sharjeelyunus/github-issues-dataset huggingface dataset:
Repository: go
Issue: x/net/html: ParseFragment out of memory on specially crafted input
Labels: NeedsInvestigation

### Go version

go1.23.1 linux/amd64

### Output of `go env` in your module/workspace:

```shell
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/oof/.cache/go-build'
GOENV='/home/oof/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/oof/.asdf/installs/golang/1.23.1/packages/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/oof/.asdf/installs/golang/1.23.1/packages'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/home/oof/.asdf/installs/golang/1.23.1/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/home/oof/.asdf/installs/golang/1.23.1/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.1'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/oof/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD=''
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1768793625=/tmp/go-build -gno-record-gcc-switches'
```


### What did you do?

Hi!

I originally reported this as a security issue, but this wasn't categorized as such, so I am just going to paste the original report here:

```

Summary: Out-Of-Memory (OOM) in net/html in golang

Program: Google VRP

URL: https://github.com/golang/net/

Vulnerability type: Denial of Service (DoS)

Details
An attacker can cause Out-Of-Memory by passing a maliciously crafted input to html.ParseFragment. The input is this string: "<svg><head><title><select><input>" which makes the program consume all of the systems available memory.

Here is an example program which demonstrates this vulnerability:


package main

import (
	"golang.org/x/net/html"
	"strings"
)

func main() {
	html.ParseFragment(strings.NewReader("<svg><head><title><select><input>"), nil)
}


My golang version is go version go1.23.1 linux/amd64 and I am using the v0.30.0 version of the net library.

This vulnerability does not occur in html.Parse, only in html.ParseFragment which I found a bit odd.

Attack scenario
An attacker can use this vulnerability to cause degradation in performance and Denial-Of-Service if said attacker can deliver malicious input to html.ParseFragment . The effects of this vulnerability are basically the same as any other OOM bug. I uploaded all the files which I played around with as files.zip.

```

### What did you see happen?

This causes an out-of-memory condition when parsing a specially crafted input.

### What did you expect to see?

The program should parse the input or fail with an error, not consume all of the systems memory.
Repository: deno
Issue: Can't type anything into prompt asking for read access to TERM
Labels: needs info

Tested Versions: 2.0.1, 2.0.4
OS: macOS Sequoia 15.2 
Tested shells: ZSH, bash, sh, fish
Tested terminal emulators: iTerm2, wezTerm, Ghostty, Apple Terminal

Absolutely no keyboard input is accepted, including `CTRL + C`

Passing the `--allow-all` flag works and the program can be ran normally

My best guess is this might have something to do with macOS secure input, but I'm not entirely certain. 

Screenshot:
<img width="665" alt="Screenshot 2024-11-03 at 23 14 46" src="https://github.com/user-attachments/assets/e577a7e3-79a4-4aa0-968a-2b9ea276f5bd">
Repository: PowerToys
Issue: Screen cleaning mode
Labels: Needs-Triage

### Description of the new feature / enhancement

The screen should turn off while the laptop is being cleaned, and then pressing a key would turn the screen back on.


### Scenario when this would be used?

If someone wants to clean their screen without turning their laptop off, this would help.

### Supporting information

_No response_
Repository: deno
Issue: Confirm `deno fmt` in well know directories
Labels: deno fmt,needs discussion

`deno fmt` is a pretty dangerous command as it will format all the files in a given directory (and sub directories). By default, it will update all files in place. Other tools, such as `cargo fmt` check for the existence of configuration files (such as a `Cargo.toml`), but Deno doesn't require any such files.

If `deno fmt` is run from the root directory, it could cause significant damage to a users file system, and it appears there was one such instance of this that was reported on the Discord channel.

The `deno fmt` command should ask for confirmation if run in well known (Suspicious) directories that are likely not Deno directories. In particular, if running in a tty environment, deno should ask the user to confirm in the following directories:

- `~/.`
- `~/Downloads`
- `~/Documents`
- `~/Desktop`
- `/`
- `~/git`

Thoughts?
Repository: PowerToys
Issue: Low disk/volume space threshold control
Labels: Needs-Triage

### Description of the new feature / enhancement

Windows will set a drive spacebar to red once it reaches 10% left on a drive. 
This made sense in the days of 100GB drives for example as 10% meant only 10 gb left . 
Now with people having 2 TB or even 4TB drives , 10% would mean 200GB or 400GB left and you end up with an annoyed RED space left bar.
Windows provides a way to completely Turn off this RED warning; but what would be more practical would be to be able to set a Threshold by % of by  MB/GB left. And thus control when the drive actually goes RED.

### Scenario when this would be used?

It is a permanent or ongoing setting that could be controlled by having Powertoys loaded; Quite simply you turn on, and you now control the level at which the drive goes RED; better yet set multiple thresholds like 10% Left = Yellow, 3% Left = RED or something like that.

### Supporting information

https://www.elevenforum.com/t/drive-capacity-icon-color.10734/

![Image](https://github.com/user-attachments/assets/52637d76-f917-495d-91da-1a7fdd662a11)
Repository: godot
Issue: ready() signal is called instantly from the Editor when loading the scene if connected via the Node tab's Signals menu 
Labels: bug,topic:editor,needs testing

### Tested versions

Reproducible in: v4.3.stable.official [77dcf97d8]

### System information

Godot v4.3.stable - Fedora Linux 41 (KDE Plasma) - Wayland - Vulkan (Forward+) - dedicated AMD Radeon RX 6600 (RADV NAVI23) - 12th Gen Intel(R) Core(TM) i5-12600KF (16 Threads)

### Issue description

When connecting the ready signal from the Node tab, the signal is called when loading the scene _via the editor_.
This leads to instantly running the connected function. It does not matter if the node is the scene's owner or a child, if it has a script, or whether it has a tool annotation or not.
If connected to methods like queue_free(), the editor will crash once it attempts to delete the corresponding node.
The editor will likely not remove any data from the scene. But if the scene is remembered as the most recent scene, it'll potentially leave the editor in a loop of starting -> loading the scene with signals -> running the method -> crashing.
The only solution is to either remove the signals from the .tscn file or change the last scene the editor "remembers".

I don't think this is the expected behavior, because it affects non-tool and script-less Nodes too. Fixing this would be helpful to create scenes with auto emitting and then freeing particles, for example. Without having to add scripts that aren't necessary.


https://github.com/user-attachments/assets/f497ace1-6b9a-4096-9da5-b7f524f6bd3e



### Steps to reproduce

1. Connect the ready signal to any node from the Editor's Node tab.
2. Close and reopen the scene. The connected function should run instantly.

### Minimal reproduction project (MRP)

The included reproduction project has 2 scenes: visibility_example and crash_example.
I recommend loading visibility_example first, as crash_example will make the editor stuck in the previously mentioned loop.
visibility_example only has a Label and TextureRect. The TextureRect has its visibility set to false (you can check the value in the tscn file), so it should be hidden. However, once the editor loads it, it'll trigger the ready signal, connected to that Node's show() method.

crash_example contains a node that will call queue_free() once the editor loads it, triggering the error.
[editor_signals_test.zip](https://github.com/user-attachments/files/17614057/editor_signals_test.zip)
Repository: rust
Issue: Unwarned Trait recursion causes stack overflow
Labels: C-enhancement,A-lints,T-compiler,L-unconditional_recursion,L-false-negative

### Code

```rs
pub trait Dog: Animal {}

pub trait Animal {
    fn speak(&self) {
        println!("Hey.");
    }
}

impl<D> Animal for D where D: Dog {
    fn speak(&self) {
        self.speak()
    }
}

pub struct Labrador;
impl Dog for Labrador {}

fn main() {
    Labrador.speak();
}
```

### Current output

#### Errors
```
Exited with signal 6 (SIGABRT): abort program
```

#### Standard Error

```
   Compiling playground v0.0.1 (/playground)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.57s
     Running `target/debug/playground`

thread 'main' has overflowed its stack
fatal runtime error: stack overflow
```

#### Standard Output

### Desired output

```
warning: function cannot return without recursing
 --> src/main.rs:4:5
  |
4 |     fn speak(&self) {
  |     ^^^^^^^^^^^^^^^ cannot return without recursing
5 |         self.speak();
  |         ------------ recursive call site
  |
```

### Rationale and extra context

This class of error is properly caught and warned against in the simplest case: calling a trait method from within that same trait method. You can see this in the above code by replacing the blanket implementation with:

```rs
impl Animal for Labrador {
    fn speak(&self) {
        self.speak()
    }
}
```

Which results in the warning listed above in the "desired output".

What appears to be happening is that, because `Dog` is required to be `Animal`, calling `self.speak()` from within the blanket implementation is calling the `Animal` method on `Dog` - which takes precedence over calling the trait method we are currently in.

This code snippet is already seemingly tautological, and it isn't clear how the compiler is reasoning about this. A type implementing `Dog` *must* be an `Animal`, yet `Labrador` cannot have the `Animal` trait unless it is also a `Dog`!

### Other cases

_No response_

### Rust Version

I've been using rust playground for this: https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=e62693e73ead0c65f1b471f8eca6a43a

Using rust 1.82.0

### Anything else?

_No response_
Repository: vscode
Issue: Ability to Temporarily Lock Folders in Workspace
Labels: feature-request,file-explorer

<!-- ⚠️⚠️ Do Not Delete This! feature_request_template ⚠️⚠️ -->
<!-- Please read our Rules of Conduct: https://opensource.microsoft.com/codeofconduct/ -->
<!-- Please search existing issues to avoid creating duplicates. -->

<!-- Describe the feature you'd like. -->

It would be helpful to have a feature that allows users to temporarily lock project folders they aren’t actively working on within a workspace. The locked folders could display a pop-up notification each time a user attempts to access them, preventing accidental edits and helping to maintain focus on the active folder. This feature would be particularly useful for developers working in large workspaces with multiple projects.

A lock option should be included in the options list for a folder.
Repository: node
Issue: Port/Duplicate async_hooks tests to use AsyncLocalStore
Labels: diag-agenda,async_local_storage

Short after https://github.com/nodejs/node/pull/55552 was merged I notices that this resulted in loosing a lot test for `AsyncLocalStore`.

Before `AsyncLocalStore` was based on async hooks. There are plenty of tests for async hooks which implict verified that `AsyncLocalStore` does what it is expected.

But since  https://github.com/nodejs/node/pull/55552 `AsyncLocalStore` and async hooks are independent.

I don't think we have to dup them all, but there are some special cases at least in HTTP area (e.g. [here](https://github.com/nodejs/node/blob/32ff100bfa0c0f4ff72fd2228bc64b1d7ec62557/lib/_http_agent.js#L534-L542)) which might require followups.

fyi @nodejs/diagnostics 

Edit 21.11.: corrected link to PR
Repository: TypeScript
Issue: The generated. d.ts file is missing jsdoc comments
Labels: Suggestion,Help Wanted,Experience Enhancement

### 🔍 Search Terms

".d.ts","jsdoc"

### ✅ Viability Checklist

- [x] This wouldn't be a breaking change in existing TypeScript/JavaScript code
- [x] This wouldn't change the runtime behavior of existing JavaScript code
- [x] This could be implemented without emitting different JS based on the types of the expressions
- [x] This isn't a runtime feature (e.g. library functionality, non-ECMAScript syntax with JavaScript output, new syntax sugar for JS, etc.)
- [x] This isn't a request to add a new utility type: https://github.com/microsoft/TypeScript/wiki/No-New-Utility-Types
- [x] This feature would agree with the rest of our Design Goals: https://github.com/Microsoft/TypeScript/wiki/TypeScript-Design-Goals

### ⭐ Suggestion

When generating .d.ts, if the referenced type is not exported, take one of the following actions:

- Compile error, indicating that necessary types have not been exported
- Automatically generate non exported types into .d.ts
- Maintain the existing implementation and only add jsdoc comments(prefered)

Here is a simple example

1. I wrote a simple library 1
```
// myLib/index.d.ts
type FilterString<T> = {
    [K in keyof T as T[K] extends string ? never : K]: T[K];
}

export function define<T>(p: T): FilterString<T>;
```

2. Reference library 1 in library 2
```
import { define } from 'myLib'

export const test = define({
  /** jsdoc 1 */
  a: 5,
  /** jsdoc 2 */
  b: '',
})
```

3. Compile library 2 to generate .d.ts
```
// without jsdoc: type FilterString without export
export declare const test: {
     a: number; // Don't let jsdoc be lost (prefered)
};
```

```
// with jsdoc: type FilterString with export
// Alternatively, generate the FilterString type into .d.ts as well
export declare const test: import("myLib").FilterString<{
     /** jsdoc 1 */
    a: number;
    /** jsdoc 2 */
    b: string;
}>;
```

### 📃 Motivating Example

When writing libraries, maintain consistent JSDoc annotations between the development and release environments

### 💻 Use Cases

1. When writing libraries, maintain consistent JSDoc annotations between the development and release environments
2. I only discovered that JSDoc was missing when it was released
3. Manually find the type that has not been exported and add it to the export
Repository: neovim
Issue: startup autocmd event documentation is inconsistent with how it behaves
Labels: bug,gui,startup,events

### Problem

Frequently there is no `ChanInfo` event.
Not sure if it's a doc/code/spec/cockpit issue.

In develop.txt there's (twice)
```
- Call |nvim_set_client_info()| after connecting, so users and plugins can
  detect the UI by handling the |ChanInfo| event. This avoids the need for ...
```
But with `nvim-tui` the `ChanInfo` event is intermittent. With both `neovide`
and `goneovim` the event never happens.


At https://neovim.io/doc/user/starting.html#--embed there's
```
--embed ... Waits for the ... nvim_ui_attach() before sourcing startup files
... The client can do other requests before nvim_ui_attach (e.g. nvim_get_api_info
```


`ChanOpen` event is never seen. Might be my specific usage/environment.

In `autocmd.txt`
```
UIEnter
    After a UI connects via |nvim_ui_attach()|,
    or after builtin TUI is started.
```
```
ChanInfo
    State of channel changed, for instance the
    client of a RPC channel described itself.
```


### Steps to reproduce

Observations using the script below

With `nvim-tui` either
1. `UIEnter` without a later `ChanInfo`
   In `UIEnter` handler `nvim_get_chan_info()` `client` value is populated.
2. `UIEnter` followed by `ChanInfo`
   In `UIEnter` handler `nvim_get_chan_info()` `client` value is empty dict.
   In `ChanInfo` `vim.v.event.info` is populated as expected.

With `neovide` never see `ChanInfo` 
1. In `UIEnter` handler `nvim_get_chan_info()` value is populated.

```lua
vim.api.nvim_create_autocmd("ChanInfo", {
    callback = function(ev)
        vim.print(string.format("ChanInfo: ev: %s", vim.inspect(ev, {newline=""})))
        vim.print(string.format("ChanInfo: v:event info: %s", vim.inspect(vim.v.event.info)))
    end
})

vim.api.nvim_create_autocmd("UIEnter", {
    callback = function(ev)
        vim.print(string.format("UIEnter: ev: %s", vim.inspect(ev, {newline=""})))
        vim.print(string.format("UIEnter: v:event: %s", vim.inspect(vim.v.event, {newline=""})))
        vim.print(string.format("UIEnter: chan info: %s", vim.inspect(
            vim.api.nvim_get_chan_info(vim.v.event.chan), {newline=""})))
    end
})
```


### Expected behavior

More accurate descriptions; maybe in conjunction with code changes

(@bfredl follow up on #31057)

### Nvim version (nvim -v)

https://github.com/neovim/neovim/commit/0da4d89558a05fb86186253e778510cfd859caea

### Vim (not Nvim) behaves the same?

NA

### Operating system/version

ubuntu

### Terminal name/version

gnome-terminal

### $TERM environment variable

xterm-256color

### Installation

make install
Repository: pytorch
Issue: There is a bug in torch.cat for non-standard boolean
Labels: triaged,module: boolean tensor,module: python frontend,module: edge cases

### 🐛 Describe the bug

```python
import torch
import numpy as np

# params 
lower_value = 5
upper_value = 10
input_shape = [1024,1,1024,1024]       # input_shape = [1024,1,1024,1023]

# create numpy array
input_array_0 = np.random.uniform(lower_value, upper_value, input_shape).astype(dtype="int8")
input_array_1 = np.random.uniform(lower_value, upper_value, input_shape).astype(dtype="int8")

# convert to torch.tensor
input_tensor_0 = torch.from_numpy(input_array_0).to(device="cuda").view(bool)
input_tensor_1 = torch.from_numpy(input_array_1).to(device="cuda").view(bool)
input_tensors = []
input_tensors.append(input_tensor_0)
input_tensors.append(input_tensor_1)

# invoke torch.cat
out = torch.cat(input_tensors, dim=1)

print(input_tensor_0.untyped_storage()[0:5])
print(input_tensor_1.untyped_storage()[0:5])
print(out.untyped_storage()[0:5])
```

When `input_shape = [1024,1,1024,1023]`, the content of `out.untyped_storage()` is between 5 and 10, which belongs to non-standard boolean. However, when `input_shape = [1024,1,1024,1024]`, the contents of `out.untyped_storage()` are all standard boolean.

![image](https://github.com/user-attachments/assets/2ec5e38f-6beb-4f23-9468-38dc52ced84e)

![image](https://github.com/user-attachments/assets/ff86744f-dfba-4ac2-9601-7e5d8028cf04)


### Versions

torch 2.3.0 + cu121

cc @albanD
Repository: TypeScript
Issue: auto-import with `package.json#imports` does not take `moduleResolution` into account
Labels: Needs More Info

### 🔎 Search Terms

"subpath", "imports", "package.json", "moduleResolution"

### 🕗 Version & Regression Information

- This changed in commit or PR #55015
- This is the behavior in every version I tried, and I reviewed the FAQ for entries about imports, completions


### ⏯ Playground Link

[alan910127/ts-60405-repro](https://github.com/alan910127/ts-60405-repro)

### 💻 Code

```jsonc
// package.json
{
  "imports": {
    "#*": "./src/*"
  },
  "devDependencies": {
    "typescript": "5.6.3"
  }
}
```

```jsonc
// tsconfig.json
{
  "compilerOptions": {
    "moduleResolution": "Bundler"
  }
}
```

```ts
// src/foo/bar/baz.ts
export function baz() {}
```

```ts
// src/one/two/three.ts
// actual   - import { baz } from "#foo/bar/baz.js";
// expected - import { baz } from "#foo/bar/baz";
```



### 🙁 Actual behavior

When auto-importing the function `baz` (either through completion or code action), the typescript language server will insert an import statement with a `.js` file extension.

```ts
import { baz } from "#foo/bar/baz.js";
```

### 🙂 Expected behavior

Since we are using `"moduleResolution": "Bundler"`, it should insert an import statement without the `.js` file extension.

```ts
import { baz } from "#foo/bar/baz";
```

### Additional information about the issue

I've seen a similar issue #59200, but I cannot reproduce the issue, with the same setup. Therefore, I think my issue might be related with the subpath imports.
Repository: kubernetes
Issue: Inconsistency of Partitions in StatefulSets with StartOrdinal Feature
Labels: kind/bug,sig/apps,needs-triage

### What happened?

StatefulSet with 
```
Replicas 9
StartOrdinal 2
Partition 5
```

we will get 
[2,3,4,5,6] current revision
[7,8,9,10] updated revision

### What did you expect to happen?

If I understand the partition with definition
https://github.com/kubernetes/kubernetes/blob/3036d107a0ee4855b992e9f49eded88e0a739734/staging/src/k8s.io/api/apps/v1/types.go#L117-L122

I will get
[2,3,4] current revision
[5,6,7,8,9,10] updated revision

Or we can define partition as the number of pods with current revision.

### How can we reproduce it (as minimally and precisely as possible)?

1. Create a sts with partition 9 and start ordinal 2
```
apiVersion: apps/v1
kind: StatefulSet
metadata:
  creationTimestamp: "2024-09-12T03:06:27Z"
  generation: 1
  name: ss2
  resourceVersion: "23988"
  uid: d556aa7c-c4da-4676-8caa-4b32db831c37
spec:
  podManagementPolicy: OrderedReady
  replicas: 9
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      baz: blah
      foo: bar
  serviceName: test
  ordinals: 
    start: 2
  template:
    metadata:
      labels:
        baz: blah
        foo: bar
    spec:
      containers:
      - image: xxxx
        imagePullPolicy: IfNotPresent
        name: nginx
        resources: {}
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
      partition: 0
    type: RollingUpdate

```

2. update the sts and set partition as 5

### Anything else we need to know?

_No response_

### Kubernetes version

<details>

```console
$ kubectl version
# paste output here
Client Version: v1.29.3
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.7
```

</details>


### Cloud provider

<details>
kind
</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>
KCM
</details>
Repository: PowerToys
Issue: Updates info relese notes opens even clicked off from settings
Labels: Issue-Bug,Needs-Triage

### Microsoft PowerToys version

0.85.1

### Installation method

PowerToys auto-update

### Running as admin

Yes

### Area(s) with issue?

General

### Steps to reproduce

I dont know.

### ✔️ Expected Behavior

I dont need to know update notes weeks after latest update. When turning off the Notification and Release Notes, it should not open the window when Power Toys is opened either att startup or in manual

### ❌ Actual Behavior

When I start my computer and auto starting Power Toys as administrator, the Release Notes window opnes even turned off Show Notifications and Show the Release Notes. Also when taken ticks off from the updates drop box.

### Other Software

_No response_