rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
Vulnerability ID: CVE-2021-46251
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ScratchVerifier/ScratchOAuth2
Published: 2022-02-15
File: includes/special/SpecialScratchOAuth2.php
Commit message: SECURITY: Escape username in invalid username error
POST request with invalid usernames to SpecialScratchOAuth2 page in 
ScratchOAuth2 may lead to reflected cross-site scripting.
Commit author: apple502j

Vulnerable version (before fix):
 public function specialLogin( $error = null ) { 			$username = $request->getVal( 'username', '', ); 			if (!preg_match(SOA2_USERNAME_REGEX, $username)) { 				$this->specialLogin( 					wfMessage('soa2-invalid-username', $username)->plain() 				); 				return; 			}

Fixed version (after fix):
 public function specialLogin( $error = null ) { 			$username = $request->getVal( 'username', '', ); 			if (!preg_match(SOA2_USERNAME_REGEX, $username)) { 				$this->specialLogin( 					wfMessage('soa2-invalid-username')->plaintextParams($username)->parse() 				); 				return; 			}

Patch:
patch: @@ -69,7 +69,7 @@ public function specialLogin( $error = null ) {
 			$username = $request->getVal( 'username', '', );
 			if (!preg_match(SOA2_USERNAME_REGEX, $username)) {
 				$this->specialLogin(
-					wfMessage('soa2-invalid-username', $username)->plain()
+					wfMessage('soa2-invalid-username')->plaintextParams($username)->parse()
 				);
 				return;
 			}
path: includes/special/SpecialScratchOAuth2.php
Vulnerability: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
Vulnerability ID: CVE-2022-0139
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/radareorg/radare2
Published: 2022-02-08
File: libr/io/io_bank.c
Commit message: Fix use-after-free in iobank rbtree usage ##io

* See havoc4 bin for reproducer
* Reported via huntr.dev by 'Cen Zhang'
Commit author: Sergi Àlvarez i Capilla

Vulnerable version (before fix):
 R_API bool r_io_bank_map_add_top(RIO *io, const ut32 bankid, const ut32 mapid) { 		//delete all submaps that are completly included in sm 		RRBNode *next = r_rbnode_next (entry); 		// this can be optimized, there is no need to do search here 		r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL); 		entry = next; 	} 	if (entry && r_io_submap_from (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {

Fixed version (after fix):
 R_API bool r_io_bank_map_add_top(RIO *io, const ut32 bankid, const ut32 mapid) { 		//delete all submaps that are completly included in sm 		RRBNode *next = r_rbnode_next (entry); 		// this can be optimized, there is no need to do search here 		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL); 		if (!a) { 			break; 		} 		entry = next; 	} 	if (entry && r_io_submap_from (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {

Patch:
patch: @@ -230,7 +230,10 @@ R_API bool r_io_bank_map_add_top(RIO *io, const ut32 bankid, const ut32 mapid) {
 		//delete all submaps that are completly included in sm
 		RRBNode *next = r_rbnode_next (entry);
 		// this can be optimized, there is no need to do search here
-		r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
+		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
+		if (!a) {
+			break;
+		}
 		entry = next;
 	}
 	if (entry && r_io_submap_from (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {
path: libr/io/io_bank.c
Vulnerability: mruby is vulnerable to NULL Pointer Dereference
Vulnerability ID: CVE-2022-0240
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/mruby/mruby
Published: 2022-01-17
File: src/class.c
Commit message: class.c: add `obj->c` check before `prepare_singleton_class()`.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 prepare_singleton_class(mrb_state *mrb, struct RBasic *o) {   struct RClass *sc, *c;    if (o->c->tt == MRB_TT_SCLASS) return;   sc = MRB_OBJ_ALLOC(mrb, MRB_TT_SCLASS, mrb->class_class);   sc->flags |= MRB_FL_CLASS_IS_INHERITED; mrb_singleton_class_ptr(mrb_state *mrb, mrb_value v)     break;   }   obj = mrb_basic_ptr(v);   prepare_singleton_class(mrb, obj);   return obj->c; }

Fixed version (after fix):
 prepare_singleton_class(mrb_state *mrb, struct RBasic *o) {   struct RClass *sc, *c;    mrb_assert(o->c);   if (o->c->tt == MRB_TT_SCLASS) return;   sc = MRB_OBJ_ALLOC(mrb, MRB_TT_SCLASS, mrb->class_class);   sc->flags |= MRB_FL_CLASS_IS_INHERITED; mrb_singleton_class_ptr(mrb_state *mrb, mrb_value v)     break;   }   obj = mrb_basic_ptr(v);   if (obj->c == NULL) return NULL;   prepare_singleton_class(mrb, obj);   return obj->c; }

Patch:
patch: @@ -357,6 +357,7 @@ prepare_singleton_class(mrb_state *mrb, struct RBasic *o)
 {
   struct RClass *sc, *c;
 
+  mrb_assert(o->c);
   if (o->c->tt == MRB_TT_SCLASS) return;
   sc = MRB_OBJ_ALLOC(mrb, MRB_TT_SCLASS, mrb->class_class);
   sc->flags |= MRB_FL_CLASS_IS_INHERITED;
@@ -1682,6 +1683,7 @@ mrb_singleton_class_ptr(mrb_state *mrb, mrb_value v)
     break;
   }
   obj = mrb_basic_ptr(v);
+  if (obj->c == NULL) return NULL;
   prepare_singleton_class(mrb, obj);
   return obj->c;
 }
path: src/class.c
Vulnerability: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Vulnerability ID: CVE-2022-0326
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/mruby/mruby
Published: 2022-01-21
File: mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: no `OP_HASHADD` required when `val` is false.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 gen_hash(codegen_scope *s, node *tree, int val, int limit)     }   }   if (update) {     if (len > 0) {       pop_n(len*2+1);       genop_2(s, OP_HASHADD, cursp(), len);       push();     }     return -1;                  /* variable length */   }   if (update) return -1;   return len; } 

Fixed version (after fix):
 gen_hash(codegen_scope *s, node *tree, int val, int limit)     }   }   if (update) {     if (val && len > 0) {       pop_n(len*2+1);       genop_2(s, OP_HASHADD, cursp(), len);       push();     }     return -1;                  /* variable length */   }   return len; } 

Patch:
patch: @@ -1644,14 +1644,13 @@ gen_hash(codegen_scope *s, node *tree, int val, int limit)
     }
   }
   if (update) {
-    if (len > 0) {
+    if (val && len > 0) {
       pop_n(len*2+1);
       genop_2(s, OP_HASHADD, cursp(), len);
       push();
     }
     return -1;                  /* variable length */
   }
-  if (update) return -1;
   return len;
 }
path: mrbgems/mruby-compiler/core/codegen.c
Vulnerability: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.
Vulnerability ID: CVE-2022-0419
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/radareorg/radare2
Published: 2022-02-01
File: libr/bin/p/bin_xnu_kernelcache.c
Commit message: Fix null deref in xnu.kernelcache ##crash

* Reported by @xshad3 via huntr.dev
Commit author: pancake

Vulnerable version (before fix):
 static bool load_buffer(RBinFile *bf, void **bin_obj, RBuffer *buf, ut64 loadadd  beach: 	r_buf_free (fbuf); 	obj->cache_buf = NULL; 	MACH0_(mach0_free) (main_mach0); 	return false; }

Fixed version (after fix):
 static bool load_buffer(RBinFile *bf, void **bin_obj, RBuffer *buf, ut64 loadadd  beach: 	r_buf_free (fbuf); 	if (obj) { 		obj->cache_buf = NULL; 	} 	MACH0_(mach0_free) (main_mach0); 	return false; }

Patch:
patch: @@ -242,7 +242,9 @@ static bool load_buffer(RBinFile *bf, void **bin_obj, RBuffer *buf, ut64 loadadd
 
 beach:
 	r_buf_free (fbuf);
-	obj->cache_buf = NULL;
+	if (obj) {
+		obj->cache_buf = NULL;
+	}
 	MACH0_(mach0_free) (main_mach0);
 	return false;
 }
path: libr/bin/p/bin_xnu_kernelcache.c
Vulnerability: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Vulnerability ID: CVE-2022-0481
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/mruby/mruby
Published: 2022-02-04
File: mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: fixed a bug in hash code generation with `!val`.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 gen_hash(codegen_scope *s, node *tree, int val, int limit)    while (tree) {     if (nint(tree->car->car->car) == NODE_KW_REST_ARGS) {       if (len > 0) {         pop_n(len*2);         if (!update) {           genop_2(s, OP_HASH, cursp(), len); gen_hash(codegen_scope *s, node *tree, int val, int limit)         push();       }       codegen(s, tree->car->cdr, val);       if (len > 0 || update) {         pop(); pop();         genop_1(s, OP_HASHCAT, cursp());         push();

Fixed version (after fix):
 gen_hash(codegen_scope *s, node *tree, int val, int limit)    while (tree) {     if (nint(tree->car->car->car) == NODE_KW_REST_ARGS) {       if (val && len > 0) {         pop_n(len*2);         if (!update) {           genop_2(s, OP_HASH, cursp(), len); gen_hash(codegen_scope *s, node *tree, int val, int limit)         push();       }       codegen(s, tree->car->cdr, val);       if (val && (len > 0 || update)) {         pop(); pop();         genop_1(s, OP_HASHCAT, cursp());         push();

Patch:
patch: @@ -1603,7 +1603,7 @@ gen_hash(codegen_scope *s, node *tree, int val, int limit)
 
   while (tree) {
     if (nint(tree->car->car->car) == NODE_KW_REST_ARGS) {
-      if (len > 0) {
+      if (val && len > 0) {
         pop_n(len*2);
         if (!update) {
           genop_2(s, OP_HASH, cursp(), len);
@@ -1615,7 +1615,7 @@ gen_hash(codegen_scope *s, node *tree, int val, int limit)
         push();
       }
       codegen(s, tree->car->cdr, val);
-      if (len > 0 || update) {
+      if (val && (len > 0 || update)) {
         pop(); pop();
         genop_1(s, OP_HASHCAT, cursp());
         push();
path: mrbgems/mruby-compiler/core/codegen.c
Vulnerability: Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
Vulnerability ID: CVE-2022-0515
CWE: CWE-352
Severity score: 2.9
Project: https://github.com/crater-invoice/crater
Published: 2022-03-21
File: routes/web.php
Commit message: changed route method
Commit author: harshjagad20

Vulnerable version (before fix):
  Route::post('login', [LoginController::class, 'login']);  Route::get('auth/logout', function () {     Auth::guard('web')->logout(); }); 

Fixed version (after fix):
  Route::post('login', [LoginController::class, 'login']);  Route::post('auth/logout', function () {     Auth::guard('web')->logout(); }); 

Patch:
patch: @@ -42,7 +42,7 @@
 
 Route::post('login', [LoginController::class, 'login']);
 
-Route::get('auth/logout', function () {
+Route::post('auth/logout', function () {
     Auth::guard('web')->logout();
 });
path: routes/web.php
Vulnerability: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
Vulnerability ID: CVE-2022-0518
CWE: CWE-787
Severity score: 4.9
Project: https://github.com/radareorg/radare2
Published: 2022-02-08
File: shlr/java/class.c
Commit message: Fix oobread segfault in java arith8.class ##crash

* Reported by Cen Zhang via huntr.dev
Commit author: Sergi Àlvarez i Capilla

Vulnerable version (before fix):
 R_API RBinJavaAttrInfo *r_bin_java_inner_classes_attr_new(RBinJavaObj *bin, ut8 	ut64 offset = 0, curpos; 	attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset); 	offset += 6; 	if (attr == NULL) { 		// TODO eprintf 		return attr; R_API RBinJavaAttrInfo *r_bin_java_inner_classes_attr_new(RBinJavaObj *bin, ut8 	attr->info.inner_classes_attr.classes = r_list_newf (r_bin_java_inner_classes_attr_entry_free); 	for (i = 0; i < attr->info.inner_classes_attr.number_of_classes; i++) { 		curpos = buf_offset + offset; 		if (offset + 8 > sz) { 			eprintf ("Invalid amount of inner classes\n"); 			break; 		}

Fixed version (after fix):
 R_API RBinJavaAttrInfo *r_bin_java_inner_classes_attr_new(RBinJavaObj *bin, ut8 	ut64 offset = 0, curpos; 	attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset); 	offset += 6; 	if (buf_offset + offset + 8 > sz) { 		eprintf ("Invalid amount of inner classes\n"); 		return NULL; 	} 	if (attr == NULL) { 		// TODO eprintf 		return attr; R_API RBinJavaAttrInfo *r_bin_java_inner_classes_attr_new(RBinJavaObj *bin, ut8 	attr->info.inner_classes_attr.classes = r_list_newf (r_bin_java_inner_classes_attr_entry_free); 	for (i = 0; i < attr->info.inner_classes_attr.number_of_classes; i++) { 		curpos = buf_offset + offset; 		if (buf_offset + offset + 8 > sz) { 			eprintf ("Invalid amount of inner classes\n"); 			break; 		}

Patch:
patch: @@ -3733,6 +3733,10 @@ R_API RBinJavaAttrInfo *r_bin_java_inner_classes_attr_new(RBinJavaObj *bin, ut8
 	ut64 offset = 0, curpos;
 	attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset);
 	offset += 6;
+	if (buf_offset + offset + 8 > sz) {
+		eprintf ("Invalid amount of inner classes\n");
+		return NULL;
+	}
 	if (attr == NULL) {
 		// TODO eprintf
 		return attr;
@@ -3743,7 +3747,7 @@ R_API RBinJavaAttrInfo *r_bin_java_inner_classes_attr_new(RBinJavaObj *bin, ut8
 	attr->info.inner_classes_attr.classes = r_list_newf (r_bin_java_inner_classes_attr_entry_free);
 	for (i = 0; i < attr->info.inner_classes_attr.number_of_classes; i++) {
 		curpos = buf_offset + offset;
-		if (offset + 8 > sz) {
+		if (buf_offset + offset + 8 > sz) {
 			eprintf ("Invalid amount of inner classes\n");
 			break;
 		}
path: shlr/java/class.c
Vulnerability: Use After Free in NPM radare2.js prior to 5.6.2.
Vulnerability ID: CVE-2022-0520
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/radareorg/radare2
Published: 2022-02-08
File: libr/bin/format/pyc/marshal.c
Commit message: Fix bins/*/rep8 - UAF crash in pyc parser ##crash

* Reported by Cen Zhang via huntr.dev
Commit author: Sergi Àlvarez i Capilla

Vulnerable version (before fix):
 static pyc_object *get_object(RBuffer *buffer) { 		break; 	case TYPE_UNKNOWN: 		eprintf ("Get not implemented for type 0x%x\n", type); 		r_list_pop (refs); 		free_object (ret); 		return NULL; 	case 0:

Fixed version (after fix):
 static pyc_object *get_object(RBuffer *buffer) { 		break; 	case TYPE_UNKNOWN: 		eprintf ("Get not implemented for type 0x%x\n", type); 		// r_list_pop (refs); 		free_object (ret); 		return NULL; 	case 0:

Patch:
patch: @@ -1098,7 +1098,7 @@ static pyc_object *get_object(RBuffer *buffer) {
 		break;
 	case TYPE_UNKNOWN:
 		eprintf ("Get not implemented for type 0x%x\n", type);
-		r_list_pop (refs);
+		// r_list_pop (refs);
 		free_object (ret);
 		return NULL;
 	case 0:
path: libr/bin/format/pyc/marshal.c
Vulnerability: Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
Vulnerability ID: CVE-2022-0522
CWE: CWE-119
Severity score: 4.9
Project: https://github.com/radareorg/radare2
Published: 2022-02-08
File: libr/anal/p/anal_arm_cs.c
Commit message: Fix negative index in anal.arm64.cs ##crash

* Reported by Cen Zhang via huntr.dev
Commit author: Sergi Àlvarez i Capilla

Vulnerable version (before fix):
 static const char *arg(RAnal *a, csh *handle, cs_insn *insn, char *buf, int n) {  #define VEC64(n) insn->detail->arm64.operands[n].vess #define VEC64_APPEND(sb, n, i) vector64_append(sb, handle, insn, n, i) #define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz-1]<<sh))  static void vector64_append(RStrBuf *sb, csh *handle, cs_insn *insn, int n, int i) { 	cs_arm64_op op = INSOP64 (n); static void vector64_dst_append(RStrBuf *sb, csh *handle, cs_insn *insn, int n, 			shift -= 64; 			regc = "h"; 		}  		if (shift > 0 && shift < 64) { 			r_strbuf_appendf (sb, "%d,SWAP,0x%"PFMT64x",&,<<,%s%s,0x%"PFMT64x",&,|,%s%s", 				shift, mask, REG64 (n), regc, VEC64_MASK (shift, size), REG64 (n), regc);

Fixed version (after fix):
 static const char *arg(RAnal *a, csh *handle, cs_insn *insn, char *buf, int n) {  #define VEC64(n) insn->detail->arm64.operands[n].vess #define VEC64_APPEND(sb, n, i) vector64_append(sb, handle, insn, n, i) #define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz>0?sz-1:0]<<sh))  static void vector64_append(RStrBuf *sb, csh *handle, cs_insn *insn, int n, int i) { 	cs_arm64_op op = INSOP64 (n); static void vector64_dst_append(RStrBuf *sb, csh *handle, cs_insn *insn, int n, 			shift -= 64; 			regc = "h"; 		} 		if (shift > 0 && shift < 64) { 			r_strbuf_appendf (sb, "%d,SWAP,0x%"PFMT64x",&,<<,%s%s,0x%"PFMT64x",&,|,%s%s", 				shift, mask, REG64 (n), regc, VEC64_MASK (shift, size), REG64 (n), regc);

Patch:
patch: @@ -1015,7 +1015,7 @@ static const char *arg(RAnal *a, csh *handle, cs_insn *insn, char *buf, int n) {
 
 #define VEC64(n) insn->detail->arm64.operands[n].vess
 #define VEC64_APPEND(sb, n, i) vector64_append(sb, handle, insn, n, i)
-#define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz-1]<<sh))
+#define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz>0?sz-1:0]<<sh))
 
 static void vector64_append(RStrBuf *sb, csh *handle, cs_insn *insn, int n, int i) {
 	cs_arm64_op op = INSOP64 (n);
@@ -1079,7 +1079,6 @@ static void vector64_dst_append(RStrBuf *sb, csh *handle, cs_insn *insn, int n,
 			shift -= 64;
 			regc = "h";
 		}
-
 		if (shift > 0 && shift < 64) {
 			r_strbuf_appendf (sb, "%d,SWAP,0x%"PFMT64x",&,<<,%s%s,0x%"PFMT64x",&,|,%s%s",
 				shift, mask, REG64 (n), regc, VEC64_MASK (shift, size), REG64 (n), regc);
path: libr/anal/p/anal_arm_cs.c
Vulnerability: Out-of-bounds Read in Homebrew mruby prior to 3.2.
Vulnerability ID: CVE-2022-0525
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/mruby/mruby
Published: 2022-02-09
File: mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: stack position may be wrong on assignments.

When `[]=` access includes keyword arguments.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)           }         }         if (tree->cdr->car) {       /* keyword arguments */           gen_hash(s, tree->cdr->car->cdr, VAL, 0);           if (n < 14) {             n++;             push();           }           else {             pop();             genop_2(s, OP_ARYPUSH, cursp(), 1);           }         }       }       if (rhs) {

Fixed version (after fix):
 gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)           }         }         if (tree->cdr->car) {       /* keyword arguments */           if (n == 14) {             pop_n(n);             genop_2(s, OP_ARRAY, cursp(), n);             push();             n = 15;           }           gen_hash(s, tree->cdr->car->cdr, VAL, 0);           if (n < 14) {             n++;           }           else {             pop_n(2);             genop_2(s, OP_ARYPUSH, cursp(), 1);           }           push();         }       }       if (rhs) {

Patch:
patch: @@ -1865,15 +1865,21 @@ gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)
           }
         }
         if (tree->cdr->car) {       /* keyword arguments */
+          if (n == 14) {
+            pop_n(n);
+            genop_2(s, OP_ARRAY, cursp(), n);
+            push();
+            n = 15;
+          }
           gen_hash(s, tree->cdr->car->cdr, VAL, 0);
           if (n < 14) {
             n++;
-            push();
           }
           else {
-            pop();
+            pop_n(2);
             genop_2(s, OP_ARYPUSH, cursp(), 1);
           }
+          push();
         }
       }
       if (rhs) {
path: mrbgems/mruby-compiler/core/codegen.c
Vulnerability: Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.
Vulnerability ID: CVE-2022-0571
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/phoronix-test-suite/phoronix-test-suite
Published: 2022-02-14
File: pts-core/phoromatic/phoromatic_functions.php
Commit message: phoromatic: Reject HTML encoded character input and other strings that likely have no use within the context of Phoromatic inputs
Commit author: Michael Larabel

Vulnerable version (before fix):
 function phoromatic_quit_if_invalid_input_found($input_keys = null) 	// backup as to sanitization and stripping elsewhere, safeguard namely check for things like < for fields that shouldn't have it 	// plus a few simple backups as safeguards for words that really have no legit relevance within Phoromatic...  	foreach(array('<', 'document.write', '../', 'onerror', 'onload', 'alert(') as $invalid_string) 	{ 		foreach($input_keys as $key) 		{

Fixed version (after fix):
 function phoromatic_quit_if_invalid_input_found($input_keys = null) 	// backup as to sanitization and stripping elsewhere, safeguard namely check for things like < for fields that shouldn't have it 	// plus a few simple backups as safeguards for words that really have no legit relevance within Phoromatic...  	foreach(array('<', '>', 'document.write', '../', 'onerror', 'onload', 'alert(', 'String.', 'confirm(', 'focus=', '&lt', '&gt', '&#') as $invalid_string) 	{ 		foreach($input_keys as $key) 		{

Patch:
patch: @@ -33,7 +33,7 @@ function phoromatic_quit_if_invalid_input_found($input_keys = null)
 	// backup as to sanitization and stripping elsewhere, safeguard namely check for things like < for fields that shouldn't have it
 	// plus a few simple backups as safeguards for words that really have no legit relevance within Phoromatic...
 
-	foreach(array('<', 'document.write', '../', 'onerror', 'onload', 'alert(') as $invalid_string)
+	foreach(array('<', '>', 'document.write', '../', 'onerror', 'onload', 'alert(', 'String.', 'confirm(', 'focus=', '&lt', '&gt', '&#') as $invalid_string)
 	{
 		foreach($input_keys as $key)
 		{
path: pts-core/phoromatic/phoromatic_functions.php
Vulnerability: Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.
Vulnerability ID: CVE-2022-0614
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/mruby/mruby
Published: 2022-02-16
File: src/vm.c
Commit message: vm.c: should check type before hash access.

Since the operand of double splat (`**`) may not be a hash, simple
assertion (previous code since d42a64e) was not enough for this case.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)       int lim = a+b*2+1;        hash = regs[a];       mrb_assert(mrb_hash_p(hash));       for (i=a+1; i<lim; i+=2) {         mrb_hash_set(mrb, hash, regs[i], regs[i+1]);       }

Fixed version (after fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)       int lim = a+b*2+1;        hash = regs[a];       mrb_ensure_hash_type(mrb, hash);       for (i=a+1; i<lim; i+=2) {         mrb_hash_set(mrb, hash, regs[i], regs[i+1]);       }

Patch:
patch: @@ -2766,7 +2766,7 @@ mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)
       int lim = a+b*2+1;
 
       hash = regs[a];
-      mrb_assert(mrb_hash_p(hash));
+      mrb_ensure_hash_type(mrb, hash);
       for (i=a+1; i<lim; i+=2) {
         mrb_hash_set(mrb, hash, regs[i], regs[i+1]);
       }
path: src/vm.c