starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-5375 (published 2023-10-04T09:15Z)

Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/mosparo/mosparo
commit_details: repo_url: https://github.com/mosparo/mosparo
author: Matthias Zobrist
author_date: 2023-10-02 17:44:04+02:00
msg: Fixed an open redirect in the project switch functionality.
Reported by @tomorroisnew on huntr.dev
repository: repo_url: https://github.com/mosparo/mosparo
repo_name: mosparo/mosparo
description: The modern spam protection. Protects your forms from spam by simply checking the content. Open source, Free to use, Accessible, and Self-Hosted.
repo_language: PHP
owner: mosparo
file_changes: filename: ProjectController.php
change_type: ModificationType.MODIFY
diff: @@ -394,7 +394,7 @@ class ProjectController extends AbstractController
 
         // Redirect back to the originally requested path
         $targetPath = $request->query->get('targetPath', false);
-        if ($targetPath) {
+        if ($targetPath && $this->isLocalUrl($request, $targetPath)) {
             return $this->redirect($targetPath);
         }
 
@@ -411,4 +411,22 @@ class ProjectController extends AbstractController
 
         return true;
     }
+
+    protected function isLocalUrl(Request $request, $url): bool
+    {
+        // If the first character is a slash, the URL is relative (only the path) and is local
+        if (str_starts_with($url, '/')) {
+            return true;
+        }
+
+        // If the URL is absolute but starts with the host of mosparo, we can redirect it.
+        // Add the slash to prevent a redirect when a similar top-level domain is used.
+        // For example, mosparo.com should not allow a redirect to mosparo.com.au
+        if (str_starts_with($url, $request->getSchemeAndHttpHost() . '/')) {
+            return true;
+        }
+
+        // The URL does not match the two checks because it's an external URL; no redirect in that case.
+        return false;
+    }
 }
\ No newline at end of file

programming_language: PHP
CVE-2011-3353 (published 2012-05-24T23:55Z)

Buffer overflow in the fuse_notify_inval_entry function in fs/fuse/dev.c in the Linux kernel before 3.1 allows local users to cause a denial of service (BUG_ON and system crash) by leveraging the ability to mount a FUSE filesystem.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Miklos Szeredi
author_date: 2011-08-24 10:20:17+02:00
msg: fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message

FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the
message processing could overrun and result in a "kernel BUG at
fs/fuse/dev.c:629!"

Reported-by: Han-Wen Nienhuys <hanwenn@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@kernel.org
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: dev.c
change_type: ModificationType.MODIFY
diff: @@ -1358,6 +1358,10 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
 	if (outarg.namelen > FUSE_NAME_MAX)
 		goto err;
 
+	err = -EINVAL;
+	if (size != sizeof(outarg) + outarg.namelen + 1)
+		goto err;
+
 	name.name = buf;
 	name.len = outarg.namelen;
 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);

programming_language: C
CVE-2023-22996 (published 2023-02-28T21:15Z)

In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-772
cwe_name: Missing Release of Resource after Effective Lifetime
description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
extended_description: When a resource is not released after use, it can allow attackers to cause a denial of service by causing the allocation of resources without triggering their release. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Miaoqian Lin
author_date: 2022-01-08 09:59:31+00:00
msg: soc: qcom: aoss: Fix missing put_device call in qmp_get

The reference taken by 'of_find_device_by_node()' must be released when
not needed anymore.
Add the corresponding 'put_device()' in the error handling paths.

Fixes: 8c75d585b931 ("soc: qcom: aoss: Expose send for generic usecase")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20220108095931.21527-1-linmq006@gmail.com
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: qcom_aoss.c
change_type: ModificationType.MODIFY
diff: @@ -451,7 +451,11 @@ struct qmp *qmp_get(struct device *dev)
 
 	qmp = platform_get_drvdata(pdev);
 
-	return qmp ? qmp : ERR_PTR(-EPROBE_DEFER);
+	if (!qmp) {
+		put_device(&pdev->dev);
+		return ERR_PTR(-EPROBE_DEFER);
+	}
+	return qmp;
 }
 EXPORT_SYMBOL(qmp_get);
 

programming_language: C
CVE-2019-18808 (published 2019-11-07T16:15Z)

A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-19 11:04:48-05:00
msg: crypto: ccp - Release all allocated memory if sha type is invalid

Release all allocated memory if sha type is invalid:
In ccp_run_sha_cmd, if the type of sha is invalid, the allocated
hmac_buf should be released.

v2: fix the goto.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: ccp-ops.c
change_type: ModificationType.MODIFY
diff: @@ -1777,8 +1777,9 @@ ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 			       LSB_ITEM_SIZE);
 			break;
 		default:
+			kfree(hmac_buf);
 			ret = -EINVAL;
-			goto e_ctx;
+			goto e_data;
 		}
 
 		memset(&hmac_cmd, 0, sizeof(hmac_cmd));

programming_language: C
CVE-2020-9395 (published 2020-07-06T22:15Z)

An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:A/AC:M/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.0, HIGH (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ambiot/amb1_sdk
commit_details: repo_url: https://github.com/ambiot/amb1_sdk
author: ambiot
author_date: 2020-02-25 17:45:00+08:00
msg: [WLAN] Update wlan library

Change Notes:
	bug fixed

Revision Notes:
	r22259+r40932
repository: repo_url: https://github.com/ambiot/amb1_sdk
repo_name: ambiot/amb1_sdk
description: SDK for Ameba1
repo_language: C
owner: ambiot
repo_url: https://github.com/ambiot/amb1_arduino
commit_details: repo_url: https://github.com/ambiot/amb1_arduino
author: zhangzhenwu
author_date: 2020-02-25 20:06:21+08:00
msg: Title: Update wlan library
repository: repo_url: https://github.com/ambiot/amb1_arduino
repo_name: ambiot/amb1_arduino
description: Ameba1 Arduino third-party package SDK
repo_language: C
owner: ambiot
file_changes: filename: package_realtek.com_ameba1_index.json
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,36 @@
 		{
           "name": "Realtek Ameba Boards (32-bits ARM Cortex-M3)",
           "architecture": "Ameba1",
+          "version": "2.0.6-v2",
+          "category": "Contributed",
+          "help": {
+            "online": "http://www.amebaiot.com/"
+          },
+          "url": "https://github.com/ambiot/amb1_arduino/raw/master/Arduino_package/release/ameba_1-2.0.6-v2.tar.gz",
+          "archiveFileName": "ameba_1-2.0.6-v2.tar.gz",
+          "checksum": "SHA-256:ae23b8a56008edafe70f8db3f304176fab014b7be8a5564ebeedaf0a5b02e3d1",
+          "size": "28100307",
+          "boards": [
+            {"name": "Ameba RTL8195A"},
+            {"name": "Ameba RTL8710"},
+            {"name": "Ameba RTL8711AM"}
+          ],
+          "toolsDependencies": [
+            {
+              "packager": "realtek",
+              "name": "ameba_1_arm-none-eabi-gcc",
+              "version": "4.8.3-2014q1"
+            },
+            {
+              "packager": "realtek",
+              "name": "ameba_1_tools",
+              "version": "1.1.1"
+            }
+          ]
+        },
+		{
+          "name": "Realtek Ameba Boards (32-bits ARM Cortex-M3)",
+          "architecture": "Ameba1",
           "version": "2.0.6",
           "category": "Contributed",
           "help": {

programming_language: Jupyter Notebook
CVE-2020-5234 (published 2020-01-31T18:15Z)

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:L/Au:S/C:N/I:N/A:C)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/neuecc/MessagePack-CSharp
commit_details: repo_url: https://github.com/neuecc/MessagePack-CSharp
author: Andrew Arnott
author_date: 2020-01-30 16:32:36-07:00
msg: Merge security fixes in for v2.1
repository: repo_url: https://github.com/neuecc/MessagePack-CSharp
repo_name: MessagePack-CSharp/MessagePack-CSharp
description: Extremely Fast MessagePack Serializer for C#(.NET, .NET Core, Unity, Xamarin). / msgpack.org[C#]
repo_language: C#
owner: neuecc
repo_url: https://github.com/neuecc/MessagePack-CSharp
commit_details: repo_url: https://github.com/neuecc/MessagePack-CSharp
author: Andrew Arnott
author_date: 2020-02-10 06:46:20-07:00
msg: Merge pull request #811 from AArnott/fixNullHasher

Fix `MessagePackSecurity.GetEqualityComparer<object>` to not return null
repository: repo_url: https://github.com/neuecc/MessagePack-CSharp
repo_name: MessagePack-CSharp/MessagePack-CSharp
description: Extremely Fast MessagePack Serializer for C#(.NET, .NET Core, Unity, Xamarin). / msgpack.org[C#]
repo_language: C#
owner: neuecc
CVE-2018-12321 (published 2018-06-13T16:29Z)

There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: pancake
author_date: 2018-06-11 03:15:07+02:00
msg: Fix #10296 - Heap out of bounds read in java_switch_op()
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: anal_java.c
change_type: ModificationType.MODIFY
diff: @@ -679,11 +679,11 @@ static int java_switch_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data,
 
 	if (op_byte == 0xaa) {
 		// handle a table switch condition
-		if (pos + 8 > len) {
+		if (pos + 8 + 8 > len) {
 			return op->size;
 		}
-		int min_val = (ut32)(UINT (data, pos + 4)),
-			max_val = (ut32)(UINT (data, pos + 8));
+		const int min_val = (ut32)(UINT (data, pos + 4));
+		const int max_val = (ut32)(UINT (data, pos + 8));
 
 		ut32 default_loc = (ut32) (UINT (data, pos)), cur_case = 0;
 		op->switch_op = r_anal_switch_op_new (addr, min_val, default_loc);

programming_language: C++
CVE-2022-39217 (published 2022-09-17T00:15Z)

some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version `v1`. Users are advised to use `v1` or later. There are no known workarounds for this issue.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/some-natalie/ghas-to-csv
commit_details: repo_url: https://github.com/some-natalie/ghas-to-csv
author: Natalie Somersall
author_date: 2022-09-07 08:47:32-06:00
msg: move from `csv` to `defusedcsv` (#20)
repository: repo_url: https://github.com/some-natalie/ghas-to-csv
repo_name: advanced-security/ghas-to-csv
description: Play with GHAS API to provide posture data over time
repo_language: Python
owner: some-natalie
file_changes: filename: requirements.txt
change_type: ModificationType.MODIFY
diff: @@ -1 +1,2 @@
+defusedcsv==2.0.0
 requests==2.28.1

programming_language: Batchfile
filename: code_scanning.py
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 # This holds all the things that do stuff for code scanning API
 
 # Imports
-import csv
+from defusedcsv import csv
 import requests
 
 

programming_language: Python
filename: enterprise.py
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 # This holds all the logic for the various enterprise differences.
 
 # Imports
-import csv
+from defusedcsv import csv
 from time import sleep
 import requests
 

programming_language: Python
filename: secret_scanning.py
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 # This holds all the things that do stuff for secret scanning API
 
 # Imports
-import csv
+from defusedcsv import csv
 import requests
 
 

programming_language: Python
CVE-2022-21227 (published 2022-05-01T16:15Z)

The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/TryGhost/node-sqlite3
commit_details: repo_url: https://github.com/TryGhost/node-sqlite3
author: Kewde
author_date: 2021-03-09 22:54:46+00:00
msg: bug: fix segfault of invalid toString() object (#1450)

* bug: verify toString() returns valid data
* test: faulty toString test
repository: repo_url: https://github.com/TryGhost/node-sqlite3
repo_name: TryGhost/node-sqlite3
description: SQLite3 bindings for Node.js
repo_language: PLpgSQL
owner: TryGhost
file_changes: filename: statement.cc
change_type: ModificationType.MODIFY
diff: @@ -205,7 +205,13 @@ template <class T> Values::Field*
         return new Values::Float(pos, source.ToNumber().DoubleValue());
     }
     else if (source.IsObject()) {
-        std::string val = source.ToString().Utf8Value();
+        Napi::String napiVal = source.ToString();
+        // Check whether toString returned a value that is not undefined.
+        if(napiVal.Type() == 0) {
+            return NULL;
+        }
+
+        std::string val = napiVal.Utf8Value();
         return new Values::Text(pos, val.length(), val.c_str());
     }
     else {

programming_language: C++
filename: other_objects.test.js
change_type: ModificationType.MODIFY
diff: @@ -86,4 +86,13 @@ describe('data types', function() {
             });
         });
     });
+
+    it('should ignore faulty toString', function(done) {
+        const faulty = { toString: 23 };
+        db.run("INSERT INTO txt_table VALUES(?)", faulty, function (err) {
+            assert.notEqual(err, undefined);
+            done();
+        });
+    });
+
 });

programming_language: JavaScript
CVE-2022-1808 (published 2022-05-31T22:15Z)

Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/polonel/trudesk
commit_details: repo_url: https://github.com/polonel/trudesk
author: Chris Brame
author_date: 2022-05-28 04:25:26-04:00
msg: fix(core): verify user exists
repository: repo_url: https://github.com/polonel/trudesk
repo_name: polonel/trudesk
description:  :coffee: :seedling: Trudesk is an open-source help desk/ticketing solution.
repo_language: JavaScript
owner: polonel
file_changes: filename: tickets.js
change_type: ModificationType.MODIFY
diff: @@ -15,7 +15,7 @@
 var async = require('async')
 var _ = require('lodash')
 var moment = require('moment-timezone')
-var winston = require('winston')
+var winston = require('../../../logger')
 var permissions = require('../../../permissions')
 var emitter = require('../../../emitter')
 var xss = require('xss')
@@ -1828,12 +1828,23 @@ apiTickets.subscribe = function (req, res) {
   if (_.isUndefined(data.user) || _.isUndefined(data.subscribe))
     return res.status(400).json({ error: 'Invalid Post Data.' })
 
+  if (data.user.toString() !== req.user._id.toString()) return res.status(401).json({ error: 'Unauthorized!' })
+
   var ticketModel = require('../../../models/ticket')
   ticketModel.getTicketById(ticketId, function (err, ticket) {
     if (err) return res.status(400).json({ error: 'Invalid Ticket Id' })
 
     async.series(
       [
+        function (callback) {
+          require('../../../models/user').find({ _id: data.user }, function (err, user) {
+            if (err) return callback(err)
+
+            if (!user) return callback(new Error('Unauthorized!'))
+
+            return callback()
+          })
+        },
         function (callback) {
           if (data.subscribe) {
             ticket.addSubscriber(data.user, function () {
@@ -1846,7 +1857,12 @@ apiTickets.subscribe = function (req, res) {
           }
         }
       ],
-      function () {
+      function (err) {
+        if (err) {
+          winston.warn(err)
+          return res.status(401).json({ error: 'Unauthorized!' })
+        }
+
         ticket.save(function (err, ticket) {
           if (err) return res.status(400).json({ error: err })
 

programming_language: JavaScript