ext = get_file_extension($filePath);         $ext = strtolower($ext);         if (function_exists('finfo_open') and function_exists('finfo_file')) {             $finfo = finfo_open(FILEINFO_MIME_TYPE); // return mime type ala mimetype extension             $mime = @finfo_file($finfo, $filePath);

Patch:
patch: @@ -336,9 +336,12 @@
 // Make sure the fileName is unique but only if chunking is disabled
 if ($chunks < 2 && file_exists($targetDir . DIRECTORY_SEPARATOR . $fileName)) {
     $ext = strrpos($fileName, '.');
+
     $fileName_a = substr($fileName, 0, $ext);
     $fileName_b = substr($fileName, $ext);
 
+    $fileName_b = strtolower($fileName_b);
+
     $count = 1;
     while (file_exists($targetDir . DIRECTORY_SEPARATOR . $fileName_a . '_' . $count . $fileName_b)) {
         ++$count;
@@ -500,7 +503,7 @@
 
     if (is_file($filePath) and !$chunks || $chunk == $chunks - 1) {
         $ext = get_file_extension($filePath);
-
+        $ext = strtolower($ext);
         if (function_exists('finfo_open') and function_exists('finfo_file')) {
             $finfo = finfo_open(FILEINFO_MIME_TYPE); // return mime type ala mimetype extension
             $mime = @finfo_file($finfo, $filePath);
path: src/MicroweberPackages/App/functions/plupload.php
Vulnerability: Improper Neutralization of Input During Web Page Generation in Jenkins Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.
Vulnerability ID: GHSA-5ppx-rgw2-xg23
CWE: CWE-79
Severity score: 4.8
Project: https://github.com/jenkinsci/jenkins
Published: 2022-05-14
File: war/src/main/webapp/scripts/hudson-behavior.js
Commit message: [SECURITY-641] Escape autocompletion suggestions
Commit author: Daniel Beck

Vulnerable version (before fix):
 var jenkinsRules = {         };         ac.prehighlightClassName = "yui-ac-prehighlight";         ac.animSpeed = 0;         ac.useShadow = true;         ac.autoSnapContainer = true;         ac.delimChar = e.getAttribute("autoCompleteDelimChar");

Fixed version (after fix):
 var jenkinsRules = {         };         ac.prehighlightClassName = "yui-ac-prehighlight";         ac.animSpeed = 0;         ac.formatResult = ac.formatEscapedResult;         ac.useShadow = true;         ac.autoSnapContainer = true;         ac.delimChar = e.getAttribute("autoCompleteDelimChar");

Patch:
patch: @@ -712,6 +712,7 @@ var jenkinsRules = {
         };
         ac.prehighlightClassName = "yui-ac-prehighlight";
         ac.animSpeed = 0;
+        ac.formatResult = ac.formatEscapedResult;
         ac.useShadow = true;
         ac.autoSnapContainer = true;
         ac.delimChar = e.getAttribute("autoCompleteDelimChar");
path: war/src/main/webapp/scripts/hudson-behavior.js
Vulnerability: Unrestricted Upload of File with Dangerous Type in jsdecena/laracom jsdecena/laracom prior to version 2.0.9 is vulnerable to Unrestricted Upload of File with Dangerous Type.
Vulnerability ID: GHSA-5q5w-mqp6-g2gh
CWE: CWE-434
Severity score: 5.4
Project: https://github.com/jsdecena/laracom
Published: 2022-02-06
File: project/app/Shop/Products/Requests/UpdateProductRequest.php
Commit message: Fix vulnerability report from hunter.dev
Commit author: Roland Jeffrey Decena

Vulnerable version (before fix):
 public function rules()             'quantity' => ['required', 'integer', 'min:0'],             'price' => ['required', 'numeric', 'min:0'],             'sale_price' => ['nullable', 'numeric'],             'weight' => ['nullable', 'numeric', 'min:0']         ];     } }

Fixed version (after fix):
 public function rules()             'quantity' => ['required', 'integer', 'min:0'],             'price' => ['required', 'numeric', 'min:0'],             'sale_price' => ['nullable', 'numeric'],             'weight' => ['nullable', 'numeric', 'min:0'],             'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',             'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',         ];     } }

Patch:
patch: @@ -20,7 +20,9 @@ public function rules()
             'quantity' => ['required', 'integer', 'min:0'],
             'price' => ['required', 'numeric', 'min:0'],
             'sale_price' => ['nullable', 'numeric'],
-            'weight' => ['nullable', 'numeric', 'min:0']
+            'weight' => ['nullable', 'numeric', 'min:0'],
+            'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
+            'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
         ];
     }
 }
path: project/app/Shop/Products/Requests/UpdateProductRequest.php
Vulnerability: Unrestricted Upload of File with Dangerous Type in jsdecena/laracom jsdecena/laracom prior to version 2.0.9 is vulnerable to Unrestricted Upload of File with Dangerous Type.
Vulnerability ID: GHSA-5q5w-mqp6-g2gh
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/jsdecena/laracom
Published: 2022-02-06
File: project/app/Shop/Products/Requests/UpdateProductRequest.php
Commit message: Fix vulnerability report from hunter.dev
Commit author: Roland Jeffrey Decena

Vulnerable version (before fix):
 public function rules()             'quantity' => ['required', 'integer', 'min:0'],             'price' => ['required', 'numeric', 'min:0'],             'sale_price' => ['nullable', 'numeric'],             'weight' => ['nullable', 'numeric', 'min:0']         ];     } }

Fixed version (after fix):
 public function rules()             'quantity' => ['required', 'integer', 'min:0'],             'price' => ['required', 'numeric', 'min:0'],             'sale_price' => ['nullable', 'numeric'],             'weight' => ['nullable', 'numeric', 'min:0'],             'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',             'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',         ];     } }

Patch:
patch: @@ -20,7 +20,9 @@ public function rules()
             'quantity' => ['required', 'integer', 'min:0'],
             'price' => ['required', 'numeric', 'min:0'],
             'sale_price' => ['nullable', 'numeric'],
-            'weight' => ['nullable', 'numeric', 'min:0']
+            'weight' => ['nullable', 'numeric', 'min:0'],
+            'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
+            'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
         ];
     }
 }
path: project/app/Shop/Products/Requests/UpdateProductRequest.php