sharjeelyunus/github-issues-dataset huggingface dataset:
Repository: kubernetes
Issue: CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU
Labels: kind/bug,area/security,sig/api-machinery,lifecycle/frozen,committee/security-response,triage/accepted

CVSS Rating: **Low** ([CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N))

A security issue was discovered in Kubernetes where an authorized user may be able to access private networks on the Kubernetes control plane components. Kubernetes clusters are only affected if an untrusted user can create or modify Node objects and proxy to them, or an untrusted user can create or modify StorageClass objects and access KubeControllerManager logs. 

This issue has been rated Low (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) and assigned CVE-2020-8562.
 
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.

### Affected Versions:
All versions of Kubernetes are affected

### Fixed Versions
There is no fix for this issue at this time.

### Mitigations
If this issue affects your clusters’ control planes, you can use dnsmasq for name resolution and configure the min-cache-ttl and neg-ttl parameters to a low non-zero value to enforce cached replies for proxied connections. 

### Detection
This issue is not known to be directly detectable, but proxied calls will appear in the Kubernetes API Audit log. Kubernetes will respond with “address not allowed” when the validation successfully prevents a connection.

### Acknowledgements
This vulnerability was reported by Javier Provecho (Telefonica).

/area security
/kind bug
/committee product-security
/triage accepted
Repository: flutter
Issue: Perform asynchronous read back of pixels when capturing screenshots
Labels: engine,P2,team-engine,triaged-engine

Capturing a screenshot is expensive. We currently hope to ameliorate the cost by moving device to host texture transfer to the IO thread(see #44148). Another complementary approach which may help reduce overhead in some cases is to do an asynchronous read back of pixels when capturing screenshots. This might look like:

- Raster thread calls SkImage::asyncRescaleAndReadPixels, passing in a callback, this initiates a GPU -> GPU copy.
- Callback passes mapped buffer to IO thread.
- IO thread reads back pixels, makes a CPU backed SkImage, and frees buffer.
- CPU backed SkImage is passed to UI thread for rendering.
Repository: next.js
Issue: static export with trailingSlash: true - query params dropped
Labels: bug

### What version of Next.js are you using?

10.0.5

### What version of Node.js are you using?

12.13.0

### What browser are you using?

Brave

### What operating system are you using?

macOS

### How are you deploying your application?

next export -> S3

### Describe the Bug

I have a static site that I am deploying to an S3 bucket with `npm run build && npm run export` and I have `trailingSlash: true` set in my next config file.

I am finding that if I go to a route on my localhost like so:

`http://localhost:3000/users/login?query=test`

then the trailing slash gets inserted and query params passed on:

`http://localhost:3000/users/login/?query=test`

However I am finding on production that if I go to:

`https://test.com/users/login?query=test`

I get directed to the following and the query params are lost:

`https://test.com/users/login/`

### Expected Behavior

I would expect the behaviour to be the same on my localhost and production, and I would expect that the query params are passed along.

### To Reproduce

Just export any site with `npm run build && npm run export` and set `trailingSlash: true` in you `next.config.js`.
Repository: rust
Issue: Tracking issue for function attribute `#[coverage]`
Labels: T-lang,B-unstable,C-tracking-issue,A-code-coverage

> [!WARNING]  
> This main `#[coverage(..)]` attribute tracking issue description is quite outdated, and likely needs to be revisited.
> Please refer to https://github.com/rust-lang/rust/issues/134749 for the stabilization issue for the `#[coverage(..)]` attribute.


This issue will track the approval and stabilization of the attribute `coverage`, needed to give developers a way to "hide" a function from the coverage instrumentation enabled by `rustc -Z instrument-coverage`.

The `Eq` trait in the `std` library implements a marker function that is not meant to be executed, but results in an uncovered region in all rust programs that derive `Eq`. This attribute will allow the compiler to skip that function, and remove the uncovered regions.

### Unresolved questions

* is it ok that the attribute applied to the crate root, a function, or a module applies to *all* items within the marked item? So far we do not have such attributes other than the lint level attributes.

### Path to stabilization

Please refer to the stabilization issue: https://github.com/rust-lang/rust/issues/134749.
Repository: transformers
Issue: [resume optimization] skip loading pretrained weights on resume
Labels: WIP

This is similar to what was discussed in https://github.com/huggingface/transformers/issues/9205, which proposed not to random init weights on `from_pretrained`, but this time it's about resume - currently we load pretrained weights and immediately drop them on resume from checkpoint in Trainer.

To solve this we, for example, could change examples:

1. to figure out the checkpoint immediately after we init `TrainingArguments` and just before model is created. 
2. then change `from_pretrained()` API to do keep everything as is, except loading the weights from `state_dict`, if say `skip_weights_load=True` is passed:

So the code becomes:
```

    if training_args.do_train:
        if last_checkpoint is not None:
            checkpoint = last_checkpoint
        elif os.path.isdir(model_args.model_name_or_path):
            checkpoint = model_args.model_name_or_path
        else:
            checkpoint = None

    model = AutoModelForSeq2SeqLM.from_pretrained(
        model_args.model_name_or_path, 
        [...],
        skip_weights_load=checkpoint is not None,
    )

    if training_args.do_train:
        train_result = trainer.train(resume_from_checkpoint=checkpoint)
```

Any flaws in my thinking?

@patrickvonplaten, @sgugger
Repository: pytorch
Issue: scatter does not accept scalar src=
Labels: module: docs,triaged,module: numpy,module: scatter & gather ops

## 🐛 Bug

Doc claims that `Tensor.scatter` accepts `src=` but it actually doesn't when that is a scalar.  A unified kwarg name should be used.
```py
In [1]: torch.__version__
Out[1]: '1.8.1'

In [2]: x = torch.zeros(2,3, 4)

In [3]: idx = torch.randint(4, (2,3))

In [4]: x.scatter(src=1, dim=-1, index=idx)
---------------------------------------------------------------------------
TypeError                                 Traceback (most recent call last)
<ipython-input-4-380b6355cf49> in <module>
----> 1 x.scatter(src=1, dim=-1, index=idx)

TypeError: scatter() received an invalid combination of arguments - got (index=Tensor, dim=int, src=int, ), but expected one of:
 * (name dim, Tensor index, Tensor src)
      didn't match because some of the arguments have invalid types: (dim=int, index=Tensor, src=int, )
 * (int dim, Tensor index, Tensor src)
      didn't match because some of the arguments have invalid types: (dim=int, index=Tensor, src=int, )
 * (name dim, Tensor index, Number value)
      didn't match because some of the keywords were incorrect: src
 * (int dim, Tensor index, Number value)
      didn't match because some of the keywords were incorrect: src

```


cc @brianjo @mruberry @rgommers @heitorschueroff
Repository: node
Issue: Increase HTTP/2 window size by default
Labels: http2

**Is your feature request related to a problem? Please describe.**

https://gist.github.com/szmarczak/4a764b3d00ae217267c9d79caafd4082

It is now possible to set the window size on the session & its streams. By default, it's **64KB** which is **too small**. When connecting to really remote servers, there can be even **250ms** latency. That is **4** packets per second! What a fantastic speed of **256KB/s**.

Okay, you might want to connect to a close server, assume **20ms** ping. That's just **50** packets per second.
Meaning: 50 * 16 = **3200KB/s**.

**Describe the solution you'd like**

There are many 1Gbps connections out there. Let's make the session window size 128MB and the stream window size at least 16MB. ***Okay, that's overkill, see my comment ~~above~~ below.***

This way, with 250ms latency the speed will be 64MB/s (512Mbps).

**Describe alternatives you've considered**

None.

/cc @kanongil @Rantoledo @CrucialDrew @fungiboletus @sindresorhus
Repository: node
Issue: Cannot call `session.setLocalWindowSize(number)` before session connects
Labels: http2

* **Version**: v15.10.0
* **Platform**: `Linux solus 5.11.12-177.current #1 SMP PREEMPT Thu Apr 8 15:46:08 UTC 2021 x86_64 GNU/Linux`
* **Subsystem**: http2

### What steps will reproduce the bug?

```js
const http2 = require('http2');

const session = http2.connect('https://example.com');

// Throws
session.setLocalWindowSize(1024 * 1024 * 16);

session.on('remoteSettings', () => {
    // Doesn't throw
    session.setLocalWindowSize(1024 * 1024 * 16);
    console.log('Success!');
});
```

### How often does it reproduce? Is there a required condition?

Always.

### What is the expected behavior?

No error.

### What do you see instead?

```js
node:internal/http2/core:1290
    const ret = this[kHandle].setLocalWindowSize(windowSize);
                              ^

TypeError: Cannot read property 'setLocalWindowSize' of undefined
    at ClientHttp2Session.setLocalWindowSize (node:internal/http2/core:1290:31)
    at Object.<anonymous> (/home/szm/Desktop/http2-wrapper/demo.js:6:9)
    at Module._compile (node:internal/modules/cjs/loader:1091:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1120:10)
    at Module.load (node:internal/modules/cjs/loader:971:32)
    at Function.Module._load (node:internal/modules/cjs/loader:812:14)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:76:12)
    at node:internal/main/run_main_module:17:47
```

Related with #38426
Repository: pytorch
Issue: Do padding of weight and activation tensors to match optimized backend implementation
Labels: oncall: quantization,low priority,triaged

 Quantized backends (and fp32 backends possibly) have magic numbers for lengths of weights and activations. For example, conv and linear kernels work well when the number of input/output channels is a multiple of 8. Automating this process can give a speedup of upto 8x for FBGEMM CPU implementations. This needs to be backend specific.

cc @jerryzh168 @jianyuh @jamesr66a @vkuzo @jgong5 @Xia-Weiwen @leslie-fang-intel @raghuramank100
Repository: PowerToys
Issue: Mapping Alt+Left to MediaNext also remaps all other meta-key combinations
Labels: Issue-Bug,Product-Keyboard Shortcut Manager,Resolution-Fix Committed,Priority-1,Status-Reproducible

### Microsoft PowerToys version

0.35.0

### Running as admin

- [ ] Yes

### Area(s) with issue?

Keyboard Manager

### Steps to reproduce

Remap a shortcut: 
      Alt(Left) + Left  -> Next Tack

Press: 
    Ctrl+Alt+Left
OR:
    Ctrl+Shift+Alt+left
OR:
    Shift+Alt+left


### ✔️ Expected Behavior

For the shortcut to be restricted to the combination entered.

### ❌ Actual Behavior

It fires the media event no matter what. 
Even if that key combination is used locally in the application I am using.

### Other Software

Spotify
Repository: neovim
Issue: Occasional crash (segfault) when closing (and saving) with `nvr --remote-wait` in ml_replace_buf
Labels: terminal,needs:repro,has:backtrace,bug-crash

NVIM v0.5.0-dev+1178-gf0ace6d41, archlinux, xfce4-terminal

Unfortunately, this issue appears to occur randomly (and rarely); I can't seem to get a reproduction with a minimal init.vim.
Next time this issue occurs, I will try to carefuly reproduce the exact circumstances of the crash to see if it will reproduce and I will comment my results on this issue.
Regardless, I thought I would go ahead and make an issue with just the backtrace in the edge case that someone could already figure out what's going on.
```
#0  0x00007f383320478c in __memmove_avx_unaligned_erms () from /usr/lib/libc.so.6
#1  0x000055a34b7852d6 in memmove (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>, __dest=<optimized out>, __src=<optimized out>, __len=<optimized out>)
    at /usr/include/bits/string_fortified.h:36
#2  ml_flush_line (buf=buf@entry=0x55a34ea256e0) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/memline.c:2802
#3  0x000055a34b785b16 in ml_replace_buf (buf=0x55a34ea256e0, lnum=4, line=0x55a34e63b540 " ~/d/items   master   gws", copy=<optimized out>)
    at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/memline.c:2453
#4  0x000055a34b785b8d in ml_replace (lnum=<optimized out>, line=<optimized out>, copy=<optimized out>) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/memline.c:2423
#5  0x000055a34b85aa76 in refresh_screen (term=term@entry=0x55a34e9f7210, buf=buf@entry=0x55a34ea256e0) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/terminal.c:1352
#6  0x000055a34b85ab79 in refresh_terminal (term=0x55a34e9f7210) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/terminal.c:1231
#7  0x000055a34b85ad98 in refresh_timer_cb (watcher=<optimized out>, data=<optimized out>) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/terminal.c:1248
#8  0x000055a34b6fb3e9 in time_event (argv=<optimized out>) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/event/time.c:50
#9  0x000055a34b8404c8 in state_handle_k_event () at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/state.c:87
#10 0x000055a34b7aa255 in nv_event (cap=0x7fffa6f6ce38) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/normal.c:8106
#11 0x000055a34b7a2b12 in normal_execute (state=0x7fffa6f6cdb0, key=<optimized out>) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/normal.c:1142
#12 0x000055a34b8403ac in state_enter (s=0x7fffa6f6cdb0) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/state.c:69
#13 0x000055a34b79de81 in normal_enter (cmdwin=<optimized out>, noexmode=<optimized out>) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/normal.c:463
#14 0x000055a34b77271e in main (argc=-1493774576, argv=<optimized out>) at /home/ryan/.cache/yay/neovim-git/src/neovim-git/src/nvim/main.c:562
```
Repository: vscode
Issue: link parsing should favor on screen urls over offscreen content for huge files
Labels: feature-request,editor-contrib

Issue Type: <b>Bug</b>

1. git clone https://github.com/tobie/specref
2. Open the repository in VSC
3. open refs/wg21.json
4. use find to jump to a line, e.g. for `swappability` (on line 121544)
5. try to command click the link on the next line

actual results:
it takes a really long time before the link is clickable

presumption:
I'm guessing that the syntax highlighter is trying to parse and highlight all of the lines leading up to the current line.

expected results:
if the file is large (>10k lines?), skip trying to parse the entire file, and instead try to parse a window around the displayed portion first and then in the background parse the rest of the file.

VS Code version: Code 1.55.2 (3c4e3df9e89829dce27b7b5c24508306b151f30d, 2021-04-13T09:36:32.643Z)
OS version: Darwin x64 19.6.0

<details>
<summary>System Info</summary>

|Item|Value|
|---|---|
|CPUs|Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz (8 x 2500)|
|GPU Status|2d_canvas: enabled<br>gpu_compositing: enabled<br>metal: disabled_off<br>multiple_raster_threads: enabled_on<br>oop_rasterization: enabled<br>opengl: enabled_on<br>protected_video_decode: unavailable_off<br>rasterization: enabled<br>skia_renderer: disabled_off_ok<br>video_decode: enabled<br>webgl: enabled<br>webgl2: enabled|
|Load (avg)|2, 3, 3|
|Memory (System)|16.00GB (0.08GB free)|
|Process Argv|-psn_0_319566 --crash-reporter-id 1fc67ee2-0174-4598-9f98-4537df0dd32c|
|Screen Reader|no|
|VM|0%|
</details><details><summary>Extensions (32)</summary>

Extension|Author (truncated)|Version
---|---|---
open-in-macdown|Cod|1.0.0
vscode-zonefile|Com|0.0.4
vscode-markdownlint|Dav|0.40.4
vscode-eslint|dba|2.1.20
EditorConfig|Edi|0.16.4
prettier-vscode|esb|6.3.2
go|gol|0.24.2
hive-sql|jos|0.0.4
vscode-sbt-scala|lig|0.2.4
hg|mrc|1.7.1
vscode-docker|ms-|1.12.1
vscode-kubernetes-tools|ms-|1.3.0
vscode-postgresql|ms-|0.3.0
python|ms-|2021.4.765268190
jupyter|ms-|2021.5.745244803
cpptools|ms-|1.3.1
vscode-typescript-tslint-plugin|ms-|1.3.3
fabric8-analytics|red|0.3.2
java|red|0.77.0
vscode-commons|red|0.0.6
vscode-xml|red|0.16.0
vscode-yaml|red|0.18.0
preview-vscode|sea|2.2.5
html-preview-vscode|tht|0.2.5
simple-rst|tro|1.0.1
vscodeintellicode|Vis|1.2.12
vscode-java-debug|vsc|0.32.1
vscode-java-dependency|vsc|0.18.3
vscode-java-pack|vsc|0.14.0
vscode-java-test|vsc|0.28.1
vscode-maven|vsc|0.29.0
markdown-all-in-one|yzh|3.4.0


</details><details>
<summary>A/B Experiments</summary>

```
vsliv368:30146709
vsreu685:30147344
python383cf:30185419
vspor879:30202332
vspor708:30202333
vspor363:30204092
vswsl492:30256859
vstry244:30276681
pythonvsnew554cf:30291488
pythontb:30283811
vspre833:30267464
pythonptprofiler:30281270
vshan820:30276952
pythondataviewer:30285071
vscus158:30286553
vscgsv2ct:30294353

```

</details>

<!-- generated by issue reporter -->
Repository: go
Issue: runtime: stacktrace for deferred code which panics is too subtle for me
Labels: NeedsInvestigation,compiler/runtime

https://play.golang.org/p/dS4pD8LBsfH

Reproduced with 1.16.3.

### What did you expect to see?

Any way to guess *what* was deferred, or ideally, *where* it was deferred.

If you substitute a function literal, like `defer func() { foo.mu.Unlock() }()`, you get to see the name as [function].func1, which helps a lot, but if you just have a direct call to something in runtime, it's pretty hard to read.

But also, I'd like to see the original "write to nil map" panic and not have it get swallowed by the second panic from the deferred code.

### What did you see instead?

A stack trace which looks like something in runtime double-unlocked, even though actually it's my code that has the bug, and no reference to the line of code where the defer was.

It's conceivable that a clearer unwinding of this could show some of that information, although it's a bit tricky to express clearly. This might actually be two distinct requests for changes to the stack trace, one for "the defer should be annotated with its source line", and one for "it'd be nice not to lose the original panic". I'm not sure.
Repository: godot
Issue: ResourceSaver.save writes without using a temporary file, allowing corruption.
Labels: bug,topic:core


**Godot version:**
4.0.dev d1dc28e

**OS/device including version:**
Windows 10.0.19041.928

**Issue description:**
If the user hits ctrl-c or kills Godot while it is writing a resource, that resource is corrupted.

The case I'm running into is from killing godot while it's still loading the project list.
```
ERROR: C:\Users/USERNAME/AppData/Roaming/Godot/editor_settings-4.tres:1 - Parse Error:
   at: ResourceLoaderText::open (scene\resources\resource_format_text.cpp:887)
ERROR: Failed loading resource: C:\Users/USERNAME/AppData/Roaming/Godot/editor_settings-4.tres. Make sure resources have been imported by opening the project in the editor at least once.
   at: (core\io\resource_loader.cpp:203)
WARNING: Could not open config file.
     at: EditorSettings::create (editor\editor_settings.cpp:1044)
```

It is never acceptable for a crash to cause resource corruption. It should either save the old resource state, or the new state, not corrupt the resource.

**Steps to reproduce:**
1. Edit scene\resources\resource_format_text.cpp and add an error log at line 1448.
2. Build Godot in debug
3. Open the project selector window.
4. While it is slowly printing error logs to the console (takes half a minute for me), kill godot, e.g. from task manager.
5. Open the project selector window again. the project list or editor theme will be corrupted.

**Minimal reproduction project:**
occurs during project selector window.
Repository: flutter
Issue: Defer load the entire Flutter engine and framework
Labels: c: new feature,platform-android,tool,engine,t: gradle,a: existing-apps,P3,team-android,triaged-android

With #57617, we're now using Android's Play Feature Delivery mechanism (https://developer.android.com/guide/playcore/feature-delivery) to slice up the Dart code into separately downloadable "deferred components". 

Another way we can use the Android Play Feature Delivery mechanism is to defer load the entirety of Flutter rather than parts of the user's Flutter application. Specifically, the high initial fixed cost components like the Flutter engine, the Dart runtime, the Flutter framework etc can all be remote loaded at the time of use. 

Broadly, we can accomplish this by producing a simple separate maven artifact that only has Java classes to load the main Flutter "feature" via the Play Store APIs. Then we need tooling support and documentation to help users configure their Android and gradle project to package the main Flutter into a separate feature directory. For instance, the main Flutter .AAR can be built separately via `flutter build aar` than the remote loader helper class. 

This feature can't have an iOS equivalent at the present.
Repository: ant-design
Issue: Select maxTagCount="responsive" causes onBlur not triggered at the 1st time
Labels: help wanted,Inactive

- [ ] I have searched the [issues](https://github.com/ant-design/ant-design/issues) of this repository and believe that this is not a duplicate.

Select组件设置maxTagCount="responsive"后，第一次选中某项并点击其他地方，无法触发onBlur事件

### Reproduction link
[![Edit on CodeSandbox](https://codesandbox.io/static/img/play-codesandbox.svg)](https://codesandbox.io/s/antd-reproduction-template-forked-wvoo5?file=/index.js:0-564)

### Steps to reproduce
choose on tag -> click on other place

### What is expected?
"onBlur" prints

### What is actually happening?
nothing prints

| Environment | Info |
|---|---|
| antd | 4.15.3 |
| React | 17.0.2 |
| System | windows |
| Browser | chrome84 |

---
there may be many Select stay focused


<!-- generated by ant-design-issue-helper. DO NOT REMOVE -->
Repository: PowerToys
Issue: PowerToys Run truncate leading newlines
Labels: Idea-Enhancement,Product-PowerToys Run

### Provide a description of the new feature / enhancement

If I have copied

```

40.23-65.23
```

and try to paste it in the Run window, I am not getting any input.

Normalize pasted text by removing newlines (at least when they are empty).