rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Unauthenticated SQL Injection in Cachet ### Impact
In Cachet versions through 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session.

### Patches

The original repository of [https://github.com/CachetHQ/Cachet](https://github.com/CachetHQ/Cachet) is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected. 

Update to version 2.5 or later in the [https://github.com/fiveai/Cachet fork](https://github.com/fiveai/Cachet) to fix this vulnerability.
Vulnerability ID: GHSA-79mg-4w23-4fqc
CWE: CWE-287
Severity score: 8.1
Project: https://github.com/fiveai/Cachet
Published: 2021-08-30
File: app/Models/Traits/SearchableTrait.php
Commit message: Ensure only allowed searchable columns are used in DB Query
Commit author: Seb Dangerfield

Vulnerable version (before fix):
 public function scopeSearch(Builder $query, array $search = [])             return $query;         }          if (!array_intersect(array_keys($search), $this->searchable)) {             return $query;         }          return $query->where($search);     } }

Fixed version (after fix):
 public function scopeSearch(Builder $query, array $search = [])             return $query;         }          $allowed_search = array_intersect_key($search, array_flip($this->searchable));         if (! $allowed_search) {             return $query;         }          return $query->where($allowed_search);     } }

Patch:
patch: @@ -34,10 +34,11 @@ public function scopeSearch(Builder $query, array $search = [])
             return $query;
         }
 
-        if (!array_intersect(array_keys($search), $this->searchable)) {
+        $allowed_search = array_intersect_key($search, array_flip($this->searchable));
+        if (! $allowed_search) {
             return $query;
         }
 
-        return $query->where($search);
+        return $query->where($allowed_search);
     }
 }
path: app/Models/Traits/SearchableTrait.php
Vulnerability: Unauthenticated SQL Injection in Cachet ### Impact
In Cachet versions through 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session.

### Patches

The original repository of [https://github.com/CachetHQ/Cachet](https://github.com/CachetHQ/Cachet) is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected. 

Update to version 2.5 or later in the [https://github.com/fiveai/Cachet fork](https://github.com/fiveai/Cachet) to fix this vulnerability.
Vulnerability ID: GHSA-79mg-4w23-4fqc
CWE: CWE-89
Severity score: 8.1
Project: https://github.com/fiveai/Cachet
Published: 2021-08-30
File: app/Models/Traits/SearchableTrait.php
Commit message: Ensure only allowed searchable columns are used in DB Query
Commit author: Seb Dangerfield

Vulnerable version (before fix):
 public function scopeSearch(Builder $query, array $search = [])             return $query;         }          if (!array_intersect(array_keys($search), $this->searchable)) {             return $query;         }          return $query->where($search);     } }

Fixed version (after fix):
 public function scopeSearch(Builder $query, array $search = [])             return $query;         }          $allowed_search = array_intersect_key($search, array_flip($this->searchable));         if (! $allowed_search) {             return $query;         }          return $query->where($allowed_search);     } }

Patch:
patch: @@ -34,10 +34,11 @@ public function scopeSearch(Builder $query, array $search = [])
             return $query;
         }
 
-        if (!array_intersect(array_keys($search), $this->searchable)) {
+        $allowed_search = array_intersect_key($search, array_flip($this->searchable));
+        if (! $allowed_search) {
             return $query;
         }
 
-        return $query->where($search);
+        return $query->where($allowed_search);
     }
 }
path: app/Models/Traits/SearchableTrait.php
Vulnerability: Regular expression denial of service in react-native A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
Vulnerability ID: GHSA-7f53-fmmv-mfjv
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/facebook/react-native
Published: 2021-07-20
File: Libraries/Blob/URL.js
Commit message: Update validateBaseUrl to use latest regex

Summary:
Updating the regex to avoid a potential regular expression denial-of-service vulnerability.

Changelog: Update validateBaseUrl to use a more robust regular expression. Fixes CVE-2020-1920, GHSL-2020-293

Reviewed By: lunaleaps

Differential Revision: D25507604

fbshipit-source-id: c36a03c456881bc655c861e1a2c5cd41a7127c9d
Commit author: Neal Poole

Vulnerable version (before fix):
 export class URLSearchParams {  function validateBaseUrl(url: string) {   // from this MIT-licensed gist: https://gist.github.com/dperini/729294   return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,}))?)(?::\d{2,5})?(?:[/?#]\S*)?$/i.test(     url,   ); }

Fixed version (after fix):
 export class URLSearchParams {  function validateBaseUrl(url: string) {   // from this MIT-licensed gist: https://gist.github.com/dperini/729294   return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)*(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/.test(     url,   ); }

Patch:
patch: @@ -107,7 +107,7 @@ export class URLSearchParams {
 
 function validateBaseUrl(url: string) {
   // from this MIT-licensed gist: https://gist.github.com/dperini/729294
-  return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,}))?)(?::\d{2,5})?(?:[/?#]\S*)?$/i.test(
+  return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)*(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/.test(
     url,
   );
 }
path: Libraries/Blob/URL.js
Vulnerability: Improper Authenication in Pion DTLS handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.
Vulnerability ID: GHSA-7gfg-6934-mqq2
CWE: CWE-287
Severity score: 5.6
Project: https://github.com/pion/dtls
Published: 2021-06-29
File: conn.go
Commit message: Assert that ApplicationData has epoch != 0

Otherwise we may accept unencrypted/unauthenticated ApplicationData
from a remote
Commit author: Sean DuBois

Vulnerable version (before fix):
 func (c *Conn) handleIncomingPacket(buf []byte) (*alert, error) { 		c.log.Trace("<- ChangeCipherSpec") 		c.setRemoteEpoch(c.getRemoteEpoch() + 1) 	case *applicationData: 		c.decrypted <- content.data 	default: 		return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("unhandled contentType %d", content.contentType())

Fixed version (after fix):
 func (c *Conn) handleIncomingPacket(buf []byte) (*alert, error) { 		c.log.Trace("<- ChangeCipherSpec") 		c.setRemoteEpoch(c.getRemoteEpoch() + 1) 	case *applicationData: 		if h.epoch == 0 { 			return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("ApplicationData with epoch of 0") 		}  		c.decrypted <- content.data 	default: 		return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("unhandled contentType %d", content.contentType())

Patch:
patch: @@ -559,6 +559,10 @@ func (c *Conn) handleIncomingPacket(buf []byte) (*alert, error) {
 		c.log.Trace("<- ChangeCipherSpec")
 		c.setRemoteEpoch(c.getRemoteEpoch() + 1)
 	case *applicationData:
+		if h.epoch == 0 {
+			return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("ApplicationData with epoch of 0")
+		}
+
 		c.decrypted <- content.data
 	default:
 		return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("unhandled contentType %d", content.contentType())
path: conn.go
Vulnerability: XSS in hello.js This affects the package hello.js before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).
Vulnerability ID: GHSA-7jh9-6cpf-h4m7
CWE: CWE-79
Severity score: 0
Project: https://github.com/MrSwitch/hello.js
Published: 2021-01-13
File: src/hello.js
Commit message: fix(xss): oauth_redirect should be a valid url
Commit author: Andrew Dodson

Vulnerable version (before fix):
 hello.utils.extend(hello.utils, { 		// (URI Fragments within 302 Location URI are lost over HTTPS) 		// Loading the redirect.html before triggering the OAuth Flow seems to fix it. 		else if ('oauth_redirect' in p) {  			location.assign(decodeURIComponent(p.oauth_redirect)); 			return; 		} 

Fixed version (after fix):
 hello.utils.extend(hello.utils, { 		// (URI Fragments within 302 Location URI are lost over HTTPS) 		// Loading the redirect.html before triggering the OAuth Flow seems to fix it. 		else if ('oauth_redirect' in p) { 			var url = decodeURIComponent(p.oauth_redirect);  			if (isValidUrl(url)) { 				location.assign(url); 			}  			return; 		} 

Patch:
patch: @@ -1388,8 +1388,12 @@ hello.utils.extend(hello.utils, {
 		// (URI Fragments within 302 Location URI are lost over HTTPS)
 		// Loading the redirect.html before triggering the OAuth Flow seems to fix it.
 		else if ('oauth_redirect' in p) {
+			var url = decodeURIComponent(p.oauth_redirect);
+
+			if (isValidUrl(url)) {
+				location.assign(url);
+			}
 
-			location.assign(decodeURIComponent(p.oauth_redirect));
 			return;
 		}
path: src/hello.js
Vulnerability: Cross site scripting in three.js # CVE has been withdrawn

Versions of three.js prior to 0.137.0 load untrusted iframes and allow for attackers to inject arbitrary javascript into a users browser.
Vulnerability ID: GHSA-7vvq-7r29-5vg3
CWE: CWE-79
Severity score: 7.1
Project: https://github.com/mrdoob/three.js
Published: 2022-01-27
File: docs/index.html
Commit message: Only load trusted iframe (#23245)
Commit author: Rohan Sharma

Vulnerable version (before fix):
 <h1><a href="https://threejs.org">three.js</a></h1> 			const oldIframe = iframe; 			iframe = oldIframe.cloneNode();  			if ( hash ) {  				iframe.src = splitHash[ 0 ] + '.html' + splitHash[ 1 ]; 				subtitle = titles[ splitHash[ 0 ] ] + splitHash[ 1 ] + ' – ';

Fixed version (after fix):
 <h1><a href="https://threejs.org">three.js</a></h1> 			const oldIframe = iframe; 			iframe = oldIframe.cloneNode();  			if ( hash && titles[ splitHash[ 0 ] ] ) {  				iframe.src = splitHash[ 0 ] + '.html' + splitHash[ 1 ]; 				subtitle = titles[ splitHash[ 0 ] ] + splitHash[ 1 ] + ' – ';

Patch:
patch: @@ -498,7 +498,7 @@ <h1><a href="https://threejs.org">three.js</a></h1>
 			const oldIframe = iframe;
 			iframe = oldIframe.cloneNode();
 
-			if ( hash ) {
+			if ( hash && titles[ splitHash[ 0 ] ] ) {
 
 				iframe.src = splitHash[ 0 ] + '.html' + splitHash[ 1 ];
 				subtitle = titles[ splitHash[ 0 ] ] + splitHash[ 1 ] + ' – ';
path: docs/index.html
Vulnerability: Exposure of Sensitive Information to an Unauthorized Actor in microweber Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
Vulnerability ID: GHSA-7wv8-g97r-432h
CWE: CWE-200
Severity score: 7.5
Project: https://github.com/microweber/microweber
Published: 2022-01-21
File: src/MicroweberPackages/User/helpers/api_user.php
Commit message: search_authors only admins
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
  });  api_expose('users/search_authors', function ($params = false) {      $return = array();      $kw = false;     if (isset($params['kw'])) {

Fixed version (after fix):
  });  api_expose_admin('users/search_authors', function ($params = false) {      $return = array();       $kw = false;     if (isset($params['kw'])) {

Patch:
patch: @@ -63,9 +63,9 @@
 
 });
 
-api_expose('users/search_authors', function ($params = false) {
+api_expose_admin('users/search_authors', function ($params = false) {
 
-    $return = array();
+    $return = array(); 
 
     $kw = false;
     if (isset($params['kw'])) {
path: src/MicroweberPackages/User/helpers/api_user.php
Vulnerability: Cross-Site Request Forgery in microweber microweber version 1.2.10 and prior is vulnerable to cross-site request forgery.
Vulnerability ID: GHSA-7x2h-3v2v-24p9
CWE: CWE-352
Severity score: 6.5
Project: https://github.com/microweber/microweber
Published: 2022-02-09
File: src/MicroweberPackages/Content/routes/api.php
Commit message: Update api.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
          Route::post('content/delete', function (\Illuminate\Http\Request $request) {             return mw()->content_manager->helpers->delete($request->all());         });          Route::get('content/get_link_admin', function (\Illuminate\Http\Request $request) { 

Fixed version (after fix):
          Route::post('content/delete', function (\Illuminate\Http\Request $request) {             return mw()->content_manager->helpers->delete($request->all());         });           Route::get('content/get_link_admin', function (\Illuminate\Http\Request $request) { 

Patch:
patch: @@ -75,7 +75,7 @@
 
         Route::post('content/delete', function (\Illuminate\Http\Request $request) {
             return mw()->content_manager->helpers->delete($request->all());
-        });
+        }); 
 
         Route::get('content/get_link_admin', function (\Illuminate\Http\Request $request) {
path: src/MicroweberPackages/Content/routes/api.php
Vulnerability: Cross-site Scripting in ShowDoc ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability ID: GHSA-82j4-vr25-x394
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/star7th/showdoc
Published: 2022-03-15
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: Merge pull request #1629 from ajaysenr/master

Update AttachmentModel.class.php
Commit author: star7th

Vulnerable version (before fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , "%") 			|| $isDangerStr($filename , ".xml") 			|| $isDangerStr($filename , ".xxhtml") 		) { 			return true; 		}

Fixed version (after fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , "%") 			|| $isDangerStr($filename , ".xml") 			|| $isDangerStr($filename , ".xxhtml") 			|| $isDangerStr($filename , ".aspx")			 		) { 			return true; 		}

Patch:
patch: @@ -304,6 +304,7 @@ public function isDangerFilename($filename){
 			|| $isDangerStr($filename , "%")
 			|| $isDangerStr($filename , ".xml")
 			|| $isDangerStr($filename , ".xxhtml")
+			|| $isDangerStr($filename , ".aspx")			
 		) {
 			return true;
 		}
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: ReDoS in brace-expansion Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition.

## Proof of Concept

```
var expand = require('brace-expansion');
expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}');
```


## Recommendation

Update to version 1.1.7 or later.
Vulnerability ID: GHSA-832h-xg76-4gv6
CWE: CWE-20
Severity score: 7.5
Project: https://github.com/juliangruber/brace-expansion
Published: 2018-01-29
File: index.js
Commit message: fix bug in https://github.com/juliangruber/brace-expansion/issues/33
Commit author: mengyuan.ymy

Vulnerable version (before fix):
 function expand(str, isTop) {   var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);   var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);   var isSequence = isNumericSequence || isAlphaSequence;   var isOptions = /^(.*,)+(.+)?$/.test(m.body);   if (!isSequence && !isOptions) {     // {a},b}     if (m.post.match(/,.*\}/)) {

Fixed version (after fix):
 function expand(str, isTop) {   var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);   var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);   var isSequence = isNumericSequence || isAlphaSequence;   var isOptions = m.body.indexOf(',') >= 0;   if (!isSequence && !isOptions) {     // {a},b}     if (m.post.match(/,.*\}/)) {

Patch:
patch: @@ -106,7 +106,7 @@ function expand(str, isTop) {
   var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
   var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
   var isSequence = isNumericSequence || isAlphaSequence;
-  var isOptions = /^(.*,)+(.+)?$/.test(m.body);
+  var isOptions = m.body.indexOf(',') >= 0;
   if (!isSequence && !isOptions) {
     // {a},b}
     if (m.post.match(/,.*\}/)) {
path: index.js
Vulnerability: Out-of-bounds Read in OpenCV In OpenCV 3.3.1 (corresponding with OpenCV-Python 3.3.1.11), a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.
Vulnerability ID: GHSA-83rh-hx5x-q9p5
CWE: CWE-125
Severity score: 7.5
Project: https://github.com/opencv/opencv
Published: 2021-10-12
File: modules/imgcodecs/src/grfmt_hdr.cpp
Commit message: imgproc(hdr): fix bounds check in HdrDecoder::checkSignature()
Commit author: Alexander Alekhin

Vulnerable version (before fix):
 bool HdrDecoder::readData(Mat& _img)  bool HdrDecoder::checkSignature( const String& signature ) const {     if(signature.size() >= m_signature.size() &&        (!memcmp(signature.c_str(), m_signature.c_str(), m_signature.size()) ||        !memcmp(signature.c_str(), m_signature_alt.c_str(), m_signature_alt.size())))        return true;     return false; } 

Fixed version (after fix):
 bool HdrDecoder::readData(Mat& _img)  bool HdrDecoder::checkSignature( const String& signature ) const {     if (signature.size() >= m_signature.size() &&         0 == memcmp(signature.c_str(), m_signature.c_str(), m_signature.size())     )         return true;     if (signature.size() >= m_signature_alt.size() &&         0 == memcmp(signature.c_str(), m_signature_alt.c_str(), m_signature_alt.size())     )         return true;     return false; } 

Patch:
patch: @@ -101,10 +101,14 @@ bool HdrDecoder::readData(Mat& _img)
 
 bool HdrDecoder::checkSignature( const String& signature ) const
 {
-    if(signature.size() >= m_signature.size() &&
-       (!memcmp(signature.c_str(), m_signature.c_str(), m_signature.size()) ||
-       !memcmp(signature.c_str(), m_signature_alt.c_str(), m_signature_alt.size())))
-       return true;
+    if (signature.size() >= m_signature.size() &&
+        0 == memcmp(signature.c_str(), m_signature.c_str(), m_signature.size())
+    )
+        return true;
+    if (signature.size() >= m_signature_alt.size() &&
+        0 == memcmp(signature.c_str(), m_signature_alt.c_str(), m_signature_alt.size())
+    )
+        return true;
     return false;
 }
path: modules/imgcodecs/src/grfmt_hdr.cpp
Vulnerability: Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks APKLeaks prior to v2.0.4 allows remote authenticated attackers to execute arbitrary OS commands via package name inside the application manifest.

### Impact

An authenticated attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified, or could cause other unintended behavior through malicious package names.


### References

- a966e781499ff6fd4eea66876d7532301b13a382

### For more information

If you have any questions or comments about this advisory:
* Email me at [me@dw1.io](mailto:me@dw1.io)
Vulnerability ID: GHSA-8434-v7xw-8m9x
CWE: CWE-78
Severity score: 9.3
Project: https://github.com/dwisiswant0/apkleaks
Published: 2022-01-21
File: apkleaks/apkleaks.py
Commit message: Escapes decompiling arguments
Commit author: Dwi Siswanto

Vulnerable version (before fix):
 from apkleaks.colors import clr from contextlib import closing from distutils.spawn import find_executable from pyaxmlparser import APK from urllib.request import urlopen from zipfile import ZipFile def decompile(self): 					classes.write(zipped.read("classes.dex")) 			except Exception as e: 				sys.exit(self.writeln(str(e), clr.WARNING)) 		dec = "%s %s -d %s --deobf" % (self.jadx, dex, self.tempdir) 		os.system(dec) 		return self.tempdir  	def unique(self, list): 

Fixed version (after fix):
 from apkleaks.colors import clr from contextlib import closing from distutils.spawn import find_executable from pipes import quote from pyaxmlparser import APK from urllib.request import urlopen from zipfile import ZipFile def decompile(self): 					classes.write(zipped.read("classes.dex")) 			except Exception as e: 				sys.exit(self.writeln(str(e), clr.WARNING)) 		args = [self.jadx, dex, "-d", self.tempdir, "--deobf"] 		comm = "%s" % (" ".join(quote(arg) for arg in args)) 		os.system(comm) 		return self.tempdir  	def unique(self, list): 

Patch:
patch: @@ -2,6 +2,7 @@
 from apkleaks.colors import clr
 from contextlib import closing
 from distutils.spawn import find_executable
+from pipes import quote
 from pyaxmlparser import APK
 from urllib.request import urlopen
 from zipfile import ZipFile
@@ -84,8 +85,9 @@ def decompile(self):
 					classes.write(zipped.read("classes.dex"))
 			except Exception as e:
 				sys.exit(self.writeln(str(e), clr.WARNING))
-		dec = "%s %s -d %s --deobf" % (self.jadx, dex, self.tempdir)
-		os.system(dec)
+		args = [self.jadx, dex, "-d", self.tempdir, "--deobf"]
+		comm = "%s" % (" ".join(quote(arg) for arg in args))
+		os.system(comm)
 		return self.tempdir
 
 	def unique(self, list):
path: apkleaks/apkleaks.py