starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2014-8480 (published 2014-11-10T11:55Z)

The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel before 3.18-rc2 lacks intended decoder-table flags for certain RIP-relative instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Nadav Amit
author_date: 2014-10-13 13:04:14+03:00
msg: KVM: x86: PREFETCH and HINT_NOP should have SrcMem flag

The decode phase of the x86 emulator assumes that every instruction with the
ModRM flag, and which can be used with RIP-relative addressing, has either
SrcMem or DstMem.  This is not the case for several instructions - prefetch,
hint-nop and clflush.

Adding SrcMem|NoAccess for prefetch and hint-nop and SrcMem for clflush.

This fixes CVE-2014-8480.

Fixes: 41061cdb98a0bec464278b4db8e894a3121671f5
Cc: stable@vger.kernel.org
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: emulate.c
change_type: ModificationType.MODIFY
diff: @@ -3807,7 +3807,7 @@ static const struct opcode group11[] = {
 };
 
 static const struct gprefix pfx_0f_ae_7 = {
-	I(0, em_clflush), N, N, N,
+	I(SrcMem | ByteOp, em_clflush), N, N, N,
 };
 
 static const struct group_dual group15 = { {
@@ -4024,10 +4024,11 @@ static const struct opcode twobyte_table[256] = {
 	N, I(ImplicitOps | EmulateOnUD, em_syscall),
 	II(ImplicitOps | Priv, em_clts, clts), N,
 	DI(ImplicitOps | Priv, invd), DI(ImplicitOps | Priv, wbinvd), N, N,
-	N, D(ImplicitOps | ModRM), N, N,
+	N, D(ImplicitOps | ModRM | SrcMem | NoAccess), N, N,
 	/* 0x10 - 0x1F */
 	N, N, N, N, N, N, N, N,
-	D(ImplicitOps | ModRM), N, N, N, N, N, N, D(ImplicitOps | ModRM),
+	D(ImplicitOps | ModRM | SrcMem | NoAccess),
+	N, N, N, N, N, N, D(ImplicitOps | ModRM | SrcMem | NoAccess),
 	/* 0x20 - 0x2F */
 	DIP(ModRM | DstMem | Priv | Op3264 | NoMod, cr_read, check_cr_read),
 	DIP(ModRM | DstMem | Priv | Op3264 | NoMod, dr_read, check_dr_read),

programming_language: C++
CVE-2012-6112 (published 2013-01-27T22:55Z)

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/tinymce/tinymce_spellchecker_php
commit_details: repo_url: https://github.com/tinymce/tinymce_spellchecker_php
author: Spocke
author_date: 2012-11-16 11:08:03+01:00
msg: Fixed security issue with google spellchecker
repository: repo_url: https://github.com/tinymce/tinymce_spellchecker_php
repo_name: tinymce/tinymce_spellchecker_php
description: TinyMCE Spellchecker for PHP
repo_language: PHP
owner: tinymce
file_changes: filename: changelog.txt
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,5 @@
+Version 2.0.6.1 (2012-11-16)
+	Fixed security issue with google spellchecker.
 Version 2.0.6 (2011-09-29)
 	Fixed incorrect position of suggestion menu.
 	Fixed handling of mispelled words with no suggestions in PSpellShell engine.

programming_language: Markdown
filename: GoogleSpell.php
change_type: ModificationType.MODIFY
diff: @@ -51,6 +51,8 @@ class GoogleSpell extends SpellChecker {
 	}
 
 	function &_getMatches($lang, $str) {
+		$lang = preg_replace('/[^a-z\-]/i', '', $lang); // Sanitize, remove everything but a-z or -
+		$str = preg_replace('/[\x00-\x1F\x7F]/', '', $str); // Sanitize, remove all control characters
 		$server = "www.google.com";
 		$port = 443;
 		$path = "/tbproxy/spell?lang=" . $lang . "&hl=en";

programming_language: PHP
CVE-2018-17075 (published 2018-09-16T02:29Z)

The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/golang/net
commit_details: repo_url: https://github.com/golang/net
author: Kunpei Sakai
author_date: 2018-07-14 02:18:40+09:00
msg: html: remove special procedure for <template> in frameset im

See more details: https://bugs.chromium.org/p/chromium/issues/detail?id=829668

Updates golang/go#23071

Change-Id: Ib9c963269f814c3f21d3784754729df57dcc8f90
Reviewed-on: https://go-review.googlesource.com/123776
Run-TryBot: Kunpei Sakai <namusyaka@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Nigel Tao <nigeltao@golang.org>
repository: repo_url: https://github.com/golang/net
repo_name: golang/net
description: [mirror] Go supplementary network libraries
repo_language: Go
owner: golang
file_changes: filename: parse.go
change_type: ModificationType.MODIFY
diff: @@ -1071,13 +1071,7 @@ func inBodyIM(p *parser) bool {
 				p.acknowledgeSelfClosingTag()
 			}
 			return true
-		case a.Frame:
-			// TODO: remove this divergence from the HTML5 spec.
-			if p.oe.contains(a.Template) {
-				p.addElement()
-				return true
-			}
-		case a.Caption, a.Col, a.Colgroup, a.Head, a.Tbody, a.Td, a.Tfoot, a.Th, a.Thead, a.Tr:
+		case a.Caption, a.Col, a.Colgroup, a.Frame, a.Head, a.Tbody, a.Td, a.Tfoot, a.Th, a.Thead, a.Tr:
 			// Ignore the token.
 		default:
 			p.reconstructActiveFormattingElements()
@@ -1925,11 +1919,6 @@ func inFramesetIM(p *parser) bool {
 			p.acknowledgeSelfClosingTag()
 		case a.Noframes:
 			return inHeadIM(p)
-		case a.Template:
-			// TODO: remove this divergence from the HTML5 spec.
-			//
-			// See https://bugs.chromium.org/p/chromium/issues/detail?id=829668
-			return inTemplateIM(p)
 		}
 	case EndTagToken:
 		switch p.tok.DataAtom {

programming_language: Go
filename: template.dat
change_type: ModificationType.MODIFY
diff: @@ -477,9 +477,7 @@
 | <html>
 |   <head>
 |   <frameset>
-|     <template>
-|       content
-|         <frame>
+|     <frame>
 
 #data
 <template><frame></frame></frameset><frame></frame></template>
@@ -489,8 +487,6 @@
 |   <head>
 |     <template>
 |       content
-|         <frame>
-|         <frame>
 |   <body>
 
 #data
@@ -823,8 +819,6 @@
 |   <head>
 |     <template>
 |       content
-|         <frame>
-|         <frame>
 |   <body>
 
 #data

programming_language: HTML
CVE-2023-45826 (published 2023-10-19T19:15Z)

Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Leantime/leantime
commit_details: repo_url: https://github.com/Leantime/leantime
author: Marcel Folaron
author_date: 2023-09-25 14:38:45-04:00
msg: Merge pull request #1906 from Leantime/bugFixes

Bug fixes
repository: repo_url: https://github.com/Leantime/leantime
repo_name: Leantime/leantime
description: Leantime is a goals focused project management system for non-project managers. Building with ADHD, Autism, and dyslexia in mind.
repo_language: PHP
owner: Leantime
CVE-2022-3510 (published 2022-12-12T13:15Z)

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.\n\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/protocolbuffers/protobuf
commit_details: repo_url: https://github.com/protocolbuffers/protobuf
author: Mike Kruskal
author_date: 2022-09-29 08:28:01-07:00
msg: Sync from Piper @mkruskal/footmitten

PROTOBUF_SYNC_PIPER
repository: repo_url: https://github.com/protocolbuffers/protobuf
repo_name: protocolbuffers/protobuf
description: Protocol Buffers - Google's data interchange format
repo_language: C++
owner: protocolbuffers
CVE-2017-14341 (published 2017-09-12T17:29Z)

ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file.

Severity: HIGH
CVSS v2 base score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2017-08-07 14:59:43-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/654
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: wpg.c
change_type: ModificationType.MODIFY
diff: @@ -1035,6 +1035,8 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
           if(i==EOF)
             break;
           Rd_WP_DWORD(image,&Rec.RecordLength);
+          if (Rec.RecordLength > GetBlobSize(image))
+            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
           if(EOFBlob(image))
             break;
 

programming_language: C
CVE-2021-3756 (published 2021-10-29T16:15Z)

libmysofa is vulnerable to Heap-based Buffer Overflow

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/hoene/libmysofa
commit_details: repo_url: https://github.com/hoene/libmysofa
author: Christian Hoene
author_date: 2021-10-03 17:48:38+02:00
msg: Fix for issue 163
repository: repo_url: https://github.com/hoene/libmysofa
repo_name: hoene/libmysofa
description: Reader for AES SOFA files to get better HRTFs
repo_language: C
owner: hoene
file_changes: filename: dataobject.c
change_type: ModificationType.MODIFY
diff: @@ -500,14 +500,17 @@ static int readOHDRHeaderMessageDataLayout(struct READER *reader,
       store = ftell(reader->fhd);
       if (fseek(reader->fhd, data_address, SEEK_SET) < 0)
         return errno; // LCOV_EXCL_LINE
-      if (!data->data) {
-        if (data_size > 0x10000000)
-          return MYSOFA_INVALID_FORMAT;
-        data->data_len = data_size;
-        data->data = calloc(1, data_size);
-        if (!data->data)
-          return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE
+      if (data->data) {
+        free(data->data);
+        data->data = NULL;
       }
+      if (data_size > 0x10000000)
+        return MYSOFA_INVALID_FORMAT;
+      data->data_len = data_size;
+      data->data = calloc(1, data_size);
+      if (!data->data)
+        return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE
+
       err = fread(data->data, 1, data_size, reader->fhd);
       if (err != data_size)
         return MYSOFA_READ_ERROR; // LCOV_EXCL_LINE

programming_language: C
CVE-2021-45927 (published 2022-01-01T01:15Z)

MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd6e029ee0) in mdb_numeric_to_string (called from mdb_xfer_bound_data and _mdb_attempt_bind).

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/mdbtools/mdbtools
commit_details: repo_url: https://github.com/mdbtools/mdbtools
author: Evan Miller
author_date: 2021-05-01 07:03:58-04:00
msg: Version 0.9.3, final
repository: repo_url: https://github.com/mdbtools/mdbtools
repo_name: mdbtools/mdbtools
description: MDB Tools - Read Access databases on *nix
repo_language: C
owner: mdbtools
file_changes: filename: NEWS
change_type: ModificationType.MODIFY
diff: @@ -1,45 +1,28 @@
-Version 0.9.3, Beta 4
-=============
-
-libmdb:
-* Fix build failure with emscripten #299
-
-Version 0.9.3, Beta 3
-=============
-
-libmdb / libmdbsql:
-* Fix build when _XOPEN_SOURCE was already defined on the platform #298
-
-Version 0.9.3, Beta 2
-=============
-
-libmdb:
-* Migrate to g_memdup2 #287 #288
-
-libmdbsql:
-* Allow double quoted (") database names #291
-* Allow spaces in database names #292 #293
-
-Docs:
-* Add JET version for access 2013/2016/2019 to docs #286
-
-Version 0.9.3, Beta 1
+Version 0.9.3
 =============
 
 libmdb:
 * Support files created with Access 2019 #260 #277
 * Fix a warning when reading in binary property values #262
 * Fix signed-unsigned comparison warning #269
+* Migrate to `g_memdup2` #287 #288
+* Fix build when `_XOPEN_SOURCE` was already defined on the platform #298
+* Fix build failure with emscripten #299
 
 libmdbsql:
 * Support negative floating point literals #274 #279
-* Comparison operators behaved incorrectly when the constant was on the left #283 #285
 * Improved support for file paths in `CONNECT TO` statements #275 #280 #282
+* Comparison operators behaved incorrectly when the constant was on the left #283 #285
+* Allow double quoted (") database names #291
+* Allow spaces in database names #292 #293
 
 ODBC:
 * unixODBC now uses the `--libdir` passed at configure-time #261
 * Fix a segfault in PyODBC when `SQLGetTypeInfo` is called on an unsupported data type #278
 
+Docs:
+* Add JET version for access 2013/2016/2019 to docs #286
+
 Version 0.9.2
 =============
 

programming_language: Markdown
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 dnl Process this file with autoconf to produce a configure script.
-AC_INIT([mdbtools],[0.9.3-beta4],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])
+AC_INIT([mdbtools],[0.9.3],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_SRCDIR(src/extras/mdb-dump.c)

programming_language: Shell
CVE-2022-48468 (published 2023-04-13T21:15Z)

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/protobuf-c/protobuf-c
commit_details: repo_url: https://github.com/protobuf-c/protobuf-c
author: Robert Edmonds
author_date: 2022-07-10 20:37:15-04:00
msg: Merge pull request #513 from protobuf-c/edmonds/issue499

Fix issue #499: unsigned integer overflow
repository: repo_url: https://github.com/protobuf-c/protobuf-c
repo_name: protobuf-c/protobuf-c
description: Protocol Buffers implementation in C
repo_language: C++
owner: protobuf-c
CVE-2016-1000108 (published 2019-12-10T15:15Z)

yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application\'s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/klacke/yaws
commit_details: repo_url: https://github.com/klacke/yaws
author: Klacke Wikstrom
author_date: 2016-07-25 12:46:30+02:00
msg: Security flaw http://httpoxy.org/ fixed
A security flaw with HTTP_PROXY fixed. When we now construct the
cgi env variables, we just skip the Proxy header.
Reported by dominic@varspool.com
repository: repo_url: https://github.com/klacke/yaws
repo_name: erlyaws/yaws
description: Yaws webserver
repo_language: Erlang
owner: klacke
file_changes: filename: yaws_cgi.erl
change_type: ModificationType.MODIFY
diff: @@ -368,11 +368,21 @@ build_env(Arg, Scriptfilename, Pathinfo, ExtraEnv, SC) ->
             {"HTTP_IF_NONE_MATCH", H#headers.if_none_match},
             {"HTTP_IF_UNMODIFIED_SINCE", H#headers.if_unmodified_since},
             {"HTTP_COOKIE", flatten_val(make_cookie_val(H#headers.cookie))}
-           ]++lists:map(fun({http_header,_,Var,_,Val})->{tohttp(Var),Val} end,
-                        H#headers.other)
+           ]++ other_headers(H#headers.other)
           )) ++
         Extra_CGI_Vars.
 
+other_headers(Headers) ->
+    lists:zf(fun({http_header,_,Var,_,Val}) ->
+                     case tohttp(Var) of
+                         "HTTP_PROXY" ->
+                             %% See http://httpoxy.org/
+                             false;
+                         HTTP ->
+                             {true, {HTTP,Val}}
+                     end
+             end, Headers).
+
 tohttp(X) ->
     "HTTP_"++lists:map(fun tohttp_c/1, yaws:to_list(X)).
 

programming_language: Erlang