rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: SQL Injection in medoo columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
Vulnerability ID: GHSA-q9p4-qfc8-fvpp
CWE: CWE-89
Severity score: 9.8
Project: https://github.com/catfan/Medoo
Published: 2021-10-12
File: src/Medoo.php
Commit message: [fix] Fix columnQuote for security issue reported by Snyk
Commit author: Angel Lai

Vulnerable version (before fix):
 protected function typeMap($value, $type)  	protected function columnQuote($string) 	{ 		if (strpos($string, '.') !== false) 		{ 			return '"' . $this->prefix . str_replace('.', '"."', $string) . '"';

Fixed version (after fix):
 protected function typeMap($value, $type)  	protected function columnQuote($string) 	{ 		if (!preg_match('/^[a-zA-Z0-9]+(\.?[a-zA-Z0-9]+)?$/i', $string)) 		{ 			throw new InvalidArgumentException("Incorrect column name \"$string\""); 		}  		if (strpos($string, '.') !== false) 		{ 			return '"' . $this->prefix . str_replace('.', '"."', $string) . '"';

Patch:
patch: @@ -500,6 +500,11 @@ protected function typeMap($value, $type)
 
 	protected function columnQuote($string)
 	{
+		if (!preg_match('/^[a-zA-Z0-9]+(\.?[a-zA-Z0-9]+)?$/i', $string))
+		{
+			throw new InvalidArgumentException("Incorrect column name \"$string\"");
+		}
+
 		if (strpos($string, '.') !== false)
 		{
 			return '"' . $this->prefix . str_replace('.', '"."', $string) . '"';
path: src/Medoo.php
Vulnerability: OS Command Injection in im-metadata im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.
Vulnerability ID: GHSA-qfxv-qqvg-24pg
CWE: CWE-78
Severity score: 9.8
Project: https://github.com/Turistforeningen/node-im-metadata
Published: 2021-04-13
File: index.js
Commit message: fix: check path argument before processing (#10)

hotfix to re mediate command injection
Commit author: Sam Sanoop

Vulnerable version (before fix):
 module.exports = function(path, opts, cb) {     opts = {};   }    var cmd = module.exports.cmd(path, opts);   opts.timeout = opts.timeout || 5000;    exec(cmd, opts, function(e, stdout, stderr) {     if (e) { return cb(e); }     if (stderr) { return cb(new Error(stderr)); }      return cb(null, module.exports.parse(path, stdout, opts));   }); };  module.exports.cmd = function(path, opts) {

Fixed version (after fix):
 module.exports = function(path, opts, cb) {     opts = {};   }    if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(path))) {     console.log('Input Validation failed, Suspicious Characters found');   } else {     var cmd = module.exports.cmd(path, opts);     opts.timeout = opts.timeout || 5000;     exec(cmd, opts, function(e, stdout, stderr) {       if (e) { return cb(e); }     if (stderr) { return cb(new Error(stderr)); }        return cb(null, module.exports.parse(path, stdout, opts));   }); } };  module.exports.cmd = function(path, opts) {

Patch:
patch: @@ -9,15 +9,18 @@ module.exports = function(path, opts, cb) {
     opts = {};
   }
 
-  var cmd = module.exports.cmd(path, opts);
-  opts.timeout = opts.timeout || 5000;
-
-  exec(cmd, opts, function(e, stdout, stderr) {
-    if (e) { return cb(e); }
+  if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(path))) {
+    console.log('Input Validation failed, Suspicious Characters found');
+  } else {
+    var cmd = module.exports.cmd(path, opts);
+    opts.timeout = opts.timeout || 5000;
+    exec(cmd, opts, function(e, stdout, stderr) {
+      if (e) { return cb(e); }
     if (stderr) { return cb(new Error(stderr)); }
 
-    return cb(null, module.exports.parse(path, stdout, opts));
+      return cb(null, module.exports.parse(path, stdout, opts));
   });
+}
 };
 
 module.exports.cmd = function(path, opts) {
path: index.js
Vulnerability: Directory traversal in mkdocs The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information.
Vulnerability ID: GHSA-qh9q-34h6-hcv9
CWE: CWE-22
Severity score: 7.5
Project: https://github.com/mkdocs/mkdocs
Published: 2021-10-12
File: mkdocs/livereload/__init__.py
Commit message: Prevent directory traversal in the dev server
Commit author: Oleh Prypin

Vulnerable version (before fix):
 import mimetypes import os import os.path import re import socketserver import threading def condition():         if path == "/js/livereload.js":             file_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "livereload.js")         elif path.startswith(self.mount_path):             rel_file_path = path[len(self.mount_path):].lstrip("/")             if path.endswith("/"):                 rel_file_path += "index.html"             file_path = os.path.join(self.root, rel_file_path)         elif path == "/":             start_response("302 Found", [("Location", self.mount_path)])

Fixed version (after fix):
 import mimetypes import os import os.path import posixpath import re import socketserver import threading def condition():         if path == "/js/livereload.js":             file_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "livereload.js")         elif path.startswith(self.mount_path):             rel_file_path = path[len(self.mount_path):]             if path.endswith("/"):                 rel_file_path += "index.html"             # Prevent directory traversal - normalize the path.             rel_file_path = posixpath.normpath("/" + rel_file_path).lstrip("/")             file_path = os.path.join(self.root, rel_file_path)         elif path == "/":             start_response("302 Found", [("Location", self.mount_path)])

Patch:
patch: @@ -4,6 +4,7 @@
 import mimetypes
 import os
 import os.path
+import posixpath
 import re
 import socketserver
 import threading
@@ -183,9 +184,11 @@ def condition():
         if path == "/js/livereload.js":
             file_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "livereload.js")
         elif path.startswith(self.mount_path):
-            rel_file_path = path[len(self.mount_path):].lstrip("/")
+            rel_file_path = path[len(self.mount_path):]
             if path.endswith("/"):
                 rel_file_path += "index.html"
+            # Prevent directory traversal - normalize the path.
+            rel_file_path = posixpath.normpath("/" + rel_file_path).lstrip("/")
             file_path = os.path.join(self.root, rel_file_path)
         elif path == "/":
             start_response("302 Found", [("Location", self.mount_path)])
path: mkdocs/livereload/__init__.py
Vulnerability: CWE-730 Regex injection with IFTTT Plugin ### Impact
Anyone _publicly_ hosting the Apprise library and granting them access to the IFTTT notification service.

### Patches
Update to Apprise v0.9.5.1
   ```bash
   # Install Apprise v0.9.5.1 from PyPI
   pip install apprise==0.9.5.1
   ```

The patch to the problem was performed [here](https://github.com/caronc/apprise/pull/436/files).

### Workarounds
Alternatively, if upgrading is not an option, you can safely remove the following file:
- `apprise/plugins/NotifyIFTTT.py` 

The above will eliminate the ability to use IFTTT, but everything else will work smoothly.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Apprise](https://github.com/caronc/apprise/issues)
* Email me at [lead2gold@gmail.com](mailto:lead2gold@gmail.com)

### Additional Credit
Github would not allow me to additionally credit **Rasmus Petersen**, but I would like to put that here at the very least - thank you for finding and reporting this issue along with those already credited

## Additional Notes:
- Github would not allow me to add/tag the 2 CWE's this issue is applicable to (only CWE-400).  The other is: CWE-730 (placed in the title)
Vulnerability ID: GHSA-qhmp-h54x-38qr
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/caronc/apprise
Published: 2021-09-20
File: apprise/plugins/NotifyIFTTT.py
Commit message: Slight bulletproofing to IFTTT regex handling (#436)
Commit author: Chris Caron

Vulnerable version (before fix):
 def parse_native_url(url):         result = re.match(             r'^https?://maker\.ifttt\.com/use/'             r'(?P<webhook_id>[A-Z0-9_-]+)'             r'/?(?P<events>([A-Z0-9_-]+/?)+)?'             r'/?(?P<params>\?.+)?$', url, re.I)          if result:

Fixed version (after fix):
 def parse_native_url(url):         result = re.match(             r'^https?://maker\.ifttt\.com/use/'             r'(?P<webhook_id>[A-Z0-9_-]+)'             r'((?P<events>(/[A-Z0-9_-]+)+))?'             r'/?(?P<params>\?.+)?$', url, re.I)          if result:

Patch:
patch: @@ -355,7 +355,7 @@ def parse_native_url(url):
         result = re.match(
             r'^https?://maker\.ifttt\.com/use/'
             r'(?P<webhook_id>[A-Z0-9_-]+)'
-            r'/?(?P<events>([A-Z0-9_-]+/?)+)?'
+            r'((?P<events>(/[A-Z0-9_-]+)+))?'
             r'/?(?P<params>\?.+)?$', url, re.I)
 
         if result:
path: apprise/plugins/NotifyIFTTT.py
Vulnerability: Exposure of Sensitive Information in snipe/snipe-it Snipe-IT prior to v5.3.10 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.
Vulnerability ID: GHSA-qpv2-jxc7-3638
CWE: CWE-200
Severity score: 4.3
Project: https://github.com/snipe/snipe-it
Published: 2022-02-15
File: resources/lang/en/passwords.php
Commit message: Updated language string

Signed-off-by: snipe <snipe@snipe.net>
Commit author: snipe

Vulnerable version (before fix):
 <?php  return [     'sent'	        => 'Your password link has been sent!',     'user'			=> 'No matching active user found with that email.', ];

Fixed version (after fix):
 <?php  return [     'sent'	        => 'Success: If that email address exists in our system, a password recovery email has been sent.',     'user'			=> 'No matching active user found with that email.', ];

Patch:
patch: @@ -1,6 +1,6 @@
 <?php
 
 return [
-    'sent'	        => 'Your password link has been sent!',
+    'sent'	        => 'Success: If that email address exists in our system, a password recovery email has been sent.',
     'user'			=> 'No matching active user found with that email.',
 ];
path: resources/lang/en/passwords.php
Vulnerability: Out-of-Bounds read in stringstream Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).

# WITHDRAWN

This is a duplicate of GHSA-mf6x-7mm4-x2g7
Vulnerability ID: GHSA-qpw2-xchm-655q
CWE: CWE-125
Severity score: 6.5
Project: https://github.com/mhart/StringStream
Published: 2022-01-06
File: stringstream.js
Commit message: Merge pull request #9 from mhart/fix-buffer-constructor-vuln

Ensure data is not a number in Buffer constructor
Commit author: Michael Hart

Vulnerable version (before fix):
 StringStream.prototype.write = function(data) {     return false   }   if (this.fromEncoding) {     if (Buffer.isBuffer(data)) data = data.toString()     data = new Buffer(data, this.fromEncoding)   }   var string = this.decoder.write(data)

Fixed version (after fix):
 StringStream.prototype.write = function(data) {     return false   }   if (this.fromEncoding) {     if (Buffer.isBuffer(data) || typeof data === 'number') data = data.toString()     data = new Buffer(data, this.fromEncoding)   }   var string = this.decoder.write(data)

Patch:
patch: @@ -28,7 +28,7 @@ StringStream.prototype.write = function(data) {
     return false
   }
   if (this.fromEncoding) {
-    if (Buffer.isBuffer(data)) data = data.toString()
+    if (Buffer.isBuffer(data) || typeof data === 'number') data = data.toString()
     data = new Buffer(data, this.fromEncoding)
   }
   var string = this.decoder.write(data)
path: stringstream.js
Vulnerability: Cross-site Scripting in ShowDoc ShowDoc is vulnerable to stored cross-site scripting via viva cshtm file upload in in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability ID: GHSA-qq74-vgcf-54c3
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/star7th/showdoc
Published: 2022-03-15
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: bug
Commit author: star7th

Vulnerable version (before fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".asa") 			|| $isDangerStr($filename , ".cshtml") 			|| $isDangerStr($filename , ".axd") 		) { 			return true; 		}

Fixed version (after fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".asa") 			|| $isDangerStr($filename , ".cshtml") 			|| $isDangerStr($filename , ".axd") 			|| $isDangerStr($filename , "htm") 		) { 			return true; 		}

Patch:
patch: @@ -311,6 +311,7 @@ public function isDangerFilename($filename){
 			|| $isDangerStr($filename , ".asa")
 			|| $isDangerStr($filename , ".cshtml")
 			|| $isDangerStr($filename , ".axd")
+			|| $isDangerStr($filename , "htm")
 		) {
 			return true;
 		}
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: Improper Input Validation In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.
Vulnerability ID: GHSA-qr2j-wrhx-4829
CWE: CWE-20
Severity score: 7.5
Project: https://github.com/ethereum/go-ethereum
Published: 2021-05-18
File: eth/api_tracer.go
Commit message: eth: ensure from<to when tracing chain (credits Chen Nan via bugbounty)
Commit author: Martin Holst Swende

Vulnerable version (before fix):
 func (api *PrivateDebugAPI) TraceChain(ctx context.Context, start, end rpc.Block 	if to == nil { 		return nil, fmt.Errorf("end block #%d not found", end) 	} 	return api.traceChain(ctx, from, to, config) } 

Fixed version (after fix):
 func (api *PrivateDebugAPI) TraceChain(ctx context.Context, start, end rpc.Block 	if to == nil { 		return nil, fmt.Errorf("end block #%d not found", end) 	} 	if from.Number().Cmp(to.Number()) >= 0 { 		return nil, fmt.Errorf("end block (#%d) needs to come after start block (#%d)", end, start) 	} 	return api.traceChain(ctx, from, to, config) } 

Patch:
patch: @@ -119,6 +119,9 @@ func (api *PrivateDebugAPI) TraceChain(ctx context.Context, start, end rpc.Block
 	if to == nil {
 		return nil, fmt.Errorf("end block #%d not found", end)
 	}
+	if from.Number().Cmp(to.Number()) >= 0 {
+		return nil, fmt.Errorf("end block (#%d) needs to come after start block (#%d)", end, start)
+	}
 	return api.traceChain(ctx, from, to, config)
 }
path: eth/api_tracer.go
Vulnerability: Cross-Site Scripting in Kaminari ### Impact
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

### Releases
The 1.2.1 gem including the patch has already been released.
All past released versions are affected by this vulnerability.

### Workarounds
Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.

```ruby
module Kaminari::Helpers
  PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
end
```

### Credits
Thanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.
Vulnerability ID: GHSA-r5jw-62xg-j433
CWE: CWE-79
Severity score: 6.4
Project: https://github.com/kaminari/kaminari
Published: 2020-05-28
File: kaminari-core/lib/kaminari/helpers/tags.rb
Commit message: Blacklist "original_script_name" get param
Commit author: Daniel Mircea

Vulnerable version (before fix):
  module Kaminari   module Helpers     PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name].freeze      # A tag stands for an HTML tag inside the paginator.     # Basically, a tag has its own partial template file, so every tag can be

Fixed version (after fix):
  module Kaminari   module Helpers     PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze      # A tag stands for an HTML tag inside the paginator.     # Basically, a tag has its own partial template file, so every tag can be

Patch:
patch: @@ -2,7 +2,7 @@
 
 module Kaminari
   module Helpers
-    PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name].freeze
+    PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
 
     # A tag stands for an HTML tag inside the paginator.
     # Basically, a tag has its own partial template file, so every tag can be
path: kaminari-core/lib/kaminari/helpers/tags.rb
Vulnerability: Data race in abox An issue was discovered in the abox crate before 0.4.1 for Rust. 

Affected versions of this crate implements `Send`/`Sync` for `AtomicBox<T>` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread.

Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race).

The flaw was corrected in commit 34c2b9e by adding trait bound `T: Send` to `Send` impl for `AtomicBox<T>` and trait bound `T: Sync` to `Sync` impl for `AtomicBox<T>`.
Vulnerability ID: GHSA-r626-fc64-3q28
CWE: CWE-362
Severity score: 8.1
Project: https://github.com/SonicFrog/abox
Published: 2021-08-25
File: src/lib.rs
Commit message: send/sync fix to prevent misuse
Commit author: JOE1994

Vulnerable version (before fix):
 impl<T: Sized> Drop for AtomicBox<T> {     } }  unsafe impl<T: Sized> Sync for AtomicBox<T> {} unsafe impl<T: Sized> Send for AtomicBox<T> {}  #[cfg(test)] mod tests {

Fixed version (after fix):
 impl<T: Sized> Drop for AtomicBox<T> {     } }  unsafe impl<T: Sized + Sync> Sync for AtomicBox<T> {} unsafe impl<T: Sized + Send> Send for AtomicBox<T> {}  #[cfg(test)] mod tests {

Patch:
patch: @@ -89,8 +89,8 @@ impl<T: Sized> Drop for AtomicBox<T> {
     }
 }
 
-unsafe impl<T: Sized> Sync for AtomicBox<T> {}
-unsafe impl<T: Sized> Send for AtomicBox<T> {}
+unsafe impl<T: Sized + Sync> Sync for AtomicBox<T> {}
+unsafe impl<T: Sized + Send> Send for AtomicBox<T> {}
 
 #[cfg(test)]
 mod tests {
path: src/lib.rs
Vulnerability: Data race in abox An issue was discovered in the abox crate before 0.4.1 for Rust. 

Affected versions of this crate implements `Send`/`Sync` for `AtomicBox<T>` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread.

Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race).

The flaw was corrected in commit 34c2b9e by adding trait bound `T: Send` to `Send` impl for `AtomicBox<T>` and trait bound `T: Sync` to `Sync` impl for `AtomicBox<T>`.
Vulnerability ID: GHSA-r626-fc64-3q28
CWE: CWE-119
Severity score: 8.1
Project: https://github.com/SonicFrog/abox
Published: 2021-08-25
File: src/lib.rs
Commit message: send/sync fix to prevent misuse
Commit author: JOE1994

Vulnerable version (before fix):
 impl<T: Sized> Drop for AtomicBox<T> {     } }  unsafe impl<T: Sized> Sync for AtomicBox<T> {} unsafe impl<T: Sized> Send for AtomicBox<T> {}  #[cfg(test)] mod tests {

Fixed version (after fix):
 impl<T: Sized> Drop for AtomicBox<T> {     } }  unsafe impl<T: Sized + Sync> Sync for AtomicBox<T> {} unsafe impl<T: Sized + Send> Send for AtomicBox<T> {}  #[cfg(test)] mod tests {

Patch:
patch: @@ -89,8 +89,8 @@ impl<T: Sized> Drop for AtomicBox<T> {
     }
 }
 
-unsafe impl<T: Sized> Sync for AtomicBox<T> {}
-unsafe impl<T: Sized> Send for AtomicBox<T> {}
+unsafe impl<T: Sized + Sync> Sync for AtomicBox<T> {}
+unsafe impl<T: Sized + Send> Send for AtomicBox<T> {}
 
 #[cfg(test)]
 mod tests {
path: src/lib.rs
Vulnerability: OS Command Injection in im-resize im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
Vulnerability ID: GHSA-r9vm-rhmf-7hxx
CWE: CWE-78
Severity score: 9.8
Project: https://github.com/Turistforeningen/node-im-resize
Published: 2021-04-13
File: index.js
Commit message: fix: check image arguments before processing (#19)

Regex hotfix to check for command injection
Commit author: Sam Sanoop

Vulnerable version (before fix):
 var join = require('path').join; var sprintf = require('util').format;  module.exports = function(image, output, cb) {   var cmd = module.exports.cmd(image, output);   exec(cmd, {timeout: 30000}, function(e, stdout, stderr) {     if (e) { return cb(e); }     if (stderr) { return cb(new Error(stderr)); }      return cb(null, output.versions);   }); };  /**

Fixed version (after fix):
 var join = require('path').join; var sprintf = require('util').format;  module.exports = function(image, output, cb) {   if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(image))) {     console.log('Input Validation failed, Suspicious Characters found');   } else {   var cmd = module.exports.cmd(image, output);   exec(cmd, {timeout: 30000}, function(e, stdout, stderr) {     if (e) { return cb(e); }     if (stderr) { return cb(new Error(stderr)); }      return cb(null, output.versions);   }); } };  /**

Patch:
patch: @@ -7,13 +7,17 @@ var join = require('path').join;
 var sprintf = require('util').format;
 
 module.exports = function(image, output, cb) {
+  if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(image))) {
+    console.log('Input Validation failed, Suspicious Characters found');
+  } else {
   var cmd = module.exports.cmd(image, output);
   exec(cmd, {timeout: 30000}, function(e, stdout, stderr) {
     if (e) { return cb(e); }
     if (stderr) { return cb(new Error(stderr)); }
 
     return cb(null, output.versions);
   });
+}
 };
 
 /**
path: index.js