rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type.
Vulnerability ID: CVE-2020-36324
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/wikimedia/analytics-quarry-web
Published: 2021-04-21
File: quarry/web/app.py
Commit message: SECURITY: Set correct Mime Type on /api/preferences

Prevents a Reflected Cross-Site scripting (XSS) vulnerability

Bug: T270195
Change-Id: I04bf53d2a939da369e54e91899615a3ffc3e5caf
Commit author: Reedy

Vulnerable version (before fix):
 def pref_get(key):         return "Authentication required", 401      if key in get_preferences():         return Response(json.dumps({'key': key, 'value': get_preferences()[key]}))     else:         return Response(json.dumps({'key': key, 'error': 'novalue'}))   @app.route("/api/preferences/set/<key>/<value>") def pref_set(key, value):         return "Authentication required", 401      get_preferences()[key] = (None if value == 'null' else value)     return Response(json.dumps({'key': key, 'success': ''})), 201   if __name__ == '__main__':

Fixed version (after fix):
 def pref_get(key):         return "Authentication required", 401      if key in get_preferences():         return Response(             json.dumps({'key': key, 'value': get_preferences()[key]}),             mimetype='application/json'         )     else:         return Response(             json.dumps({'key': key, 'error': 'novalue'}),             mimetype='application/json'         )   @app.route("/api/preferences/set/<key>/<value>") def pref_set(key, value):         return "Authentication required", 401      get_preferences()[key] = (None if value == 'null' else value)     return Response(         json.dumps({'key': key, 'success': ''}),         mimetype='application/json'     ), 201   if __name__ == '__main__':

Patch:
patch: @@ -398,9 +398,15 @@ def pref_get(key):
         return "Authentication required", 401
 
     if key in get_preferences():
-        return Response(json.dumps({'key': key, 'value': get_preferences()[key]}))
+        return Response(
+            json.dumps({'key': key, 'value': get_preferences()[key]}),
+            mimetype='application/json'
+        )
     else:
-        return Response(json.dumps({'key': key, 'error': 'novalue'}))
+        return Response(
+            json.dumps({'key': key, 'error': 'novalue'}),
+            mimetype='application/json'
+        )
 
 
 @app.route("/api/preferences/set/<key>/<value>")
@@ -409,7 +415,10 @@ def pref_set(key, value):
         return "Authentication required", 401
 
     get_preferences()[key] = (None if value == 'null' else value)
-    return Response(json.dumps({'key': key, 'success': ''})), 201
+    return Response(
+        json.dumps({'key': key, 'success': ''}),
+        mimetype='application/json'
+    ), 201
 
 
 if __name__ == '__main__':
path: quarry/web/app.py
Vulnerability: An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and delete actions) in the ImportController.Create method via a TempFileName field.
Vulnerability ID: CVE-2020-36364
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/smartstore/SmartStoreNET
Published: 2021-05-19
File: src/Presentation/SmartStore.Web/Administration/Controllers/ImportController.cs
Commit message: Resolves #2112 Path traversal vulnerability
Commit author: Marcus  Gesing

Vulnerable version (before fix):
 public ActionResult ProfileListDetails(int profileId)         [Permission(Permissions.Configuration.Import.Create)]         public ActionResult Create(ImportProfileModel model)         {             var importFile = Path.Combine(FileSystemHelper.TempDirTenant(), model.TempFileName.EmptyNull());              if (System.IO.File.Exists(importFile))

Fixed version (after fix):
 public ActionResult ProfileListDetails(int profileId)         [Permission(Permissions.Configuration.Import.Create)]         public ActionResult Create(ImportProfileModel model)         {             if (PathHelper.HasInvalidFileNameChars(model.TempFileName))             {                 return new HttpStatusCodeResult(HttpStatusCode.BadRequest, "Invalid file name.");             }              var importFile = Path.Combine(FileSystemHelper.TempDirTenant(), model.TempFileName.EmptyNull());              if (System.IO.File.Exists(importFile))

Patch:
patch: @@ -384,6 +384,11 @@ public ActionResult ProfileListDetails(int profileId)
         [Permission(Permissions.Configuration.Import.Create)]
         public ActionResult Create(ImportProfileModel model)
         {
+            if (PathHelper.HasInvalidFileNameChars(model.TempFileName))
+            {
+                return new HttpStatusCodeResult(HttpStatusCode.BadRequest, "Invalid file name.");
+            }
+
             var importFile = Path.Combine(FileSystemHelper.TempDirTenant(), model.TempFileName.EmptyNull());
 
             if (System.IO.File.Exists(importFile))
path: src/Presentation/SmartStore.Web/Administration/Controllers/ImportController.cs
Vulnerability: In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.
Vulnerability ID: CVE-2020-4031
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-06-22
File: server/shadow/shadow_server.c
Commit message: Fixed double free
Commit author: akallabeth

Vulnerable version (before fix):
 int shadow_server_start(rdpShadowServer* server) 		char** list = CommandLineParseCommaSeparatedValuesEx(NULL, server->ipcSocket, &count); 		if (!list || (count <= 1)) 		{ 			free(list); 			if (server->ipcSocket == NULL) 			{ 				if (!open_port(server, NULL)) 					return -1; 			} 			else 				return -1; 		}  		for (x = 1; x < count; x++)

Fixed version (after fix):
 int shadow_server_start(rdpShadowServer* server) 		char** list = CommandLineParseCommaSeparatedValuesEx(NULL, server->ipcSocket, &count); 		if (!list || (count <= 1)) 		{ 			if (server->ipcSocket == NULL) 			{ 				if (!open_port(server, NULL)) 				{ 					free(list); 					return -1; 				} 			} 			else 			{ 				free(list); 				return -1; 			} 		}  		for (x = 1; x < count; x++)

Patch:
patch: @@ -586,14 +586,19 @@ int shadow_server_start(rdpShadowServer* server)
 		char** list = CommandLineParseCommaSeparatedValuesEx(NULL, server->ipcSocket, &count);
 		if (!list || (count <= 1))
 		{
-			free(list);
 			if (server->ipcSocket == NULL)
 			{
 				if (!open_port(server, NULL))
+				{
+					free(list);
 					return -1;
+				}
 			}
 			else
+			{
+				free(list);
 				return -1;
+			}
 		}
 
 		for (x = 1; x < count; x++)
path: server/shadow/shadow_server.c
Vulnerability: In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9.
Vulnerability ID: CVE-2020-4070
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/w3c/css-validator
Published: 2020-06-22
File: org/w3c/css/css/StyleSheetParser.java
Commit message: escape also the throwable message, see #278
Commit author: Yves Lafon

Vulnerable version (before fix):
 public void parseURL(ApplContext ac, URL url, String title,         } catch (Exception e) {             Errors er = new Errors();             er.addError(new org.w3c.css.parser.CssError(Messages.escapeString(url.toString()),                     -1, e));             notifyErrors(er);         } finally {             if (doneref) {

Fixed version (after fix):
 public void parseURL(ApplContext ac, URL url, String title,         } catch (Exception e) {             Errors er = new Errors();             er.addError(new org.w3c.css.parser.CssError(Messages.escapeString(url.toString()),                     -1, new Exception(Messages.escapeString(e.getMessage()))));             notifyErrors(er);         } finally {             if (doneref) {

Patch:
patch: @@ -234,7 +234,7 @@ public void parseURL(ApplContext ac, URL url, String title,
         } catch (Exception e) {
             Errors er = new Errors();
             er.addError(new org.w3c.css.parser.CssError(Messages.escapeString(url.toString()),
-                    -1, e));
+                    -1, new Exception(Messages.escapeString(e.getMessage()))));
             notifyErrors(er);
         } finally {
             if (doneref) {
path: org/w3c/css/css/StyleSheetParser.java
Vulnerability: In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
Vulnerability ID: CVE-2020-5203
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/bcosca/fatfree-core
Published: 2020-03-11
File: base.php
Commit message: ensure misuse of clear() wont open a vulnerability
Commit author: ikkez

Vulnerable version (before fix):
 function clear($key) { 			// Reset global to default value 			$this->hive[$parts[0]]=$this->init[$parts[0]]; 		else { 			eval('unset('.$this->compile('@this->hive.'.$key).');'); 			if ($parts[0]=='SESSION') { 				session_commit(); function c($val) { 	*	@param $str string 	**/ 	function token($str) { 		$fw=$this->fw; 		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'), 			$fw->compile($str))); 		if (preg_match('/^(.+)(?<!\|)\|((?:\h*\w+(?:\h*[,;]?))+)$/s', 			$str,$parts)) { 			$str=trim($parts[1]); 			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func) 				$str=((empty($this->filter[$cmd=$func]) && 					function_exists($cmd)) || 					is_string($cmd=$this->filter($func)))?

Fixed version (after fix):
 function clear($key) { 			// Reset global to default value 			$this->hive[$parts[0]]=$this->init[$parts[0]]; 		else { 			// Ensure we have no code injection 			$key=preg_replace('/(\)\W*\w+.*$)/','',$key); 			eval('unset('.$this->compile('@this->hive.'.$key).');'); 			if ($parts[0]=='SESSION') { 				session_commit(); function c($val) { 	*	@param $str string 	**/ 	function token($str) { 		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str))); 		if (preg_match('/^(.+)(?<!\|)\|((?:\h*\w+(?:\h*[,;]?))+)$/s', 			$str,$parts)) { 			$str=trim($parts[1]); 			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func) 				$str=((empty($this->filter[$cmd=$func]) && 					function_exists($cmd)) || 					is_string($cmd=$this->filter($func)))?

Patch:
patch: @@ -503,6 +503,8 @@ function clear($key) {
 			// Reset global to default value
 			$this->hive[$parts[0]]=$this->init[$parts[0]];
 		else {
+			// Ensure we have no code injection
+			$key=preg_replace('/(\)\W*\w+.*$)/','',$key);
 			eval('unset('.$this->compile('@this->hive.'.$key).');');
 			if ($parts[0]=='SESSION') {
 				session_commit();
@@ -2963,13 +2965,11 @@ function c($val) {
 	*	@param $str string
 	**/
 	function token($str) {
-		$fw=$this->fw;
-		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'),
-			$fw->compile($str)));
+		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str)));
 		if (preg_match('/^(.+)(?<!\|)\|((?:\h*\w+(?:\h*[,;]?))+)$/s',
 			$str,$parts)) {
 			$str=trim($parts[1]);
-			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func)
+			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func)
 				$str=((empty($this->filter[$cmd=$func]) &&
 					function_exists($cmd)) ||
 					is_string($cmd=$this->filter($func)))?
path: base.php
Vulnerability: In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
Vulnerability ID: CVE-2020-5203
CWE: CWE-94
Severity score: 6.4
Project: https://github.com/bcosca/fatfree-core
Published: 2020-03-11
File: base.php
Commit message: ensure misuse of clear() wont open a vulnerability
Commit author: ikkez

Vulnerable version (before fix):
 function clear($key) { 			// Reset global to default value 			$this->hive[$parts[0]]=$this->init[$parts[0]]; 		else { 			eval('unset('.$this->compile('@this->hive.'.$key).');'); 			if ($parts[0]=='SESSION') { 				session_commit(); function c($val) { 	*	@param $str string 	**/ 	function token($str) { 		$fw=$this->fw; 		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'), 			$fw->compile($str))); 		if (preg_match('/^(.+)(?<!\|)\|((?:\h*\w+(?:\h*[,;]?))+)$/s', 			$str,$parts)) { 			$str=trim($parts[1]); 			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func) 				$str=((empty($this->filter[$cmd=$func]) && 					function_exists($cmd)) || 					is_string($cmd=$this->filter($func)))?

Fixed version (after fix):
 function clear($key) { 			// Reset global to default value 			$this->hive[$parts[0]]=$this->init[$parts[0]]; 		else { 			// Ensure we have no code injection 			$key=preg_replace('/(\)\W*\w+.*$)/','',$key); 			eval('unset('.$this->compile('@this->hive.'.$key).');'); 			if ($parts[0]=='SESSION') { 				session_commit(); function c($val) { 	*	@param $str string 	**/ 	function token($str) { 		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str))); 		if (preg_match('/^(.+)(?<!\|)\|((?:\h*\w+(?:\h*[,;]?))+)$/s', 			$str,$parts)) { 			$str=trim($parts[1]); 			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func) 				$str=((empty($this->filter[$cmd=$func]) && 					function_exists($cmd)) || 					is_string($cmd=$this->filter($func)))?

Patch:
patch: @@ -503,6 +503,8 @@ function clear($key) {
 			// Reset global to default value
 			$this->hive[$parts[0]]=$this->init[$parts[0]];
 		else {
+			// Ensure we have no code injection
+			$key=preg_replace('/(\)\W*\w+.*$)/','',$key);
 			eval('unset('.$this->compile('@this->hive.'.$key).');');
 			if ($parts[0]=='SESSION') {
 				session_commit();
@@ -2963,13 +2965,11 @@ function c($val) {
 	*	@param $str string
 	**/
 	function token($str) {
-		$fw=$this->fw;
-		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'),
-			$fw->compile($str)));
+		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str)));
 		if (preg_match('/^(.+)(?<!\|)\|((?:\h*\w+(?:\h*[,;]?))+)$/s',
 			$str,$parts)) {
 			$str=trim($parts[1]);
-			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func)
+			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func)
 				$str=((empty($this->filter[$cmd=$func]) &&
 					function_exists($cmd)) ||
 					is_string($cmd=$this->filter($func)))?
path: base.php
Vulnerability: In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is a reflected XSS on Search page with `alias` and `search` parameters. The problem is patched in 1.7.6.5
Vulnerability ID: CVE-2020-5272
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/PrestaShop/PrestaShop
Published: 2020-04-20
File: controllers/admin/AdminSearchConfController.php
Commit message: Merge pull request from GHSA-rpg3-f23r-jmqv

Escape alias and search for safe output
Commit author: GoT

Vulnerable version (before fix):
 public function processSave()             $this->errors[] = $this->trans('Aliases and results are both required.', array(), 'Admin.Shopparameters.Notification');         }         if (!Validate::isValidSearch($search)) {             $this->errors[] = $search . ' ' . $this->trans('Is not a valid result', array(), 'Admin.Shopparameters.Notification');         }         foreach ($aliases as $alias) {             if (!Validate::isValidSearch($alias)) {                 $this->errors[] = $alias . ' ' . $this->trans('Is not a valid alias', array(), 'Admin.Shopparameters.Notification');             }         } 

Fixed version (after fix):
 public function processSave()             $this->errors[] = $this->trans('Aliases and results are both required.', array(), 'Admin.Shopparameters.Notification');         }         if (!Validate::isValidSearch($search)) {             $this->errors[] = Tools::safeOutput($search) . ' ' . $this->trans('Is not a valid result', array(), 'Admin.Shopparameters.Notification');         }         foreach ($aliases as $alias) {             if (!Validate::isValidSearch($alias)) {                 $this->errors[] = Tools::safeOutput($alias) . ' ' . $this->trans('Is not a valid alias', array(), 'Admin.Shopparameters.Notification');             }         } 

Patch:
patch: @@ -391,11 +391,11 @@ public function processSave()
             $this->errors[] = $this->trans('Aliases and results are both required.', array(), 'Admin.Shopparameters.Notification');
         }
         if (!Validate::isValidSearch($search)) {
-            $this->errors[] = $search . ' ' . $this->trans('Is not a valid result', array(), 'Admin.Shopparameters.Notification');
+            $this->errors[] = Tools::safeOutput($search) . ' ' . $this->trans('Is not a valid result', array(), 'Admin.Shopparameters.Notification');
         }
         foreach ($aliases as $alias) {
             if (!Validate::isValidSearch($alias)) {
-                $this->errors[] = $alias . ' ' . $this->trans('Is not a valid alias', array(), 'Admin.Shopparameters.Notification');
+                $this->errors[] = Tools::safeOutput($alias) . ' ' . $this->trans('Is not a valid alias', array(), 'Admin.Shopparameters.Notification');
             }
         }
path: controllers/admin/AdminSearchConfController.php
Vulnerability: PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter. The problem is fixed in 3.5.0
Vulnerability ID: CVE-2020-5277
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/PrestaShop/ps_facetedsearch
Published: 2020-03-25
File: ps_facetedsearch.php
Commit message: Merge pull request from GHSA-mmmv-m5q9-g3cm

Escape url_name parameter
Commit author: GoT

Vulnerable version (before fix):
 public function checkLinksRewrite($params)                 $params['errors'][] = Tools::displayError(                     $this->trans(                         '"%s" is not a valid url',                         [$urlNameLang],                         'Modules.Facetedsearch.Admin'                     )                 );

Fixed version (after fix):
 public function checkLinksRewrite($params)                 $params['errors'][] = Tools::displayError(                     $this->trans(                         '"%s" is not a valid url',                         [Tools::safeOutput($urlNameLang, true)],                         'Modules.Facetedsearch.Admin'                     )                 );

Patch:
patch: @@ -1208,7 +1208,7 @@ public function checkLinksRewrite($params)
                 $params['errors'][] = Tools::displayError(
                     $this->trans(
                         '"%s" is not a valid url',
-                        [$urlNameLang],
+                        [Tools::safeOutput($urlNameLang, true)],
                         'Modules.Facetedsearch.Admin'
                     )
                 );
path: ps_facetedsearch.php
Vulnerability: In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is a reflected XSS on Exception page The problem is fixed in 1.7.6.5
Vulnerability ID: CVE-2020-5278
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/PrestaShop/PrestaShop
Published: 2020-04-20
File: classes/exception/PrestaShopException.php
Commit message: Merge pull request from GHSA-mrpj-67mq-3fr5

Escape exception message when rendering PrestaShopException
Commit author: GoT

Vulnerable version (before fix):
 protected function getExtendedMessage($html = true)          return sprintf(             $format,             $this->getMessage(),             $this->getLine(),             ltrim(str_replace(array(_PS_ROOT_DIR_, '\\'), array('', '/'), $this->getFile()), '/')         );

Fixed version (after fix):
 protected function getExtendedMessage($html = true)          return sprintf(             $format,             Tools::safeOutput($this->getMessage(), true),             $this->getLine(),             ltrim(str_replace(array(_PS_ROOT_DIR_, '\\'), array('', '/'), $this->getFile()), '/')         );

Patch:
patch: @@ -230,7 +230,7 @@ protected function getExtendedMessage($html = true)
 
         return sprintf(
             $format,
-            $this->getMessage(),
+            Tools::safeOutput($this->getMessage(), true),
             $this->getLine(),
             ltrim(str_replace(array(_PS_ROOT_DIR_, '\\'), array('', '/'), $this->getFile()), '/')
         );
path: classes/exception/PrestaShopException.php
Vulnerability: ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.
Vulnerability ID: CVE-2020-5283
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/viewvc/viewvc
Published: 2020-04-03
File: lib/viewvc.py
Commit message: issue #211: escape CVS subdir last-modified file name
Commit author: C. Michael Pilato

Vulnerable version (before fix):
 def view_directory(request):       if request.roottype == 'cvs' and file.rev is not None:         row.rev = None         if cfg.options.show_logs:           row.log_file = file.newest_file           row.log_rev = file.rev        if request.roottype == 'svn':

Fixed version (after fix):
 def view_directory(request):       if request.roottype == 'cvs' and file.rev is not None:         row.rev = None         if cfg.options.show_logs:           row.log_file = request.server.escape(file.newest_file)           row.log_rev = file.rev        if request.roottype == 'svn':

Patch:
patch: @@ -2412,7 +2412,7 @@ def view_directory(request):
       if request.roottype == 'cvs' and file.rev is not None:
         row.rev = None
         if cfg.options.show_logs:
-          row.log_file = file.newest_file
+          row.log_file = request.server.escape(file.newest_file)
           row.log_rev = file.rev
 
       if request.roottype == 'svn':
path: lib/viewvc.py
Vulnerability: In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter. The problem is fixed in 1.7.6.5
Vulnerability ID: CVE-2020-5285
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/PrestaShop/PrestaShop
Published: 2020-04-20
File: src/PrestaShopBundle/Twig/Extension/PathWithBackUrlExtension.php
Commit message: Merge pull request from GHSA-j3r6-33hf-m8wh

Do not use useless is_safe_callback option, auto escape the extension's result
Commit author: GoT

Vulnerable version (before fix):
 public function getFunctions()         return [             new TwigFunction(                 'pathWithBackUrl',                 [$this, 'getPathWithBackUrl'],                 ['is_safe_callback' => [$this->routingExtension, 'isUrlGenerationSafe']]             ),         ];     }

Fixed version (after fix):
 public function getFunctions()         return [             new TwigFunction(                 'pathWithBackUrl',                 [$this, 'getPathWithBackUrl']             ),         ];     }

Patch:
patch: @@ -75,8 +75,7 @@ public function getFunctions()
         return [
             new TwigFunction(
                 'pathWithBackUrl',
-                [$this, 'getPathWithBackUrl'],
-                ['is_safe_callback' => [$this->routingExtension, 'isUrlGenerationSafe']]
+                [$this, 'getPathWithBackUrl']
             ),
         ];
     }
path: src/PrestaShopBundle/Twig/Extension/PathWithBackUrlExtension.php