starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-24822 (published 2024-02-07T18:15Z)

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.

CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/pimcore/admin-ui-classic-bundle
commit_details: repo_url: https://github.com/pimcore/admin-ui-classic-bundle
author: robertSt7
author_date: 2024-02-07 10:31:46+01:00
msg: Fix: Tag access rights (#412)
repository: repo_url: https://github.com/pimcore/admin-ui-classic-bundle
repo_name: pimcore/admin-ui-classic-bundle
repo_language: JavaScript
owner: pimcore
file_changes: filename: TagsController.php
change_type: ModificationType.MODIFY
diff: @@ -41,6 +41,8 @@ class TagsController extends AdminAbstractController
      */
     public function addAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         try {
             $tag = new Tag();
             $tag->setName(strip_tags($request->get('text', '')));
@@ -64,6 +66,8 @@ class TagsController extends AdminAbstractController
      */
     public function deleteAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         $tag = Tag::getById((int) $request->get('id'));
         if ($tag) {
             $tag->delete();
@@ -85,6 +89,8 @@ class TagsController extends AdminAbstractController
      */
     public function updateAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         $tag = Tag::getById((int) $request->get('id'));
         if ($tag) {
             $parentId = $request->get('parentId');

programming_language: PHP
CVE-2019-15920 (published 2019-09-04T19:15Z)

An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: ZhangXiaoxu
author_date: 2019-04-06 15:47:39+08:00
msg: cifs: Fix use-after-free in SMB2_read

There is a KASAN use-after-free:
BUG: KASAN: use-after-free in SMB2_read+0x1136/0x1190
Read of size 8 at addr ffff8880b4e45e50 by task ln/1009

Should not release the 'req' because it will use in the trace.

Fixes: eccb4422cf97 ("smb3: Add ftrace tracepoints for improved SMB3 debugging")

Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
CC: Stable <stable@vger.kernel.org> 4.18+
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: smb2pdu.c
change_type: ModificationType.MODIFY
diff: @@ -3448,8 +3448,6 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
 	rqst.rq_nvec = 1;
 
 	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
-	cifs_small_buf_release(req);
-
 	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
 
 	if (rc) {
@@ -3471,6 +3469,8 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
 				    io_parms->tcon->tid, ses->Suid,
 				    io_parms->offset, io_parms->length);
 
+	cifs_small_buf_release(req);
+
 	*nbytes = le32_to_cpu(rsp->DataLength);
 	if ((*nbytes > CIFS_MAX_MSGSIZE) ||
 	    (*nbytes > io_parms->length)) {

programming_language: C
CVE-2020-5250 (published 2020-03-05T17:15Z)

In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 6.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N)

Weakness information:
cwe_id: CWE-552
cwe_name: Files or Directories Accessible to External Parties
description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
extended_description: 
	   Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users.  Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any.  Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.
	   In cloud technologies and containers, this weakness might present itself in the form of misconfigured storage accounts that can be read or written by a public or anonymous user.
	 
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: Pablo Borowicz
author_date: 2020-03-02 10:52:39+01:00
msg: Merge pull request from GHSA-mhfc-6rhg-fxp3

Fix possible personal data leak
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2019-18609 (published 2019-12-01T22:15Z)

An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/alanxz/rabbitmq-c
commit_details: repo_url: https://github.com/alanxz/rabbitmq-c
author: Alan Antonuk
author_date: 2019-11-03 23:50:07-08:00
msg: lib: check frame_size is >= INT32_MAX

When parsing a frame header, validate that the frame_size is less than
or equal to INT32_MAX. Given frame_max is limited between 0 and
INT32_MAX in amqp_login and friends, this does not change the API.

This prevents a potential buffer overflow when a malicious client sends
a frame_size that is close to UINT32_MAX, in which causes an overflow
when computing state->target_size resulting in a small value there. A
buffer is then allocated with the small amount, then memcopy copies the
frame_size writing to memory beyond the end of the buffer.
repository: repo_url: https://github.com/alanxz/rabbitmq-c
repo_name: alanxz/rabbitmq-c
description: RabbitMQ C client
repo_language: C
owner: alanxz
file_changes: filename: amqp_connection.c
change_type: ModificationType.MODIFY
diff: @@ -287,12 +287,21 @@ int amqp_handle_input(amqp_connection_state_t state, amqp_bytes_t received_data,
     case CONNECTION_STATE_HEADER: {
       amqp_channel_t channel;
       amqp_pool_t *channel_pool;
-      /* frame length is 3 bytes in */
+      uint32_t frame_size;
+
       channel = amqp_d16(amqp_offset(raw_frame, 1));
 
-      state->target_size =
-          amqp_d32(amqp_offset(raw_frame, 3)) + HEADER_SIZE + FOOTER_SIZE;
+      /* frame length is 3 bytes in */
+      frame_size = amqp_d32(amqp_offset(raw_frame, 3));
+      /* To prevent the target_size calculation below from overflowing, check
+       * that the stated frame_size is smaller than a signed 32-bit. Given
+       * the library only allows configuring frame_max as an int32_t, and
+       * frame_size is uint32_t, the math below is safe from overflow. */
+      if (frame_size >= INT32_MAX) {
+        return AMQP_STATUS_BAD_AMQP_DATA;
+      }
 
+      state->target_size = frame_size + HEADER_SIZE + FOOTER_SIZE;
       if ((size_t)state->frame_max < state->target_size) {
         return AMQP_STATUS_BAD_AMQP_DATA;
       }

programming_language: C
CVE-2022-3134 (published 2022-09-06T20:15Z)

Use After Free in GitHub repository vim/vim prior to 9.0.0389.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-09-05 19:51:13+01:00
msg: patch 9.0.0389: crash when 'tagfunc' closes the window

Problem:    Crash when 'tagfunc' closes the window.
Solution:   Bail out when the window was closed.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: errors.h
change_type: ModificationType.MODIFY
diff: @@ -3324,3 +3324,5 @@ EXTERN char e_non_null_dict_required_for_argument_nr[]
 EXTERN char e_non_null_list_required_for_argument_nr[]
 	INIT(= N_("E1298: Non-NULL List required for argument %d"));
 #endif
+EXTERN char e_window_unexpectedly_close_while_searching_for_tags[]
+	INIT(= N_("E1299: Window unexpectedly closed while searching for tags"));

programming_language: C
filename: tag.c
change_type: ModificationType.MODIFY
diff: @@ -690,6 +690,16 @@ do_tag(
 		max_num_matches = MAXCOL; // If less than max_num_matches
 					  // found: all matches found.
 
+	    // A tag function may do anything, which may cause various
+	    // information to become invalid.  At least check for the tagstack
+	    // to still be the same.
+	    if (tagstack != curwin->w_tagstack)
+	    {
+		emsg(_(e_window_unexpectedly_close_while_searching_for_tags));
+		FreeWild(new_num_matches, new_matches);
+		break;
+	    }
+
 	    // If there already were some matches for the same name, move them
 	    // to the start.  Avoids that the order changes when using
 	    // ":tnext" and jumping to another file.

programming_language: C
filename: test_tagfunc.vim
change_type: ModificationType.MODIFY
diff: @@ -401,4 +401,17 @@ func Test_tagfunc_wipes_buffer()
   set tagfunc=
 endfunc
 
+func Test_tagfunc_closes_window()
+  split any
+  func MytagfuncClose(pat, flags, info)
+    close
+    return [{'name' : 'mytag', 'filename' : 'Xtest', 'cmd' : '1'}]
+  endfunc
+  set tagfunc=MytagfuncClose
+  call assert_fails('tag xyz', 'E1299:')
+
+  set tagfunc=
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -703,6 +703,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    389,
 /**/
     388,
 /**/

programming_language: Ruby
CVE-2016-7452 (published 2016-11-03T10:59Z)

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/exponentcms/exponent-cms
commit_details: repo_url: https://github.com/exponentcms/exponent-cms
author: dleffler
author_date: 2016-09-14 17:50:30-04:00
msg: security fix to pixidou editor
repository: repo_url: https://github.com/exponentcms/exponent-cms
repo_name: exponentcms/exponent-cms
description: Content Management, Simple.
repo_language: PHP
owner: exponentcms
file_changes: filename: pixidouController.php
change_type: ModificationType.MODIFY
diff: @@ -58,8 +58,11 @@ class pixidouController extends expController {
     }
     
     public function exitEditor() {
-
-        //eDebug($this->params,true);
+        // clean up parameters
+        $this->params['fid'] = intval($this->params['fid']);
+        if (!empty($this->params['cpi']) && strpos($this->params['cpi'], '..') !== false) {
+            $this->params['exitType'] = 'error';
+        }
         switch ($this->params['exitType']) {
             case 'saveAsCopy':
                 $oldimage = new expFile($this->params['fid']);                

programming_language: PHP
CVE-2024-3651 (published 2024-07-07T18:15Z)

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/kjd/idna
commit_details: repo_url: https://github.com/kjd/idna
author: Kim Davies
author_date: 2024-04-10 20:29:01-07:00
msg: Release v3.7
repository: repo_url: https://github.com/kjd/idna
repo_name: kjd/idna
description: Internationalized Domain Names for Python (IDNA 2008 and UTS #46)
repo_language: Python
owner: kjd
file_changes: filename: HISTORY.rst
change_type: ModificationType.MODIFY
diff: @@ -3,6 +3,14 @@
 History
 -------
 
+3.7 (2024-04-11)
+++++++++++++++++
+
+- Fix issue where specially crafted inputs to encode() could
+  take exceptionally long amount of time to process. [CVE-2024-3651]
+
+Thanks to Guido Vranken for reporting the issue.
+
 3.6 (2023-11-25)
 ++++++++++++++++
 

programming_language: Markdown
filename: LICENSE.md
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (c) 2013-2023, Kim Davies and contributors.
+Copyright (c) 2013-2024, Kim Davies and contributors.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

programming_language: Markdown
filename: package_data.py
change_type: ModificationType.MODIFY
diff: @@ -1,2 +1,2 @@
-__version__ = '3.6'
+__version__ = '3.7'
 

programming_language: SQL
CVE-2014-9140 (published 2014-12-05T16:59Z)

Buffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (crash) cia a crafted PPP packet.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2014-10-22 12:31:21-07:00
msg: Do bounds checking when unescaping PPP.

Clean up a const issue while we're at it.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-ppp.c
change_type: ModificationType.MODIFY
diff: @@ -1351,14 +1351,15 @@ static void
 ppp_hdlc(netdissect_options *ndo,
          const u_char *p, int length)
 {
-	u_char *b, *s, *t, c;
+	u_char *b, *t, c;
+	const u_char *s;
 	int i, proto;
 	const void *se;
 
         if (length <= 0)
                 return;
 
-	b = (uint8_t *)malloc(length);
+	b = (u_char *)malloc(length);
 	if (b == NULL)
 		return;
 
@@ -1367,14 +1368,13 @@ ppp_hdlc(netdissect_options *ndo,
 	 * Do this so that we dont overwrite the original packet
 	 * contents.
 	 */
-	for (s = (u_char *)p, t = b, i = length; i > 0; i--) {
+	for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) {
 		c = *s++;
 		if (c == 0x7d) {
-			if (i > 1) {
-				i--;
-				c = *s++ ^ 0x20;
-			} else
-				continue;
+			if (i <= 1 || !ND_TTEST(*s))
+				break;
+			i--;
+			c = *s++ ^ 0x20;
 		}
 		*t++ = c;
 	}

programming_language: C
CVE-2017-6307 (published 2017-02-24T04:59Z)

An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/verdammelt/tnef
commit_details: repo_url: https://github.com/verdammelt/tnef
author: Eric Sesterhenn
author_date: 2017-02-19 19:47:22+01:00
msg: Use asserts on lengths to prevent invalid reads/writes.
repository: repo_url: https://github.com/verdammelt/tnef
repo_name: verdammelt/tnef
description: tnef
repo_language: C
owner: verdammelt
file_changes: filename: mapi_attr.c
change_type: ModificationType.MODIFY
diff: @@ -174,6 +174,7 @@ mapi_attr_read (size_t len, unsigned char *buf)
     uint32 i,j;
     assert(len > 4);
     uint32 num_properties = GETINT32(buf+idx);
+    assert((num_properties+1) != 0);
     MAPI_Attr** attrs = CHECKED_XMALLOC (MAPI_Attr*, (num_properties + 1));
 
     idx += 4;
@@ -212,6 +213,7 @@ mapi_attr_read (size_t len, unsigned char *buf)
 		    /* read the data into a buffer */
 		    a->names[i].data 
 			= CHECKED_XMALLOC(unsigned char, a->names[i].len);
+		    assert((idx+(a->names[i].len*2)) <= len);
 		    for (j = 0; j < (a->names[i].len >> 1); j++)
 			a->names[i].data[j] = (buf+idx)[j*2];
 
@@ -308,8 +310,11 @@ mapi_attr_read (size_t len, unsigned char *buf)
 	    case szMAPI_BINARY:
 		CHECKINT32(idx, len); v->len = GETINT32(buf+idx); idx += 4;
 
+		assert(v->len + idx <= len);
+
 		if (a->type == szMAPI_UNICODE_STRING)
 		{
+		    assert(v->len != 0);
 		    v->data.buf = (unsigned char*)unicode_to_utf8(v->len, buf+idx);
 		}
 		else

programming_language: C
CVE-2020-5296 (published 2020-06-03T22:15Z)

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 4.9, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-610
cwe_name: Externally Controlled Reference to a Resource in Another Sphere
description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/octobercms/october
commit_details: repo_url: https://github.com/octobercms/october
author: Luke Towers
author_date: 2020-03-31 03:37:31-06:00
msg: Improve asset file path handling
repository: repo_url: https://github.com/octobercms/october
repo_name: octobercms/october
description: Self-hosted CMS platform based on the Laravel PHP Framework.
repo_language: PHP
owner: octobercms
file_changes: filename: Asset.php
change_type: ModificationType.MODIFY
diff: @@ -285,7 +285,14 @@ class Asset extends Extendable
             $fileName = $this->fileName;
         }
 
-        return $this->theme->getPath().'/'.$this->dirName.'/'.$fileName;
+        // Limit paths to those under the assets directory
+        $directory = $this->theme->getPath() . '/' . $this->dirName . '/';
+        $path = realpath($directory . $fileName);
+        if (!starts_with($path, $directory)) {
+            return false;
+        }
+
+        return $path;
     }
 
     /**

programming_language: PHP