sharjeelyunus/github-issues-dataset huggingface dataset:
Repository: go
Issue: proposal: cmd/vet: detect homograph attacks
Labels: Proposal,Proposal-Hold,Analysis

A [homograph attack](https://en.wikipedia.org/wiki/IDN_homograph_attack) is an attack that exploits the visual similarity of two glyphs. Traditionally, this has been used in phishing attacks to trick a user into visiting a malicious domain that looks identical to the real domain. However, homographs can also be used to sneak malicious source code past review. This is possible in any language that supports Unicode source code.

Here is a simple example of a homograph attack in Go source code:

```go
package main

import (
	"log"
	"os"
)

func main() {
	log.SetFlags(0)
	f, err := os.Create("test")
	if err != nil {
		log.Fatal(err)
	}
	f.Close()
	if _, еrr := f.Write([]byte("data")); err != nil {
		log.Fatal(еrr)
	}
}
```
([Playground link](https://play.golang.org/p/EturtcBpds))

The expected output is `write test: file already closed`, but the actual program prints nothing.  This happens because `e` and `е` are homographs, and thus `err` and `еrr` refer to different variables. This example is not very threatening, but it should demonstrate that sophisticated attacks could be constructed using this mechanism.
In my analysis, strings are the most likely vector for a homograph attack. For example, a homograph could be inserted in a `switch` statement over runes or strings, such that a particular `case` branch would never be taken. A homograph could also be used in an `import`  path, although sites like GitHub seem to do a good job of preventing users from registering names or repos that contain homographs. Finally, as in the example above, homographs could be inserted in variable names where scoping rules make the duplication difficult to detect.

I propose that `go vet` make a "best effort" to detect homograph attacks. This is a bit nuanced because there are many valid reasons to include Unicode characters in source code; distinguishing malicious homographs from harmless ones is probably impossible in general. However, I believe that a few simple heuristics can catch the vast majority of viable attacks. For example, `go vet` could flag identifiers that mix ASCII with known homographs.
I have already developed a simple tool for this purpose [here](https://github.com/NebulousLabs/glyphcheck), though it is currently too strict to be used in projects that contain harmless homographs. Perhaps an external tool is sufficient, but adding it to `go vet` increases the chance that a security-conscious project will be protected from such attacks. At any rate, I recommend that open-source projects at Google run any publicly-submitted patches through a homograph detector.
Repository: go
Issue: go/types: vague docs about "incrementally" type checking files
Labels: Documentation,NeedsInvestigation

The go/types documentation twice mentions "incrementally":

> Alternatively, create a new type checker with NewChecker and invoke it incrementally by calling Checker.Files.

> NewChecker returns a new Checker instance for a given package. Package files may be added incrementally via checker.Files.

However, it's unclear to me what that's supposed to mean. The types tutorial doesn't mention "incrementally" at all either, or even describe using the types.Checker API.

Intuitively, I would think an "incremental" API means the caller only needs to supply new information; e.g., to call Files({A}) and then Files({B}). But looking at the implementation, it appears the second call actually needs to be Files({A,B}). That's fine (and can't change now anyway), but I'm not clear in what sense it's "incremental." It doesn't build on any previous work, except to reuse the same maps previously allocated.

/cc @griesemer @alandonovan
Repository: kubernetes
Issue: apimachinery - Support for Float comparisons in selector.go for Gt Lt operations
Labels: sig/api-machinery,lifecycle/frozen

FEATURE REQUEST 
Provide support for label selector comparisons of Float values. One use case is for targeted selection to nodes with a label greater than a specific major version number of some component. There may be other use cases.

```
[{"key": "myComponentVersion", "operator": "Gt", "values": ["1.8"]}]
```
The current [NewRequirement](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/labels/selector.go#L135) and [Matches](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/labels/selector.go#L208) function only support comparison of Integers.

Are there any known dependancies on this being Int64?
Any concern with updating this to convert and compare Floats instead of Integers?
Would it need to support both or is that overkill?
Repository: angular
Issue: Each HammerJS event is causing a new HammerJS instance to be created.
Labels: type: bug/fix,area: core,core: event listeners,P4

**I'm submitting a ...**  (check one with "x")
```
[X] bug report => search github for a similar issue or PR before submitting
[ ] feature request
[ ] support request => Please do not submit support request here, instead see https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question
```

**Current behavior**
Multiple instances of HammerJS are created on for each event on a given element. It's causing performance issue and makes reacting to events hard (weird behaviour).

As workaround one can register one listener on most generic event `(pan)="drag($event)"`

**Expected behavior**
For a given Element only one Hammer instance should be created.

**Minimal reproduction of the problem with instructions**
```
<div (panstart)="drag($event)" (panend)="dragEnd($event)"
        (panup)="drag($event)" (pandown)="drag($event)">
```

**What is the motivation / use case for changing the behavior?**
Dragging element over page looks terrible (the square looks like jumping or very low FPS).

**Please tell us about your environment:**
Playing around with angular quickstart.

* **Angular version:** 4.0.3

* **Browser:** all
The performance problems were noticed on Chrome Mobile
 
* **Language:** TypeScript 2.2

* **Node (for AoT issues):** `node --version` =   7.9

Code where it gets created:
https://github.com/angular/angular/blob/4.0.x/packages/platform-browser/src/dom/events/hammer_gestures.ts#L115
Repository: vscode
Issue: Problem saving keybindings
Labels: feature-request,ux

<!-- Do you have a question? Please ask it on http://stackoverflow.com/questions/tagged/vscode -->

- VSCode Version: 1.11.2 and 1.12.0 - insiders
- OS Version: Windows 10

-- Sorry for the English, I used Google Translator --

When I set a shortcut, if you press <kbd>Ctrl</kbd> + <kbd>k</kbd>, the VSCode is waiting for a second combination. Which works great.


But if I press any keyboard and then <kbd>Ctrl</kbd> + <kbd>k</kbd>, this key takes the function of <kbd>Ctrl</kbd> + <kbd>K</kbd> and always waits for a second combination.

Example: <kbd>n</kbd> <kbd>Ctrl</kbd> + <kbd>k</kbd>

If you type a text and press <kbd>n</kbd> it is waiting for the second combination.

I know the same open multiple ports for shortcuts, but maybe one maybe a setting where I only limit use to <kbd>Ctrl</kbd> + <kbd>k</kbd> to receive a second combination.

My suggestion is (I do not know if it's possible):

1- Limit second combination only to <kbd>Ctrl</kbd> + <kbd>k</kbd>, or until the user changes.
2- Whenever you have this situation, reverse the shortcuts automatically, either on the new screen or manually. If you typed <kbd>n</kbd> <kbd>Ctrl</kbd> + <kbd>k</kbd> it should interpret or edit the file for <kbd>Ctrl</kbd> + <kbd>k</kbd> <kbd>n</kbd>
3 - Prevent saving the shortcut key if it is wrong or prevents it from working.
Repository: flutter
Issue: Dropdown menus are expected to animate both width and height
Labels: framework,f: material design,from: review,has reproducible steps,P2,found in release: 3.3,found in release: 3.4,team-design,triaged-design

Feedback from Material Design review:
"Overflow menu popup animates incorrectly. It is supposed to expand both vertically and horizontally, instead it seems to jump to full width and then animates the height"

I believe this is in reference to menus such as the dropdown menus seen in Flutter Gallery > Menus demos.

An example gif is here:
https://material.io/guidelines/components/menus.html#menus-usage
The last gif before the Menu Items section titled "Action overflow menu" appears to have this behavior (if very quickly).

I think the material itself is expanding vertically and horizontally and the text is also fading in at the same time?

This was marked as a P1 so would block further releases of the Gallery at current.
Repository: opencv
Issue: GaussianBlur in OpenCL work incorrectly
Labels: category: ocl,incomplete

<!--
If you have a question rather than reporting a bug please go to http://answers.opencv.org where you get much faster responses.
If you need further assistance please read [How To Contribute](https://github.com/opencv/opencv/wiki/How_to_contribute).

This is a template helping you to create an issue which can be processed as quickly as possible. This is the bug reporting section for the OpenCV library.
-->

##### System information
<!-- Example
- OpenCV => 3.1
- Operating System / Platform => Windows 64 Bit / AMD Radeon RX 480 Graphics
- Compiler => Visual Studio 2015
-->

- OpenCV => 3.1 and 3.2 are both tested
- Operating System / Platform => Windows 10 64Bit / AMD Radeon RX 480 Graphics
- Compiler => Visual Studio 2015

##### Detailed description
Pass cv::UMat(below left) into GaussianBlur, the result(below right) contains strange vertical stripes:
![1](https://cloud.githubusercontent.com/assets/6456584/25421440/7fb47e32-2a8f-11e7-8071-5dd8a45274e0.jpg)

##### Steps to reproduce

<!-- to add code example fence it with triple backticks and optional file extension
    ```.cpp
#include <opencv2/core.hpp>
#include <opencv2/imgproc/imgproc.hpp>
#include <opencv2/core/ocl.hpp>
#include <opencv2/highgui/highgui.hpp>

int main() {
	cv::Mat src = cv::imread("1.jpg");
	cv::UMat uorig, ublur;
	src.copyTo(uorig);

	cv::GaussianBlur(uorig, ublur, cv::Size(0, 0), 0.8);
	cv::imshow("orig", src);
	cv::imshow("blured", ublur);

	cv::waitKey();
	return 0;
}
    ```
 or attach as .txt or .zip file
-->
 ```.cpp
#include <opencv2/core.hpp>
#include <opencv2/imgproc/imgproc.hpp>
#include <opencv2/core/ocl.hpp>
#include <opencv2/highgui/highgui.hpp>

int main() {
	cv::Mat src = cv::imread("1.jpg");
	cv::UMat uorig, ublur;
	src.copyTo(uorig);

	cv::GaussianBlur(uorig, ublur, cv::Size(0, 0), 0.8);
	cv::imshow("orig", src);
	cv::imshow("blured", ublur);

	cv::waitKey();
	return 0;
}
```
Repository: vscode
Issue: Editor drag and drop mouse feedback missing
Labels: ux,under-discussion,editor-drag-and-drop

Refs: #25338

OS X, insider

1. Enable editor drag and drop and select some text
2. Drag that text
3. Notice that the editor cursor nicely updates however the mouse cursor does not update to reflect that I am dropping something. This leaves me puzzled as the user what is going on as there is no prominent feedback that I am actually dragging the text in the editor

It would be great if we could fix this as it would greatly increase the experinece imho
Notice in the gif that I am dragging the text all the time while the mouse is unchanged

![dnd](https://cloud.githubusercontent.com/assets/1926584/25426320/03ffde14-2a6f-11e7-9482-9e3274d2df66.gif)
Repository: vscode
Issue: Drop cursor missing if drop location === current cursor location
Labels: ux,under-discussion,editor-drag-and-drop

<!-- Do you have a question? Please ask it on http://stackoverflow.com/questions/tagged/vscode -->

Refs: #25338

IMO the current cursor location is less important that the drop indication. So the cursor should show the drop location style.

![cast](https://cloud.githubusercontent.com/assets/1931590/25428184/5e0f94d4-2a75-11e7-9d52-fdbd3a533e72.gif)
Repository: neovim
Issue: 'guicursor' coloring is not updated by `:highlight Cursor`
Labels: bug,highlight,options

- `nvim --version`: 
```console
$ n -v
NVIM v0.2.0-1464-g7e571bca
Build type: RelWithDebInfo
Compilation: /usr/local/Homebrew/Library/Homebrew/shims/super/clang -Wconversion -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1 -DNVIM_MSGPACK_HAS_FLOAT32 -O2 -g -DDISABLE_LOG -Wall -Wextra -pedantic -Wno-unused-parameter -Wstrict-prototypes -std=gnu99 -Wvla -fstack-protector-strong -fdiagnostics-color=auto -DINCLUDE_GENERATED_DECLARATIONS -I/tmp/neovim-20170426-23155-ad758q/build/config -I/tmp/neovim-20170426-23155-ad758q/src -I/usr/local/include -I/usr/local/include -I/usr/local/include -I/usr/local/include -I/usr/local/include -I/usr/local/include -I/usr/local/opt/gettext/include -I/usr/include -I/usr/include -I/tmp/neovim-20170426-23155-ad758q/build/src/nvim/auto -I/tmp/neovim-20170426-23155-ad758q/build/include
Compiled by kborges@13592-storage

Optional features included (+) or not (-): +acl   +iconv    +jemalloc +tui
For differences from Vim, see :help vim-differences

   system vimrc file: "$VIM/sysinit.vim"
  fall-back for $VIM: "/usr/local/Cellar/neovim/HEAD-7e571bc/share/nvim"
```
- Vim (version: ) behaves differently? **yes**
- Operating system/version: macOS Sierra 10.12.4 (16E195)
- Terminal name/version: iTerm2 Build 3.0.15
- `$TERM`:
```console
$ echo $TERM
xterm-256color
```
- minimal init.vim:
```viml
set rtp-=/Users/kborges/.config/nvim
set rtp-=/Users/kborges/.config/nvim/after

colorscheme desert
hi! Cursor ctermfg=1 ctermbg=1 guifg=#FF0000 guibg=#FF0000

set termguicolors
set guicursor=n-c-v:block-Cursor/Cursor-blinkon0
set guicursor+=i-ci:ver1-Cursor/Cursor-blinkwait300-blinkon200-blinkoff150
```

### Actual behaviour

**nvim:**
![nvim-gcursor](https://cloud.githubusercontent.com/assets/120483/25428954/5267f15e-2a6f-11e7-86aa-8eea8c7dd56b.gif)

**vim:**
![vim-gcursor](https://cloud.githubusercontent.com/assets/120483/25428993/67264618-2a6f-11e7-98bc-6adfd05ca2eb.gif)


I think there are 2 different errors:
1. the `:hi! Cursor "...` seems not to be working
2. Even when I force the `:hi! Cursor` on the command, the cursor color doesn't change

PS.: I marked that the behaviour on vim is different because the `:hi! Cursor "...` on init.vim seems to work on vim.
Repository: pytorch
Issue: Conjugate Gradient mentioned in docs, but not implemented
Labels: todo,feature,module: optimizer,triaged

The torch.nn.optim docs promised me conjugate gradient descent (mentions it in the closure section), but it's not there. No references to the algorithm in the code base either :(. Not yet ported from Lua?

cc @vincentqb
Repository: go
Issue: x/pkgsite: list types that satisfy an interface within its package
Labels: Proposal,Proposal-Accepted,Tools,pkgsite

Forked from https://github.com/golang/go/issues/19412#issuecomment-296766847, to continue discussion with @jimmyfrasche and any others without taking over that proposal thread.

The pattern of having an interface with an unexported method and types that implement it is a fairly common pattern in Go as we don't have [sum types](https://github.com/golang/go/issues/19412). A good example is in `go/ast`: https://golang.org/pkg/go/ast/#Spec

For a user reading the godoc, it's very useful to them to know what are the types that can go in that interface. The actual information is hidden in the code, so most packages like `go/ast` above list them manually: `The Spec type stands for any of *ImportSpec, *ValueSpec, and *TypeSpec.`

This works OK, but the issue is that these names aren't linked to the types in the same page. I propose that this happen automatically, much like https://github.com/golang/go/issues/4953 for packages. Linking to types (and potentially other exported names like funcs and consts) could be useful for other purposes.

This is the conservative solution. A more aggressive solution would be to automatically generate the list of types that can fit into the interface. If we had sum types that could be limited to those kinds of types and be trivial to implement.

As long as we don't have sum types, @jimmyfrasche was suggesting to just list all the types that satisfy the interface in its package. I'm not sure if that's a good idea for all interfaces, but would certainly be useful for those that follow the pattern of an unexported method to mimic sum types. Not sure how safe/desired such a change would be.

Manually listing the types in the godoc isn't a huge pain, but not having links is a problem.

CC @griesemer who wrote the `go/ast` godoc and might have some input
Repository: go
Issue: runtime: shrink map as elements are deleted
Labels: Performance,NeedsFix,compiler/runtime

### What version of Go are you using (`go version`)?
go version go1.8 windows/amd64

### What operating system and processor architecture are you using (`go env`)?
set GOARCH=amd64
set GOBIN=
set GOEXE=.exe
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOOS=windows
set GOPATH=C:\dev\Go
set GORACE=
set GOROOT=C:\Go
set GOTOOLDIR=C:\Go\pkg\tool\windows_amd64
set GCCGO=gccgo
set CC=gcc
set GOGCCFLAGS=-m64 -mthreads -fmessage-length=0
set CXX=g++
set CGO_ENABLED=1
set PKG_CONFIG=pkg-config
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2


### What did you do?
See example on playground: https://play.golang.org/p/odsk9F1UH1
(edit: forgot to remove sleeps and changed the number of elements)

### What did you expect to see?
removing elements from m1 map should release memory.

### What did you see instead?
total allocated memory is always increasing


In the example the issue is not so relevant, but in my production scenario (several maps with more than 1million elements each) I can easily get OOM error, and the process is being killed.
Also I don't know if memstats.Alloc is the right counter to expose here, but I can observe the issue with regular process management tools in linux (e.g. top or htop)
Repository: pytorch
Issue: Feature Request: noise contrastive estimation/negative sampling
Labels: feature,module: nn,triaged

There isn't a standard loss function implementing this, even though it's pretty common. I am perfectly willing to implement it myself, if nobody else feels like it. It shouldn't be terribly complicated. I would structure it something like:
```python
class NCELoss(torch.nn.modules.loss._Loss):
    r"""Noise contrastive estimation loss function.
    Args:
        num_classes: int number of classes for the output layer
        num_sampled: int number of samples to extract from noise distribution
        noise_sampler: () -> int function
            Function to generate k class labels according to noise distribution.
            By default, noise will be assumed log uniform unigram.

    Shape:
        - Input: :math:`(N, C)` where `C = num_classes`
        - Target: :math:`(N)` where each value is `0 <= targets[i] <= C-1`
    """
```
The API for tensorflow also uses a parameter `subtract_log_q` so that by setting it to `False` you can switch to a negative sampling objective from nce. Is this worth doing?

Is this something that already exists? Is this something worth implementing?
Repository: TypeScript
Issue: Suggestion: a built-in TypedArray interface
Labels: Suggestion,Help Wanted,Domain: lib.d.ts,Fix Available

I would have expected a [`TypedArray`][ecma-typed-array] interface to exist in
the built-in declaration libraries. Instead, there are independent types for
[`Int8Array`][lib-int8-array], etc, with no common base type.

```ts
interface Int8Array { /* ... */ }
interface Int8ArrayConstructor { /* ... */ }
declare const Int8Array: Int8ArrayConstructor;

interface Uint8Array { /* ... */ }
interface Uint8ArrayConstructor { /* ... */ }
declare const Uint8Array: Uint8ArrayConstructor;

// ...
```

It seems sensible that there should be a common `TypedArray` type, both because

  - a TypeScript user might want to declare a variable as a `TypedArray`, and
  - it would reduce repetition in the built-in declaration files

```ts
interface TypedArray { /* ... */ }

interface Int8Array extends TypedArray { }
interface Int8ArrayConstructor { /* ... */ }
declare const Int8Array: Int8ArrayConstructor;

interface Uint8Array extends TypedArray { }
interface Uint8ArrayConstructor { /* ... */ }
declare const Uint8Array: Uint8ArrayConstructor;

// ...
```

Is there a good reason why there is no `TypedArray` type? If not, I can submit a PR.

## Use case

Consider the [`isTypedArray()`][lodash-is-typed-array] function from lodash.
Currently, it is declared as follows:

```ts
function isTypedArray(value: any): boolean;
```

This proposal would enable an appropriate type-guard, without declaring
a convoluted union type:

```ts
function isTypedArray(value: any): value is TypedArray;
```

[ecma-typed-array]: http://www.ecma-international.org/ecma-262/6.0/#sec-typedarray-objects
[lib-int8-array]: https://github.com/Microsoft/TypeScript/blob/6756e3e44c3b21d021a7542b63f2de84b65695c4/src/lib/es5.d.ts#L1550
[lodash-is-typed-array]: https://lodash.com/docs/4.17.4#isTypedArray
Repository: flutter
Issue: Canonical routing example code isn't documented
Labels: framework,d: api docs,d: examples,f: routes,P2,team-framework,triaged-framework

We find that our developers learn by reading the code, and documenting the code with dartdocs is a helpful way to teach and orient the developer.

https://github.com/flutter/flutter/blob/master/examples/stocks/lib/main.dart is our canonical "simple" example of routing. We'd love to see inline dartdocs here, pointing out the main concepts and what the developer should see and learn by looking at this file.

We link to https://github.com/flutter/flutter/blob/master/examples/stocks/lib/main.dart from Gallery source code, and we'll link to it from our now in-progress /routing-and-navigation page.

Thanks!