rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Cross-site Scripting in Pimcore Pimcore prior to version 10.2.10 contains a cross-site scripting vulnerability.
Vulnerability ID: GHSA-f7q6-xxph-mfm8
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/pimcore/pimcore
Published: 2022-01-27
File: models/DataObject/ClassDefinition/Service.php
Commit message: disallow html entity names on import - follow up to #11217
Commit author: Divesh

Vulnerable version (before fix):
 public static function generateLayoutTreeFromArray($array, $throwException = fal     {         if (is_array($array) && count($array) > 0) {             if ($name = $array['name'] ?? false) {                 $sanitizedName = htmlentities($name);                 if ($sanitizedName !== $name) {                     throw new \Exception('not a valid name:' . htmlentities($name));                 }             }             /** @var LoaderInterface $loader */             $loader = \Pimcore::getContainer()->get('pimcore.implementation_loader.object.' . $array['datatype']); 

Fixed version (after fix):
 public static function generateLayoutTreeFromArray($array, $throwException = fal     {         if (is_array($array) && count($array) > 0) {             if ($name = $array['name'] ?? false) {                 if (preg_match('/<.+?>/', $name)) {                     throw new \Exception('not a valid name:' . htmlentities($name));                 }             }              /** @var LoaderInterface $loader */             $loader = \Pimcore::getContainer()->get('pimcore.implementation_loader.object.' . $array['datatype']); 

Patch:
patch: @@ -315,11 +315,11 @@ public static function generateLayoutTreeFromArray($array, $throwException = fal
     {
         if (is_array($array) && count($array) > 0) {
             if ($name = $array['name'] ?? false) {
-                $sanitizedName = htmlentities($name);
-                if ($sanitizedName !== $name) {
+                if (preg_match('/<.+?>/', $name)) {
                     throw new \Exception('not a valid name:' . htmlentities($name));
                 }
             }
+
             /** @var LoaderInterface $loader */
             $loader = \Pimcore::getContainer()->get('pimcore.implementation_loader.object.' . $array['datatype']);
path: models/DataObject/ClassDefinition/Service.php
Vulnerability: Prototype Pollution in locutus All versions of package locutus prior to version 2.0.12 are vulnerable to Prototype Pollution via the php.strings.parse_str function.
Vulnerability ID: GHSA-f98m-q3hr-p5wq
CWE: CWE-20
Severity score: 9.8
Project: https://github.com/locutusjs/locutus
Published: 2021-05-06
File: src/php/strings/parse_str.js
Commit message: fixed prototype pollution
Commit author: Asjid Kalam

Vulnerable version (before fix):
 module.exports = function parse_str (str, array) { // eslint-disable-line camelc     key = _fixStr(tmp[0])     value = (tmp.length < 2) ? '' : _fixStr(tmp[1])      while (key.charAt(0) === ' ') {       key = key.slice(1)     }

Fixed version (after fix):
 module.exports = function parse_str (str, array) { // eslint-disable-line camelc     key = _fixStr(tmp[0])     value = (tmp.length < 2) ? '' : _fixStr(tmp[1])      if (key.includes('__proto__') || key.includes('constructor') || key.includes('prototype')) {       break;     }      while (key.charAt(0) === ' ') {       key = key.slice(1)     }

Patch:
patch: @@ -74,6 +74,10 @@ module.exports = function parse_str (str, array) { // eslint-disable-line camelc
     key = _fixStr(tmp[0])
     value = (tmp.length < 2) ? '' : _fixStr(tmp[1])
 
+    if (key.includes('__proto__') || key.includes('constructor') || key.includes('prototype')) {
+      break;
+    }
+
     while (key.charAt(0) === ' ') {
       key = key.slice(1)
     }
path: src/php/strings/parse_str.js
Vulnerability: Cross-site Scripting in Gogs ### Impact

The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations [allow uploading SVG (`text/xml`) files as issue attachments (non-default)](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284) are affected.

### Patches

Correctly setting the Content Security Policy for the serving endpoint. Users should upgrade to 0.12.7 or the latest 0.13.0+dev.

### Workarounds

[Disable uploading SVG files (`text/xml`) as issue attachments](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284).

### References

https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6919.
Vulnerability ID: GHSA-ff28-f46g-r9g8
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/gogs/gogs
Published: 2022-05-24
File: internal/cmd/web.go
Commit message: attachment: set CSP header in the serving endpoint (#6926)
Commit author: Joe Chen

Vulnerable version (before fix):
 func runWeb(c *cli.Context) error { 				} 				defer fr.Close()  				c.Header().Set("Cache-Control", "public,max-age=86400") 				c.Header().Set("Content-Disposition", fmt.Sprintf(`inline; filename="%s"`, attach.Name)) 

Fixed version (after fix):
 func runWeb(c *cli.Context) error { 				} 				defer fr.Close()  				c.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox") 				c.Header().Set("Cache-Control", "public,max-age=86400") 				c.Header().Set("Content-Disposition", fmt.Sprintf(`inline; filename="%s"`, attach.Name)) 

Patch:
patch: @@ -314,6 +314,7 @@ func runWeb(c *cli.Context) error {
 				}
 				defer fr.Close()
 
+				c.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox")
 				c.Header().Set("Cache-Control", "public,max-age=86400")
 				c.Header().Set("Content-Disposition", fmt.Sprintf(`inline; filename="%s"`, attach.Name))
path: internal/cmd/web.go
Vulnerability: Improper Authentication in Apache Airflow The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue only affects Apache Airflow 2.0.0.
Vulnerability ID: GHSA-fh37-cx83-q542
CWE: CWE-287
Severity score: 5.3
Project: https://github.com/apache/airflow
Published: 2021-06-18
File: airflow/www/api/experimental/endpoints.py
Commit message: Add authentication to lineage endpoint for experimental API (#13870)

(cherry picked from commit 24a54242d56058846c7978130b3f37ca045d5142)
Commit author: Ian Carroll

Vulnerable version (before fix):
 def delete_pool(name):   @api_experimental.route('/lineage/<string:dag_id>/<string:execution_date>', methods=['GET']) def get_lineage(dag_id: str, execution_date: str):     """Get Lineage details for a DagRun"""     # Convert string datetime into actual datetime

Fixed version (after fix):
 def delete_pool(name):   @api_experimental.route('/lineage/<string:dag_id>/<string:execution_date>', methods=['GET']) @requires_authentication def get_lineage(dag_id: str, execution_date: str):     """Get Lineage details for a DagRun"""     # Convert string datetime into actual datetime

Patch:
patch: @@ -389,6 +389,7 @@ def delete_pool(name):
 
 
 @api_experimental.route('/lineage/<string:dag_id>/<string:execution_date>', methods=['GET'])
+@requires_authentication
 def get_lineage(dag_id: str, execution_date: str):
     """Get Lineage details for a DagRun"""
     # Convert string datetime into actual datetime
path: airflow/www/api/experimental/endpoints.py
Vulnerability: Command Injection in systeminformation ### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to `is.services()`, `is.inetChecksite()`, `si.inetLatency()`, `si.networkStats()`, `is.services()` and `si.processLoad()`

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation)
Vulnerability ID: GHSA-fj59-f6c3-3vw4
CWE: CWE-78
Severity score: 5.9
Project: https://github.com/sebhildebrandt/systeminformation
Published: 2020-10-27
File: lib/util.js
Commit message: improved shell sanitation
Commit author: Sebastian Hildebrandt

Vulnerable version (before fix):
 function sanitizeShellString(str) {   result = result.replace(/\$/g, "");   result = result.replace(/#/g, "");   result = result.replace(/\\/g, "");   return result } 

Fixed version (after fix):
 function sanitizeShellString(str) {   result = result.replace(/\$/g, "");   result = result.replace(/#/g, "");   result = result.replace(/\\/g, "");   result = result.replace(/\t/g, "");   result = result.replace(/\n/g, "");   result = result.replace(/\"/g, "");   return result } 

Patch:
patch: @@ -503,6 +503,9 @@ function sanitizeShellString(str) {
   result = result.replace(/\$/g, "");
   result = result.replace(/#/g, "");
   result = result.replace(/\\/g, "");
+  result = result.replace(/\t/g, "");
+  result = result.replace(/\n/g, "");
+  result = result.replace(/\"/g, "");
   return result
 }
path: lib/util.js
Vulnerability: Undertow vulnerable to memory exhaustion due to buffer leak Buffer leak on incoming WebSocket PONG message(s) in Undertow before 2.0.40 and 2.2.10 can lead to memory exhaustion and allow a denial of service.
Vulnerability ID: GHSA-fj7c-vg2v-ccrm
CWE: CWE-400
Severity score: 0
Project: https://github.com/undertow-io/undertow
Published: 2022-07-15
File: websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java
Commit message: [UNDERTOW-1935] - buffer leak on incoming websocket PONG message
Commit author: Andrey Marinchuk

Vulnerable version (before fix):
 public void run() {                     }                 }             });         }     } 

Fixed version (after fix):
 public void run() {                     }                 }             });         } else {             bufferedBinaryMessage.getData().free();         }     } 

Patch:
patch: @@ -152,6 +152,8 @@ public void run() {
                     }
                 }
             });
+        } else {
+            bufferedBinaryMessage.getData().free();
         }
     }
path: websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java
Vulnerability: Cross-Site Scripting in jquery-mobile All version of `jquery-mobile` are vulnerable to Cross-Site Scripting. The package checks for content in `location.hash` and if a URL is found it does an XmlHttpRequest (XHR) to the URL and renders the response with `innerHTML`. It fails to validate the `Content-Type` of the response, allowing attackers to include malicious payloads as part of query parameters that are reflected back to the user. A response such as `{"q":"<iframe/src='javascript:alert(1)'></iframe>","results":[]}` would be parsed as HTML and the JavaScript payload executed.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability ID: GHSA-fj93-7wm4-8x2g
CWE: CWE-79
Severity score: 0
Project: https://github.com/jquery/jquery-mobile
Published: 2020-09-02
File: js/widgets/pagecontainer.js
Commit message: Check Content-Type header before parsing AJAX response as HTML (#8649)

Fix for issue #8640 (possible XSS vulnerability)
Commit author: Denis Ryabov

Vulnerable version (before fix):
 $.widget( "mobile.pagecontainer", {  		return $.proxy( function( html, textStatus, xhr ) {  			// Pre-parse html to check for a data-url, use it as the new fileUrl, base path, etc 			var content, 

Fixed version (after fix):
 $.widget( "mobile.pagecontainer", {  		return $.proxy( function( html, textStatus, xhr ) {  			// Check that Content-Type is "text/html" (https://github.com/jquery/jquery-mobile/issues/8640) 			if ( !/^text\/html\b/.test( xhr.getResponseHeader('Content-Type') ) ) { 				// Display error message for unsupported content type 				if ( settings.showLoadMsg ) { 					this._showError(); 				} 				return; 			}  			// Pre-parse html to check for a data-url, use it as the new fileUrl, base path, etc 			var content, 

Patch:
patch: @@ -564,6 +564,15 @@ $.widget( "mobile.pagecontainer", {
 
 		return $.proxy( function( html, textStatus, xhr ) {
 
+			// Check that Content-Type is "text/html" (https://github.com/jquery/jquery-mobile/issues/8640)
+			if ( !/^text\/html\b/.test( xhr.getResponseHeader('Content-Type') ) ) {
+				// Display error message for unsupported content type
+				if ( settings.showLoadMsg ) {
+					this._showError();
+				}
+				return;
+			}
+
 			// Pre-parse html to check for a data-url, use it as the new fileUrl, base path, etc
 			var content,
path: js/widgets/pagecontainer.js
Vulnerability: Electron protocol handler browser vulnerable to Command Injection Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
Vulnerability ID: GHSA-fjqr-fx3f-g4rv
CWE: CWE-78
Severity score: 8.8
Project: https://github.com/electron/electron
Published: 2018-03-26
File: atom/app/command_line_args.cc
Commit message: Use case-insensitive switch comparisons
Commit author: Samuel Attard

Vulnerable version (before fix):
 bool IsBlacklistedArg(const base::CommandLine::CharType* arg) {    if (prefix_length > 0) {     a += prefix_length;     std::string switch_name(a, strcspn(a, "="));     auto* iter = std::lower_bound(std::begin(kBlacklist), std::end(kBlacklist),                                   switch_name);     if (iter != std::end(kBlacklist) && switch_name == *iter) {

Fixed version (after fix):
 bool IsBlacklistedArg(const base::CommandLine::CharType* arg) {    if (prefix_length > 0) {     a += prefix_length;     std::string switch_name =         base::ToLowerASCII(base::StringPiece(a, strcspn(a, "=")));     auto* iter = std::lower_bound(std::begin(kBlacklist), std::end(kBlacklist),                                   switch_name);     if (iter != std::end(kBlacklist) && switch_name == *iter) {

Patch:
patch: @@ -1390,7 +1390,8 @@ bool IsBlacklistedArg(const base::CommandLine::CharType* arg) {
 
   if (prefix_length > 0) {
     a += prefix_length;
-    std::string switch_name(a, strcspn(a, "="));
+    std::string switch_name =
+        base::ToLowerASCII(base::StringPiece(a, strcspn(a, "=")));
     auto* iter = std::lower_bound(std::begin(kBlacklist), std::end(kBlacklist),
                                   switch_name);
     if (iter != std::end(kBlacklist) && switch_name == *iter) {
path: atom/app/command_line_args.cc
Vulnerability: Potential double free of buffer during string decoding ### Impact
_What kind of vulnerability is it? Who is impacted?_

When an error occurs while reallocating the buffer for string decoding, the buffer gets freed twice.

Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Users should upgrade to UltraJSON 5.4.0.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

There is no workaround.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [UltraJSON](http://github.com/ultrajson/ultrajson/issues)
Vulnerability ID: GHSA-fm67-cv37-96ff
CWE: CWE-415
Severity score: 5.9
Project: https://github.com/ultrajson/ultrajson
Published: 2022-07-05
File: lib/ultrajsondec.c
Commit message: Merge pull request from GHSA-fm67-cv37-96ff

Fix double free on string decoding if realloc fails
Commit author: Hugo van Kemenade

Vulnerable version (before fix):
 static FASTCALL_ATTR JSOBJ FASTCALL_MSVC decode_string ( struct DecoderState *ds       escStart = (JSUINT32 *)ds->dec->realloc(ds->escStart, newSize * sizeof(JSUINT32));       if (!escStart)       {         ds->dec->free(ds->escStart);         return SetError(ds, -1, "Could not reserve memory block");       }       ds->escStart = escStart;

Fixed version (after fix):
 static FASTCALL_ATTR JSOBJ FASTCALL_MSVC decode_string ( struct DecoderState *ds       escStart = (JSUINT32 *)ds->dec->realloc(ds->escStart, newSize * sizeof(JSUINT32));       if (!escStart)       {         // Don't free ds->escStart here; it gets handled in JSON_DecodeObject.         return SetError(ds, -1, "Could not reserve memory block");       }       ds->escStart = escStart;

Patch:
patch: @@ -384,7 +384,7 @@ static FASTCALL_ATTR JSOBJ FASTCALL_MSVC decode_string ( struct DecoderState *ds
       escStart = (JSUINT32 *)ds->dec->realloc(ds->escStart, newSize * sizeof(JSUINT32));
       if (!escStart)
       {
-        ds->dec->free(ds->escStart);
+        // Don't free ds->escStart here; it gets handled in JSON_DecodeObject.
         return SetError(ds, -1, "Could not reserve memory block");
       }
       ds->escStart = escStart;
path: lib/ultrajsondec.c
Vulnerability: Data race in ruspiro-singleton `Singleton<T>` is meant to be a static object that can be initialized lazily. In
order to satisfy the requirement that `static` items must implement `Sync`,
`Singleton` implemented both `Sync` and `Send` unconditionally.

This allows for a bug where non-`Sync` types such as `Cell` can be used in
singletons and cause data races in concurrent programs.

The flaw was corrected in commit `b0d2bd20e` by adding trait bounds, requiring
the contaiend type to implement `Sync`.
Vulnerability ID: GHSA-fqq2-xp7m-xvm8
CWE: CWE-362
Severity score: 8.1
Project: https://github.com/RusPiRo/ruspiro-singleton
Published: 2021-08-25
File: src/lib.rs
Commit message: fix soundness
Commit author: 2ndTaleStudio

Vulnerable version (before fix):
 pub struct Singleton<T: 'static> {  // The Singleton need to implement Send & Sync to ensure cross core compile check mechanics // this is safe as the inner RWLock ensures cross core safety unsafe impl<T> Sync for Singleton<T> {} unsafe impl<T> Send for Singleton<T> {}  impl<T: 'static> Singleton<T> {     /// Create a new [Singleton] instance to be used in a static variable. Only ``const fn`` constructors are allowed

Fixed version (after fix):
 pub struct Singleton<T: 'static> {  // The Singleton need to implement Send & Sync to ensure cross core compile check mechanics // this is safe as the inner RWLock ensures cross core safety // but we need to be conditional on the inner type to prevent interior mutable types beeing used // inside a singleton unsafe impl<T> Sync for Singleton<T> where T: Sync {} unsafe impl<T> Send for Singleton<T> where T: Send {}  impl<T: 'static> Singleton<T> {     /// Create a new [Singleton] instance to be used in a static variable. Only ``const fn`` constructors are allowed

Patch:
patch: @@ -81,8 +81,10 @@ pub struct Singleton<T: 'static> {
 
 // The Singleton need to implement Send & Sync to ensure cross core compile check mechanics
 // this is safe as the inner RWLock ensures cross core safety
-unsafe impl<T> Sync for Singleton<T> {}
-unsafe impl<T> Send for Singleton<T> {}
+// but we need to be conditional on the inner type to prevent interior mutable types beeing used
+// inside a singleton
+unsafe impl<T> Sync for Singleton<T> where T: Sync {}
+unsafe impl<T> Send for Singleton<T> where T: Send {}
 
 impl<T: 'static> Singleton<T> {
     /// Create a new [Singleton] instance to be used in a static variable. Only ``const fn`` constructors are allowed
path: src/lib.rs
Vulnerability: Data race in ruspiro-singleton `Singleton<T>` is meant to be a static object that can be initialized lazily. In
order to satisfy the requirement that `static` items must implement `Sync`,
`Singleton` implemented both `Sync` and `Send` unconditionally.

This allows for a bug where non-`Sync` types such as `Cell` can be used in
singletons and cause data races in concurrent programs.

The flaw was corrected in commit `b0d2bd20e` by adding trait bounds, requiring
the contaiend type to implement `Sync`.
Vulnerability ID: GHSA-fqq2-xp7m-xvm8
CWE: CWE-119
Severity score: 8.1
Project: https://github.com/RusPiRo/ruspiro-singleton
Published: 2021-08-25
File: src/lib.rs
Commit message: fix soundness
Commit author: 2ndTaleStudio

Vulnerable version (before fix):
 pub struct Singleton<T: 'static> {  // The Singleton need to implement Send & Sync to ensure cross core compile check mechanics // this is safe as the inner RWLock ensures cross core safety unsafe impl<T> Sync for Singleton<T> {} unsafe impl<T> Send for Singleton<T> {}  impl<T: 'static> Singleton<T> {     /// Create a new [Singleton] instance to be used in a static variable. Only ``const fn`` constructors are allowed

Fixed version (after fix):
 pub struct Singleton<T: 'static> {  // The Singleton need to implement Send & Sync to ensure cross core compile check mechanics // this is safe as the inner RWLock ensures cross core safety // but we need to be conditional on the inner type to prevent interior mutable types beeing used // inside a singleton unsafe impl<T> Sync for Singleton<T> where T: Sync {} unsafe impl<T> Send for Singleton<T> where T: Send {}  impl<T: 'static> Singleton<T> {     /// Create a new [Singleton] instance to be used in a static variable. Only ``const fn`` constructors are allowed

Patch:
patch: @@ -81,8 +81,10 @@ pub struct Singleton<T: 'static> {
 
 // The Singleton need to implement Send & Sync to ensure cross core compile check mechanics
 // this is safe as the inner RWLock ensures cross core safety
-unsafe impl<T> Sync for Singleton<T> {}
-unsafe impl<T> Send for Singleton<T> {}
+// but we need to be conditional on the inner type to prevent interior mutable types beeing used
+// inside a singleton
+unsafe impl<T> Sync for Singleton<T> where T: Sync {}
+unsafe impl<T> Send for Singleton<T> where T: Send {}
 
 impl<T: 'static> Singleton<T> {
     /// Create a new [Singleton] instance to be used in a static variable. Only ``const fn`` constructors are allowed
path: src/lib.rs