rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.
Vulnerability ID: CVE-2020-11958
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/skvadrik/re2c
Published: 2020-04-21
File: src/parse/scanner.cc
Commit message: Fix crash in lexer refill (reported by Agostino Sarubbo).

The crash happened in a rare case of a very long lexeme that doen't fit
into the buffer, forcing buffer reallocation.

The crash was caused by an incorrect calculation of the shift offset
(it was smaller than necessary). As a consequence, the data from buffer
start and up to the beginning of the current lexeme was not discarded
(as it should have been), resulting in less free space for new data than
expected.
Commit author: Ulya Trofimovich

Vulnerable version (before fix):
 bool Scanner::fill(size_t need)         if (!buf) fatal("out of memory");          memmove(buf, tok, copy);         shift_ptrs_and_fpos(buf - bot);         delete [] bot;         bot = buf;          free = BSIZE - copy;     }      if (!read(free)) {         eof = lim;         memset(lim, 0, YYMAXFILL);

Fixed version (after fix):
 bool Scanner::fill(size_t need)         if (!buf) fatal("out of memory");          memmove(buf, tok, copy);         shift_ptrs_and_fpos(buf - tok);         delete [] bot;         bot = buf;          free = BSIZE - copy;     }      DASSERT(lim + free <= bot + BSIZE);     if (!read(free)) {         eof = lim;         memset(lim, 0, YYMAXFILL);

Patch:
patch: @@ -155,13 +155,14 @@ bool Scanner::fill(size_t need)
         if (!buf) fatal("out of memory");
 
         memmove(buf, tok, copy);
-        shift_ptrs_and_fpos(buf - bot);
+        shift_ptrs_and_fpos(buf - tok);
         delete [] bot;
         bot = buf;
 
         free = BSIZE - copy;
     }
 
+    DASSERT(lim + free <= bot + BSIZE);
     if (!read(free)) {
         eof = lim;
         memset(lim, 0, YYMAXFILL);
path: src/parse/scanner.cc
Vulnerability: CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server.
Vulnerability ID: CVE-2020-12066
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/teeworlds/teeworlds
Published: 2020-04-22
File: src/engine/server/server.cpp
Commit message: changed a check
Commit author: oy

Vulnerable version (before fix):
 int CServer::SendMsg(CMsgPacker *pMsg, int Flags, int ClientID) 	if(!pMsg) 		return -1;  	// drop packet to dummy client 	if(0 <= ClientID && ClientID < MAX_CLIENTS && GameServer()->IsClientBot(ClientID)) 		return 0;  	mem_zero(&Packet, sizeof(CNetChunk));

Fixed version (after fix):
 int CServer::SendMsg(CMsgPacker *pMsg, int Flags, int ClientID) 	if(!pMsg) 		return -1;  	// drop invalid packet 	if(ClientID != -1 && (ClientID < 0 || ClientID >= MAX_CLIENTS || m_aClients[ClientID].m_State == CClient::STATE_EMPTY || m_aClients[ClientID].m_Quitting)) 		return 0;  	mem_zero(&Packet, sizeof(CNetChunk));

Patch:
patch: @@ -496,8 +496,8 @@ int CServer::SendMsg(CMsgPacker *pMsg, int Flags, int ClientID)
 	if(!pMsg)
 		return -1;
 
-	// drop packet to dummy client
-	if(0 <= ClientID && ClientID < MAX_CLIENTS && GameServer()->IsClientBot(ClientID))
+	// drop invalid packet
+	if(ClientID != -1 && (ClientID < 0 || ClientID >= MAX_CLIENTS || m_aClients[ClientID].m_State == CClient::STATE_EMPTY || m_aClients[ClientID].m_Quitting))
 		return 0;
 
 	mem_zero(&Packet, sizeof(CNetChunk));
path: src/engine/server/server.cpp
Vulnerability: jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
Vulnerability ID: CVE-2020-12268
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/ArtifexSoftware/jbig2dec
Published: 2020-04-27
File: jbig2_image.c
Commit message: Fix OSS-Fuzz issue 20332: buffer overflow in jbig2_image_compose.

With extreme values of x/y/w/h we can get overflow. Test for this
and exit safely.

Thanks for OSS-Fuzz for reporting.
Commit author: Robin Watts

Vulnerable version (before fix):
 #if !defined (INT32_MAX) #define INT32_MAX  0x7fffffff #endif  /* allocate a Jbig2Image structure and its associated bitmap */ Jbig2Image * jbig2_image_compose(Jbig2Ctx *ctx, Jbig2Image *dst, Jbig2Image *src, int x, int     if (src == NULL)         return 0;      /* This code takes a src image and combines it onto dst at offset (x,y), with operation op. */      /* Data is packed msb first within a byte, so with bits numbered: 01234567.

Fixed version (after fix):
 #if !defined (INT32_MAX) #define INT32_MAX  0x7fffffff #endif #if !defined (UINT32_MAX) #define UINT32_MAX  0xffffffffu #endif  /* allocate a Jbig2Image structure and its associated bitmap */ Jbig2Image * jbig2_image_compose(Jbig2Ctx *ctx, Jbig2Image *dst, Jbig2Image *src, int x, int     if (src == NULL)         return 0;      if ((UINT32_MAX - src->width  < (x > 0 ? x : -x)) ||         (UINT32_MAX - src->height < (y > 0 ? y : -y)))     { #ifdef JBIG2_DEBUG         jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, -1, "overflow in compose_image"); #endif         return 0;     }      /* This code takes a src image and combines it onto dst at offset (x,y), with operation op. */      /* Data is packed msb first within a byte, so with bits numbered: 01234567.

Patch:
patch: @@ -33,6 +33,9 @@
 #if !defined (INT32_MAX)
 #define INT32_MAX  0x7fffffff
 #endif
+#if !defined (UINT32_MAX)
+#define UINT32_MAX  0xffffffffu
+#endif
 
 /* allocate a Jbig2Image structure and its associated bitmap */
 Jbig2Image *
@@ -351,6 +354,15 @@ jbig2_image_compose(Jbig2Ctx *ctx, Jbig2Image *dst, Jbig2Image *src, int x, int
     if (src == NULL)
         return 0;
 
+    if ((UINT32_MAX - src->width  < (x > 0 ? x : -x)) ||
+        (UINT32_MAX - src->height < (y > 0 ? y : -y)))
+    {
+#ifdef JBIG2_DEBUG
+        jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, -1, "overflow in compose_image");
+#endif
+        return 0;
+    }
+
     /* This code takes a src image and combines it onto dst at offset (x,y), with operation op. */
 
     /* Data is packed msb first within a byte, so with bits numbered: 01234567.
path: jbig2_image.c
Vulnerability: An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages.
Vulnerability ID: CVE-2020-12465
CWE: CWE-120
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2020-04-29
File: drivers/net/wireless/mediatek/mt76/dma.c
Commit message: mt76: fix array overflow on receiving too many fragments for a packet

If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Felix Fietkau

Vulnerable version (before fix):
 mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, 	struct page *page = virt_to_head_page(data); 	int offset = data - page_address(page); 	struct sk_buff *skb = q->rx_head;  	offset += q->buf_offset; 	skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, offset, len, 			q->buf_size);  	if (more) 		return;

Fixed version (after fix):
 mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, 	struct page *page = virt_to_head_page(data); 	int offset = data - page_address(page); 	struct sk_buff *skb = q->rx_head; 	struct skb_shared_info *shinfo = skb_shinfo(skb);  	if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) { 		offset += q->buf_offset; 		skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len, 				q->buf_size); 	}  	if (more) 		return;

Patch:
patch: @@ -447,10 +447,13 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
 	struct page *page = virt_to_head_page(data);
 	int offset = data - page_address(page);
 	struct sk_buff *skb = q->rx_head;
+	struct skb_shared_info *shinfo = skb_shinfo(skb);
 
-	offset += q->buf_offset;
-	skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, offset, len,
-			q->buf_size);
+	if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
+		offset += q->buf_offset;
+		skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
+				q->buf_size);
+	}
 
 	if (more)
 		return;
path: drivers/net/wireless/mediatek/mt76/dma.c
Vulnerability: include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
Vulnerability ID: CVE-2020-12629
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/osticket/osticket
Published: 2020-05-04
File: include/class.sla.php
Commit message: xss: SLA Name

This mitigates an issue discovered by Gais Cyber Security where the SLA Name
can be exploited via XSS to execute code. This sanitizes the content for
`create()` and `update()` with `Format::htmlchars()` so we are safe from any
XSS attempts.
Commit author: JediKev

Vulnerable version (before fix):
 static function getVarScope() {     }      function update($vars, &$errors) {          if (!$vars['grace_period'])             $errors['grace_period'] = __('Grace period required');         elseif (!is_numeric($vars['grace_period'])) static function getIdByName($name) {     }      static function create($vars=false, &$errors=array()) {         $sla = new static($vars);         $sla->created = SqlFunction::NOW();         return $sla;

Fixed version (after fix):
 static function getVarScope() {     }      function update($vars, &$errors) {         $vars = Format::htmlchars($vars);         if (!$vars['grace_period'])             $errors['grace_period'] = __('Grace period required');         elseif (!is_numeric($vars['grace_period'])) static function getIdByName($name) {     }      static function create($vars=false, &$errors=array()) {         $vars = Format::htmlchars($vars);         $sla = new static($vars);         $sla->created = SqlFunction::NOW();         return $sla;

Patch:
patch: @@ -106,7 +106,7 @@ static function getVarScope() {
     }
 
     function update($vars, &$errors) {
-
+        $vars = Format::htmlchars($vars);
         if (!$vars['grace_period'])
             $errors['grace_period'] = __('Grace period required');
         elseif (!is_numeric($vars['grace_period']))
@@ -208,6 +208,7 @@ static function getIdByName($name) {
     }
 
     static function create($vars=false, &$errors=array()) {
+        $vars = Format::htmlchars($vars);
         $sla = new static($vars);
         $sla->created = SqlFunction::NOW();
         return $sla;
path: include/class.sla.php
Vulnerability: An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.
Vulnerability ID: CVE-2020-12653
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2020-05-05
File: drivers/net/wireless/marvell/mwifiex/scan.c
Commit message: mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()

mwifiex_cmd_append_vsie_tlv() calls memcpy() without checking
the destination size may trigger a buffer overflower,
which a local user could use to cause denial of service
or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Qing Xu <m1s5p6688@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Qing Xu

Vulnerable version (before fix):
 mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv, 			vs_param_set->header.len = 				cpu_to_le16((((u16) priv->vs_ie[id].ie[1]) 				& 0x00FF) + 2); 			memcpy(vs_param_set->ie, priv->vs_ie[id].ie, 			       le16_to_cpu(vs_param_set->header.len)); 			*buffer += le16_to_cpu(vs_param_set->header.len) +

Fixed version (after fix):
 mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv, 			vs_param_set->header.len = 				cpu_to_le16((((u16) priv->vs_ie[id].ie[1]) 				& 0x00FF) + 2); 			if (le16_to_cpu(vs_param_set->header.len) > 				MWIFIEX_MAX_VSIE_LEN) { 				mwifiex_dbg(priv->adapter, ERROR, 					    "Invalid param length!\n"); 				break; 			}  			memcpy(vs_param_set->ie, priv->vs_ie[id].ie, 			       le16_to_cpu(vs_param_set->header.len)); 			*buffer += le16_to_cpu(vs_param_set->header.len) +

Patch:
patch: @@ -2884,6 +2884,13 @@ mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv,
 			vs_param_set->header.len =
 				cpu_to_le16((((u16) priv->vs_ie[id].ie[1])
 				& 0x00FF) + 2);
+			if (le16_to_cpu(vs_param_set->header.len) >
+				MWIFIEX_MAX_VSIE_LEN) {
+				mwifiex_dbg(priv->adapter, ERROR,
+					    "Invalid param length!\n");
+				break;
+			}
+
 			memcpy(vs_param_set->ie, priv->vs_ie[id].ie,
 			       le16_to_cpu(vs_param_set->header.len));
 			*buffer += le16_to_cpu(vs_param_set->header.len) +
path: drivers/net/wireless/marvell/mwifiex/scan.c
Vulnerability: An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.
Vulnerability ID: CVE-2020-12654
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2020-05-05
File: drivers/net/wireless/marvell/mwifiex/wmm.c
Commit message: mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()

mwifiex_ret_wmm_get_status() calls memcpy() without checking the
destination size.Since the source is given from remote AP which
contains illegal wmm elements , this may trigger a heap buffer
overflow.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Qing Xu <m1s5p6688@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Qing Xu

Vulnerable version (before fix):
 int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv, 				    "WMM Parameter Set Count: %d\n", 				    wmm_param_ie->qos_info_bitmap & mask);  			memcpy((u8 *) &priv->curr_bss_params.bss_descriptor. 			       wmm_ie, wmm_param_ie, 			       wmm_param_ie->vend_hdr.len + 2);

Fixed version (after fix):
 int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv, 				    "WMM Parameter Set Count: %d\n", 				    wmm_param_ie->qos_info_bitmap & mask);  			if (wmm_param_ie->vend_hdr.len + 2 > 				sizeof(struct ieee_types_wmm_parameter)) 				break;  			memcpy((u8 *) &priv->curr_bss_params.bss_descriptor. 			       wmm_ie, wmm_param_ie, 			       wmm_param_ie->vend_hdr.len + 2);

Patch:
patch: @@ -970,6 +970,10 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
 				    "WMM Parameter Set Count: %d\n",
 				    wmm_param_ie->qos_info_bitmap & mask);
 
+			if (wmm_param_ie->vend_hdr.len + 2 >
+				sizeof(struct ieee_types_wmm_parameter))
+				break;
+
 			memcpy((u8 *) &priv->curr_bss_params.bss_descriptor.
 			       wmm_ie, wmm_param_ie,
 			       wmm_param_ie->vend_hdr.len + 2);
path: drivers/net/wireless/marvell/mwifiex/wmm.c
Vulnerability: An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation.
Vulnerability ID: CVE-2020-12659
CWE: CWE-787
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2020-05-05
File: net/xdp/xdp_umem.c
Commit message: xsk: Add missing check on user supplied headroom size

Add a check that the headroom cannot be larger than the available
space in the chunk. In the current code, a malicious user can set the
headroom to a value larger than the chunk size minus the fixed XDP
headroom. That way packets with a length larger than the supported
size in the umem could get accepted and result in an out-of-bounds
write.

Fixes: c0c77d8fb787 ("xsk: add user memory registration support sockopt")
Reported-by: Bui Quang Minh <minhquangbui99@gmail.com>
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=207225
Link: https://lore.kernel.org/bpf/1586849715-23490-1-git-send-email-magnus.karlsson@intel.com
Commit author: Magnus Karlsson

Vulnerable version (before fix):
 static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) 	u32 chunk_size = mr->chunk_size, headroom = mr->headroom; 	unsigned int chunks, chunks_per_page; 	u64 addr = mr->addr, size = mr->len; 	int size_chk, err;  	if (chunk_size < XDP_UMEM_MIN_CHUNK_SIZE || chunk_size > PAGE_SIZE) { 		/* Strictly speaking we could support this, if: static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) 			return -EINVAL; 	}  	size_chk = chunk_size - headroom - XDP_PACKET_HEADROOM; 	if (size_chk < 0) 		return -EINVAL;  	umem->address = (unsigned long)addr;

Fixed version (after fix):
 static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) 	u32 chunk_size = mr->chunk_size, headroom = mr->headroom; 	unsigned int chunks, chunks_per_page; 	u64 addr = mr->addr, size = mr->len; 	int err;  	if (chunk_size < XDP_UMEM_MIN_CHUNK_SIZE || chunk_size > PAGE_SIZE) { 		/* Strictly speaking we could support this, if: static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) 			return -EINVAL; 	}  	if (headroom >= chunk_size - XDP_PACKET_HEADROOM) 		return -EINVAL;  	umem->address = (unsigned long)addr;

Patch:
patch: @@ -343,7 +343,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
 	u32 chunk_size = mr->chunk_size, headroom = mr->headroom;
 	unsigned int chunks, chunks_per_page;
 	u64 addr = mr->addr, size = mr->len;
-	int size_chk, err;
+	int err;
 
 	if (chunk_size < XDP_UMEM_MIN_CHUNK_SIZE || chunk_size > PAGE_SIZE) {
 		/* Strictly speaking we could support this, if:
@@ -382,8 +382,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
 			return -EINVAL;
 	}
 
-	size_chk = chunk_size - headroom - XDP_PACKET_HEADROOM;
-	if (size_chk < 0)
+	if (headroom >= chunk_size - XDP_PACKET_HEADROOM)
 		return -EINVAL;
 
 	umem->address = (unsigned long)addr;
path: net/xdp/xdp_umem.c
Vulnerability: core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.
Vulnerability ID: CVE-2020-12669
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/Dolibarr/dolibarr
Published: 2020-05-06
File: htdocs/core/get_menudiv.php
Commit message: Merge branch '11.0' of git@github.com:Dolibarr/dolibarr.git into develop

Conflicts:
	htdocs/core/get_menudiv.php
Commit author: Laurent Destailleur

Vulnerable version (before fix):
  // Load the menu manager (only if not already done) $file_menu = $conf->standard_menu; if (GETPOST('menu')) $file_menu = GETPOST('menu'); // example: menu=eldy_menu.php if (!class_exists('MenuManager')) { 	$menufound = 0;

Fixed version (after fix):
  // Load the menu manager (only if not already done) $file_menu = $conf->standard_menu; if (GETPOST('menu', 'aZ09')) $file_menu = GETPOST('menu', 'aZ09');     // example: menu=eldy_menu.php if (!class_exists('MenuManager')) { 	$menufound = 0;

Patch:
patch: @@ -185,7 +185,7 @@
 
 // Load the menu manager (only if not already done)
 $file_menu = $conf->standard_menu;
-if (GETPOST('menu')) $file_menu = GETPOST('menu'); // example: menu=eldy_menu.php
+if (GETPOST('menu', 'aZ09')) $file_menu = GETPOST('menu', 'aZ09');     // example: menu=eldy_menu.php
 if (!class_exists('MenuManager'))
 {
 	$menufound = 0;
path: htdocs/core/get_menudiv.php
Vulnerability: The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
Vulnerability ID: CVE-2020-12742
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/iubenda/iubenda-cookie-class
Published: 2020-05-13
File: test.php
Commit message: fix pecl security bug onto the test script
Commit author: Daniel Marzini

Vulnerable version (before fix):
  				<?php 				if ( ! empty( $_POST['url'] ) ) 					$url = filter_var( $_POST['url'], FILTER_SANITIZE_URL ); 				else 					$url = ''; 

Fixed version (after fix):
  				<?php 				if ( ! empty( $_POST['url'] ) )           if (substr($_POST['url'], 0, 4) == "http") { 					   $url = filter_var( $_POST['url'], FILTER_SANITIZE_URL );           } 				else 					$url = ''; 

Patch:
patch: @@ -49,7 +49,9 @@
 
 				<?php
 				if ( ! empty( $_POST['url'] ) )
-					$url = filter_var( $_POST['url'], FILTER_SANITIZE_URL );
+          if (substr($_POST['url'], 0, 4) == "http") {
+					   $url = filter_var( $_POST['url'], FILTER_SANITIZE_URL );
+          }
 				else
 					$url = '';
path: test.php
Vulnerability: MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.
Vulnerability ID: CVE-2020-12827
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/mjmlio/mjml
Published: 2020-06-17
File: packages/mjml-core/src/index.js
Commit message: expose ignoreIncludes on mjml2html
Commit author: KMcB

Vulnerable version (before fix):
 export default function mjml2html(mjml, options = {}) {     keepComments,     minify = false,     minifyOptions = {},     juiceOptions = {},     juicePreserveTags = null,     skeleton = defaultSkeleton, export default function mjml2html(mjml, options = {}) {       filePath,       actualPath,       preprocessors,     })   } 

Fixed version (after fix):
 export default function mjml2html(mjml, options = {}) {     keepComments,     minify = false,     minifyOptions = {},     ignoreIncludes = false,     juiceOptions = {},     juicePreserveTags = null,     skeleton = defaultSkeleton, export default function mjml2html(mjml, options = {}) {       filePath,       actualPath,       preprocessors,       ignoreIncludes,     })   } 

Patch:
patch: @@ -82,6 +82,7 @@ export default function mjml2html(mjml, options = {}) {
     keepComments,
     minify = false,
     minifyOptions = {},
+    ignoreIncludes = false,
     juiceOptions = {},
     juicePreserveTags = null,
     skeleton = defaultSkeleton,
@@ -102,6 +103,7 @@ export default function mjml2html(mjml, options = {}) {
       filePath,
       actualPath,
       preprocessors,
+      ignoreIncludes,
     })
   }
path: packages/mjml-core/src/index.js