rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Missing validation causes denial of service via `GetSessionTensor` ### Impact
The implementation of [`tf.raw_ops.GetSessionTensor`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L94-L112) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

handle = tf.constant("[]", shape=[0], dtype=tf.string)
tf.raw_ops.GetSessionTensor(handle=handle)
```
  
The code assumes `handle` is a scalar but there is no validation for this:
  
```cc
    const Tensor& handle = ctx->input(0);
    const string& name = handle.scalar<tstring>()();
```

### Patches
We have patched the issue in GitHub commit [48305e8ffe5246d67570b64096a96f8e315a7281](https://github.com/tensorflow/tensorflow/commit/48305e8ffe5246d67570b64096a96f8e315a7281).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Vulnerability ID: GHSA-fv25-wrff-wf86
CWE: CWE-20
Severity score: 5.5
Project: https://github.com/tensorflow/tensorflow
Published: 2022-05-24
File: tensorflow/core/kernels/session_ops.cc
Commit message: Fix tf.raw_ops.GetSessionTensor vulnerability with invalid handle.

Check that input is actually a scalar before treating it as such.

PiperOrigin-RevId: 445218701
Commit author: Alan Liu

Vulnerable version (before fix):
 class GetSessionTensorOp : public OpKernel {    void Compute(OpKernelContext* ctx) override {     const Tensor& handle = ctx->input(0);     const string& name = handle.scalar<tstring>()();     Tensor val;     auto session_state = ctx->session_state();

Fixed version (after fix):
 class GetSessionTensorOp : public OpKernel {    void Compute(OpKernelContext* ctx) override {     const Tensor& handle = ctx->input(0);     OP_REQUIRES(ctx, TensorShapeUtils::IsScalar(handle.shape()),                 errors::InvalidArgument("handle must be scalar"));     const string& name = handle.scalar<tstring>()();     Tensor val;     auto session_state = ctx->session_state();

Patch:
patch: @@ -98,6 +98,8 @@ class GetSessionTensorOp : public OpKernel {
 
   void Compute(OpKernelContext* ctx) override {
     const Tensor& handle = ctx->input(0);
+    OP_REQUIRES(ctx, TensorShapeUtils::IsScalar(handle.shape()),
+                errors::InvalidArgument("handle must be scalar"));
     const string& name = handle.scalar<tstring>()();
     Tensor val;
     auto session_state = ctx->session_state();
path: tensorflow/core/kernels/session_ops.cc
Vulnerability: Prototype pollution in pathval A prototype pollution vulnerability affects all versions of package pathval under 1.1.1.
Vulnerability ID: GHSA-g6ww-v8xp-vmwg
CWE: CWE-20
Severity score: 7.2
Project: https://github.com/chaijs/pathval
Published: 2022-02-10
File: index.js
Commit message: fix: 🐛 fix prototype pollution
Commit author: Adam Gold

Vulnerable version (before fix):
 function parsePath(path) {   var str = path.replace(/([^\\])\[/g, '$1.[');   var parts = str.match(/(\\\.|[^.]+?)+/g);   return parts.map(function mapMatches(value) {     var regexp = /^\[(\d+)\]$/;     var mArr = regexp.exec(value);     var parsed = null;

Fixed version (after fix):
 function parsePath(path) {   var str = path.replace(/([^\\])\[/g, '$1.[');   var parts = str.match(/(\\\.|[^.]+?)+/g);   return parts.map(function mapMatches(value) {     if (value === "constructor" || value === "__proto__" || value === "prototype") {       return {}     }     var regexp = /^\[(\d+)\]$/;     var mArr = regexp.exec(value);     var parsed = null;

Patch:
patch: @@ -76,6 +76,9 @@ function parsePath(path) {
   var str = path.replace(/([^\\])\[/g, '$1.[');
   var parts = str.match(/(\\\.|[^.]+?)+/g);
   return parts.map(function mapMatches(value) {
+    if (value === "constructor" || value === "__proto__" || value === "prototype") {
+      return {}
+    }
     var regexp = /^\[(\d+)\]$/;
     var mArr = regexp.exec(value);
     var parsed = null;
path: index.js
Vulnerability: Code Injection in SEOmatic In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
Vulnerability ID: GHSA-g7xr-v82w-qggq
CWE: CWE-94
Severity score: 9.8
Project: https://github.com/nystudio107/craft-seomatic
Published: 2022-06-13
File: src/services/Helper.php
Commit message: Sanitize the canonical URL after the absolute URL has been returned, to mitigate poisoned `X-Forwarded-Host` headers
Commit author: Andrew Welch

Vulnerable version (before fix):
 public static function safeCanonicalUrl(): string         } catch (InvalidConfigException $e) {             Craft::error($e->getMessage(), __METHOD__);         }         $url = DynamicMetaHelper::sanitizeUrl($url);          return UrlHelper::absoluteUrlWithProtocol($url);     }      /**

Fixed version (after fix):
 public static function safeCanonicalUrl(): string         } catch (InvalidConfigException $e) {             Craft::error($e->getMessage(), __METHOD__);         }          return DynamicMetaHelper::sanitizeUrl(UrlHelper::absoluteUrlWithProtocol($url));     }      /**

Patch:
patch: @@ -148,9 +148,8 @@ public static function safeCanonicalUrl(): string
         } catch (InvalidConfigException $e) {
             Craft::error($e->getMessage(), __METHOD__);
         }
-        $url = DynamicMetaHelper::sanitizeUrl($url);
 
-        return UrlHelper::absoluteUrlWithProtocol($url);
+        return DynamicMetaHelper::sanitizeUrl(UrlHelper::absoluteUrlWithProtocol($url));
     }
 
     /**
path: src/services/Helper.php
Vulnerability: Cross-Site Request Forgery microweber microweber prior to version 1.2.11 is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability ID: GHSA-ghww-cv4v-hmxx
CWE: CWE-352
Severity score: 4.3
Project: https://github.com/microweber/microweber
Published: 2022-02-18
File: src/MicroweberPackages/User/Http/Controllers/UserLogoutController.php
Commit message: Update UserLogoutController.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 use App\Http\Resources\User\UserResource; use Illuminate\Http\Request; use Illuminate\Routing\Controller; use MicroweberPackages\App\Http\Middleware\SameSiteRefererMiddleware;  class UserLogoutController extends Controller public function index(Request $request)      public function submit(Request $request)     {         return logout();     }  }

Fixed version (after fix):
 use App\Http\Resources\User\UserResource; use Illuminate\Http\Request; use Illuminate\Routing\Controller; use Illuminate\Support\Facades\Auth; use MicroweberPackages\App\Http\Middleware\SameSiteRefererMiddleware;  class UserLogoutController extends Controller public function index(Request $request)      public function submit(Request $request)     {         Auth::logout();          $url = site_url();          return app()->url_manager->redirect($url);     }  }

Patch:
patch: @@ -5,6 +5,7 @@
 use App\Http\Resources\User\UserResource;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Auth;
 use MicroweberPackages\App\Http\Middleware\SameSiteRefererMiddleware;
 
 class UserLogoutController extends Controller
@@ -42,7 +43,11 @@ public function index(Request $request)
 
     public function submit(Request $request)
     {
-        return logout();
+        Auth::logout();
+
+        $url = site_url();
+
+        return app()->url_manager->redirect($url);
     }
 
 }
path: src/MicroweberPackages/User/Http/Controllers/UserLogoutController.php
Vulnerability: Cross-site Scripting in Beanstalk console Beanstalk console prior to version 1.7.12 is vulnerable to cross-site scripting.
Vulnerability ID: GHSA-gj85-pvp5-mvf9
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/ptrofimov/beanstalk_console
Published: 2022-02-06
File: lib/include.php
Commit message: Sanitize input
Commit author: Nav-Prak

Vulnerable version (before fix):
 function autoload_class($class) { require_once dirname(__FILE__) . '/../config.php'; require_once dirname(__FILE__) . '/../src/Storage.php';  $GLOBALS['server'] = !empty($_GET['server']) ? $_GET['server'] : ''; $GLOBALS['action'] = !empty($_GET['action']) ? $_GET['action'] : ''; $GLOBALS['state'] = !empty($_GET['state']) ? $_GET['state'] : ''; $GLOBALS['count'] = !empty($_GET['count']) ? $_GET['count'] : '';

Fixed version (after fix):
 function autoload_class($class) { require_once dirname(__FILE__) . '/../config.php'; require_once dirname(__FILE__) . '/../src/Storage.php';  $GLOBALS['server'] = !empty($_GET['server']) ? htmlspecialchars($_GET['server']) : ''; $GLOBALS['action'] = !empty($_GET['action']) ? $_GET['action'] : ''; $GLOBALS['state'] = !empty($_GET['state']) ? $_GET['state'] : ''; $GLOBALS['count'] = !empty($_GET['count']) ? $_GET['count'] : '';

Patch:
patch: @@ -19,7 +19,7 @@ function autoload_class($class) {
 require_once dirname(__FILE__) . '/../config.php';
 require_once dirname(__FILE__) . '/../src/Storage.php';
 
-$GLOBALS['server'] = !empty($_GET['server']) ? $_GET['server'] : '';
+$GLOBALS['server'] = !empty($_GET['server']) ? htmlspecialchars($_GET['server']) : '';
 $GLOBALS['action'] = !empty($_GET['action']) ? $_GET['action'] : '';
 $GLOBALS['state'] = !empty($_GET['state']) ? $_GET['state'] : '';
 $GLOBALS['count'] = !empty($_GET['count']) ? $_GET['count'] : '';
path: lib/include.php
Vulnerability: Data races in ticketed_lock Affected versions of this crate unconditionally implemented `Send` for `ReadTicket<T>` & `WriteTicket<T>`.
This allows to send non-Send `T` to other threads.

This can allows creating data races by cloning types with internal mutability and sending them to other threads (as `T` of `ReadTicket<T>`/`WriteTicket<T>`). Such data races can cause memory corruption or other undefined behavior.

The flaw was corrected in commit a986a93 by adding `T: Send` bounds to `Send` impls of `ReadTicket<T>`/`WriteTicket<T>`.
Vulnerability ID: GHSA-gq4h-f254-7cw9
CWE: CWE-362
Severity score: 8.1
Project: https://github.com/kvark/ticketed_lock
Published: 2021-08-25
File: src/lib.rs
Commit message: 'T: Send' to prevent misuse
Commit author: JOE1994

Vulnerable version (before fix):
 pub struct ReadTicket<T> {     data: Arc<UnsafeCell<T>>, }  unsafe impl<T> Send for ReadTicket<T> {}  #[cfg(not(feature = "futures"))] impl<T> ReadTicket<T> { pub struct WriteTicket<T> {     data: Arc<UnsafeCell<T>>, }  unsafe impl<T> Send for WriteTicket<T> {}  #[cfg(not(feature = "futures"))] impl<T> WriteTicket<T> {

Fixed version (after fix):
 pub struct ReadTicket<T> {     data: Arc<UnsafeCell<T>>, }  unsafe impl<T: Send> Send for ReadTicket<T> {}  #[cfg(not(feature = "futures"))] impl<T> ReadTicket<T> { pub struct WriteTicket<T> {     data: Arc<UnsafeCell<T>>, }  unsafe impl<T: Send> Send for WriteTicket<T> {}  #[cfg(not(feature = "futures"))] impl<T> WriteTicket<T> {

Patch:
patch: @@ -50,7 +50,7 @@ pub struct ReadTicket<T> {
     data: Arc<UnsafeCell<T>>,
 }
 
-unsafe impl<T> Send for ReadTicket<T> {}
+unsafe impl<T: Send> Send for ReadTicket<T> {}
 
 #[cfg(not(feature = "futures"))]
 impl<T> ReadTicket<T> {
@@ -112,7 +112,7 @@ pub struct WriteTicket<T> {
     data: Arc<UnsafeCell<T>>,
 }
 
-unsafe impl<T> Send for WriteTicket<T> {}
+unsafe impl<T: Send> Send for WriteTicket<T> {}
 
 #[cfg(not(feature = "futures"))]
 impl<T> WriteTicket<T> {
path: src/lib.rs
Vulnerability: Cross-site Scripting in ShowDoc ShowDoc version 2.10.3 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability ID: GHSA-gq77-3r6x-383w
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/star7th/showdoc
Published: 2022-03-13
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: file upload bug
Commit author: star7th

Vulnerable version (before fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".svg") 			|| $isDangerStr($filename , ".htm") 			|| $isDangerStr($filename , "%") 		) { 			return true; 		}

Fixed version (after fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".svg") 			|| $isDangerStr($filename , ".htm") 			|| $isDangerStr($filename , "%") 			|| $isDangerStr($filename , ".xml") 		) { 			return true; 		}

Patch:
patch: @@ -301,6 +301,7 @@ public function isDangerFilename($filename){
 			|| $isDangerStr($filename , ".svg")
 			|| $isDangerStr($filename , ".htm")
 			|| $isDangerStr($filename , "%")
+			|| $isDangerStr($filename , ".xml")
 		) {
 			return true;
 		}
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer in aubio aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.
Vulnerability ID: GHSA-grmf-4fq6-2r79
CWE: CWE-119
Severity score: 9.8
Project: https://github.com/aubio/aubio
Published: 2019-07-26
File: src/tempo/tempo.c
Commit message: [tempo] fix buffer overflow in method parser
Commit author: Paul Brossier

Vulnerable version (before fix):
 aubio_tempo_t * new_aubio_tempo (const char_t * tempo_mode,     uint_t buf_size, uint_t hop_size, uint_t samplerate) {   aubio_tempo_t * o = AUBIO_NEW(aubio_tempo_t);   char_t specdesc_func[20];   o->samplerate = samplerate;   // check parameters are valid   if ((sint_t)hop_size < 1) { aubio_tempo_t * new_aubio_tempo (const char_t * tempo_mode,   o->pp       = new_aubio_peakpicker();   aubio_peakpicker_set_threshold (o->pp, o->threshold);   if ( strcmp(tempo_mode, "default") == 0 ) {     strcpy(specdesc_func, "specflux");   } else {     strcpy(specdesc_func, tempo_mode);   }   o->od       = new_aubio_specdesc(specdesc_func,buf_size);   o->of       = new_fvec(1);

Fixed version (after fix):
 aubio_tempo_t * new_aubio_tempo (const char_t * tempo_mode,     uint_t buf_size, uint_t hop_size, uint_t samplerate) {   aubio_tempo_t * o = AUBIO_NEW(aubio_tempo_t);   char_t specdesc_func[PATH_MAX];   o->samplerate = samplerate;   // check parameters are valid   if ((sint_t)hop_size < 1) { aubio_tempo_t * new_aubio_tempo (const char_t * tempo_mode,   o->pp       = new_aubio_peakpicker();   aubio_peakpicker_set_threshold (o->pp, o->threshold);   if ( strcmp(tempo_mode, "default") == 0 ) {     strncpy(specdesc_func, "specflux", PATH_MAX - 1);   } else {     strncpy(specdesc_func, tempo_mode, PATH_MAX - 1);     specdesc_func[PATH_MAX - 1] = '\0';   }   o->od       = new_aubio_specdesc(specdesc_func,buf_size);   o->of       = new_fvec(1);

Patch:
patch: @@ -168,7 +168,7 @@ aubio_tempo_t * new_aubio_tempo (const char_t * tempo_mode,
     uint_t buf_size, uint_t hop_size, uint_t samplerate)
 {
   aubio_tempo_t * o = AUBIO_NEW(aubio_tempo_t);
-  char_t specdesc_func[20];
+  char_t specdesc_func[PATH_MAX];
   o->samplerate = samplerate;
   // check parameters are valid
   if ((sint_t)hop_size < 1) {
@@ -203,9 +203,10 @@ aubio_tempo_t * new_aubio_tempo (const char_t * tempo_mode,
   o->pp       = new_aubio_peakpicker();
   aubio_peakpicker_set_threshold (o->pp, o->threshold);
   if ( strcmp(tempo_mode, "default") == 0 ) {
-    strcpy(specdesc_func, "specflux");
+    strncpy(specdesc_func, "specflux", PATH_MAX - 1);
   } else {
-    strcpy(specdesc_func, tempo_mode);
+    strncpy(specdesc_func, tempo_mode, PATH_MAX - 1);
+    specdesc_func[PATH_MAX - 1] = '\0';
   }
   o->od       = new_aubio_specdesc(specdesc_func,buf_size);
   o->of       = new_fvec(1);
path: src/tempo/tempo.c
Vulnerability: Cross-site Scripting in bootstrap-table Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.
Vulnerability ID: GHSA-grw5-g9h2-wpg8
CWE: CWE-79
Severity score: 6.8
Project: https://github.com/wenzhixin/bootstrap-table
Published: 2022-05-17
File: src/extensions/export/bootstrap-table-export.js
Commit message: Fixed XSS vulnerability bug by onCellHtmlData
Commit author: zhixin

Vulnerable version (before fix):
 $.extend($.fn.bootstrapTable.defaults, {   showExport: false,   exportDataType: 'basic', // basic, all, selected   exportTypes: ['json', 'xml', 'csv', 'txt', 'sql', 'excel'],   exportOptions: {     onCellHtmlData (cell, rowIndex, colIndex, htmlData) {       if (cell.is('th')) {         return cell.find('.th-inner').text()       }        return htmlData     }   },   exportFooter: false })  $.BootstrapTable = class extends $.BootstrapTable {     $exportButtons.click(e => {       e.preventDefault()        const type = $(e.currentTarget).data('type')       const exportOptions = {         type,         escape: false       }        this.exportTable(exportOptions)     })     this.handleToolbar()   }

Fixed version (after fix):
 $.extend($.fn.bootstrapTable.defaults, {   showExport: false,   exportDataType: 'basic', // basic, all, selected   exportTypes: ['json', 'xml', 'csv', 'txt', 'sql', 'excel'],   exportOptions: {},   exportFooter: false })  $.BootstrapTable = class extends $.BootstrapTable {     $exportButtons.click(e => {       e.preventDefault()        this.exportTable({         type: $(e.currentTarget).data('type')       })     })     this.handleToolbar()   }

Patch:
patch: @@ -23,15 +23,7 @@ $.extend($.fn.bootstrapTable.defaults, {
   showExport: false,
   exportDataType: 'basic', // basic, all, selected
   exportTypes: ['json', 'xml', 'csv', 'txt', 'sql', 'excel'],
-  exportOptions: {
-    onCellHtmlData (cell, rowIndex, colIndex, htmlData) {
-      if (cell.is('th')) {
-        return cell.find('.th-inner').text()
-      }
-
-      return htmlData
-    }
-  },
+  exportOptions: {},
   exportFooter: false
 })
 
@@ -162,13 +154,9 @@ $.BootstrapTable = class extends $.BootstrapTable {
     $exportButtons.click(e => {
       e.preventDefault()
 
-      const type = $(e.currentTarget).data('type')
-      const exportOptions = {
-        type,
-        escape: false
-      }
-
-      this.exportTable(exportOptions)
+      this.exportTable({
+        type: $(e.currentTarget).data('type')
+      })
     })
     this.handleToolbar()
   }
path: src/extensions/export/bootstrap-table-export.js
Vulnerability: Denial of Service (DoS) in Nokogiri on JRuby ## Summary

Nokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv). That CVE is rated 7.5 (High Severity).

See [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) for more information.

Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.


## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.


## Impact

### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml

- **Severity**: High 7.5
- **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption
- **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.
- **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
Vulnerability ID: GHSA-gx8x-g87m-h5q6
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/sparklemotion/nekohtml
Published: 2022-04-11
File: src/org/cyberneko/html/HTMLScanner.java
Commit message: fix: ensure ill-formed PIs are parsed correctly
Commit author: Mike Dalessio

Vulnerable version (before fix):
 protected void scanPI() throws IOException {                     if (c == '?' || c == '/') {                         char c0 = (char)c;                         c = fCurrentEntity.read();                         if (c == '>') {                             break;                         }                         fStringBuffer.append(c0);

Fixed version (after fix):
 protected void scanPI() throws IOException {                     if (c == '?' || c == '/') {                         char c0 = (char)c;                         c = fCurrentEntity.read();                         if (c == '>' || c == -1) {                             break;                         }                         fStringBuffer.append(c0);

Patch:
patch: @@ -2588,7 +2588,7 @@ protected void scanPI() throws IOException {
                     if (c == '?' || c == '/') {
                         char c0 = (char)c;
                         c = fCurrentEntity.read();
-                        if (c == '>') {
+                        if (c == '>' || c == -1) {
                             break;
                         }
                         fStringBuffer.append(c0);
path: src/org/cyberneko/html/HTMLScanner.java
Vulnerability: Cross-site Scripting (XSS) - Stored in crud-file-server Versions of `crud-file-server` before 0.8.0 are vulnerable to stored cross-site scripting (XSS). This is due to insufficient santiziation of filenames when directory index is served by `crud-file-server`.


## Recommendation

Update to version 0.8.0 or later.
Vulnerability ID: GHSA-h24f-9mm4-w336
CWE: CWE-79
Severity score: 0
Project: https://github.com/omphalos/crud-file-server
Published: 2018-07-18
File: crud-file-server.js
Commit message: Fix not sanitizing file names rendered in html
Commit author: omphalos

Vulnerable version (before fix):
 exports.handleRequest = function(vpath, path, req, res, readOnly, logHeadRequest 															var name = results[f].name; 															var normalized = url + '/' + name; 															while(normalized[0] == '/') { normalized = normalized.slice(1, normalized.length); } 															res.write('\r\n<p><a href="/' + normalized + '">' + name + '</a></p>'); 														} 														res.end('\r\n</body></html>'); 													}

Fixed version (after fix):
 exports.handleRequest = function(vpath, path, req, res, readOnly, logHeadRequest 															var name = results[f].name; 															var normalized = url + '/' + name; 															while(normalized[0] == '/') { normalized = normalized.slice(1, normalized.length); } 															if(normalized.indexOf('"') >= 0) throw new Error('unsupported file name') 															name = name.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); 															res.write('\r\n<p><a href="/' + normalized + '"><span>' + name + '</span></a></p>'); 														} 														res.end('\r\n</body></html>'); 													}

Patch:
patch: @@ -140,7 +140,9 @@ exports.handleRequest = function(vpath, path, req, res, readOnly, logHeadRequest
 															var name = results[f].name;
 															var normalized = url + '/' + name;
 															while(normalized[0] == '/') { normalized = normalized.slice(1, normalized.length); }
-															res.write('\r\n<p><a href="/' + normalized + '">' + name + '</a></p>');
+															if(normalized.indexOf('"') >= 0) throw new Error('unsupported file name')
+															name = name.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+															res.write('\r\n<p><a href="/' + normalized + '"><span>' + name + '</span></a></p>');
 														}
 														res.end('\r\n</body></html>');
 													}
path: crud-file-server.js