starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-26133 (published 2024-02-21T17:15Z)

EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Only database instances that use custom projections are affected by this vulnerability. User passwords may become accessible to those who have access to the chunk files on disk, and users who have read access to system streams. Only users in the `$admins` group can access system streams by default. ESDB 23.10.1, 22.10.5, 21.10.11, and 20.10.6 contain a patch for this issue. Users should upgrade EventStoreDB, reset the passwords for current and previous members of `$admins` and `$ops` groups, and, if a password was reused in any other system, reset it in those systems to a unique password to follow best practices. If an upgrade cannot be done immediately, reset the passwords for current and previous members of `$admins` and `$ops` groups. Avoid creating custom projections until the patch has been applied.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/EventStore/EventStore
commit_details: repo_url: https://github.com/EventStore/EventStore
author: Tim Coleman
author_date: 2024-02-21 16:00:19+00:00
msg: Merge pull request #4162 from EventStore/hayley-jean/update-changelog-cve

Update changelog for security release
repository: repo_url: https://github.com/EventStore/EventStore
repo_name: EventStore/EventStore
description: EventStoreDB, the event-native database. Designed for Event Sourcing, Event-Driven, and Microservices architectures
repo_language: C#
owner: EventStore
CVE-2012-0957 (published 2012-12-21T11:47Z)

The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:C/I:N/A:N)

Weakness information:
cwe_id: CWE-16
cwe_name: Configuration
description: Weaknesses in this category are typically introduced during the configuration of the software.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Kees Cook
author_date: 2012-10-19 13:56:51-07:00
msg: kernel/sys.c: fix stack memory content leak via UNAME26

Calling uname() with the UNAME26 personality set allows a leak of kernel
stack contents.  This fixes it by defensively calculating the length of
copy_to_user() call, making the len argument unsigned, and initializing
the stack buffer to zero (now technically unneeded, but hey, overkill).

CVE-2012-0957

Reported-by: PaX Team <pageexec@freemail.hu>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Brad Spengler <spender@grsecurity.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: sys.c
change_type: ModificationType.MODIFY
diff: @@ -1265,15 +1265,16 @@ DECLARE_RWSEM(uts_sem);
  * Work around broken programs that cannot handle "Linux 3.0".
  * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40
  */
-static int override_release(char __user *release, int len)
+static int override_release(char __user *release, size_t len)
 {
 	int ret = 0;
-	char buf[65];
 
 	if (current->personality & UNAME26) {
-		char *rest = UTS_RELEASE;
+		const char *rest = UTS_RELEASE;
+		char buf[65] = { 0 };
 		int ndots = 0;
 		unsigned v;
+		size_t copy;
 
 		while (*rest) {
 			if (*rest == '.' && ++ndots >= 3)
@@ -1283,8 +1284,9 @@ static int override_release(char __user *release, int len)
 			rest++;
 		}
 		v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
-		snprintf(buf, len, "2.6.%u%s", v, rest);
-		ret = copy_to_user(release, buf, len);
+		copy = min(sizeof(buf), max_t(size_t, 1, len));
+		copy = scnprintf(buf, copy, "2.6.%u%s", v, rest);
+		ret = copy_to_user(release, buf, copy + 1);
 	}
 	return ret;
 }

programming_language: C
CVE-2016-3179 (published 2017-03-24T15:59Z)

The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (invalid free and daemon crash) via vectors related to error handling.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/miniupnp/miniupnp
commit_details: repo_url: https://github.com/miniupnp/miniupnp
author: Thomas BERNARD
author_date: 2014-04-12 10:05:42+02:00
msg: minissdpd.c: Initialize pointers to NULL (fix)
repository: repo_url: https://github.com/miniupnp/miniupnp
repo_name: miniupnp/miniupnp
description: UPnP IGD implementation
repo_language: C
owner: miniupnp
file_changes: filename: minissdpd.c
change_type: ModificationType.MODIFY
diff: @@ -658,6 +658,7 @@ void processRequest(struct reqelem * req)
 			syslog(LOG_ERR, "cannot allocate memory");
 			goto error;
 		}
+		memset(newserv, 0, sizeof(struct service));	/* set pointers to NULL */
 		if(containsForbiddenChars(p, l)) {
 			syslog(LOG_ERR, "bad request (st contains forbidden chars)");
 			goto error;

programming_language: C
CVE-2022-4127 (published 2022-11-28T22:15Z)

A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Jens Axboe
author_date: 2022-07-09 07:02:10-06:00
msg: io_uring: check that we have a file table when allocating update slots

If IORING_FILE_INDEX_ALLOC is set asking for an allocated slot, the
helper doesn't check if we actually have a file table or not. The non
alloc path does do that correctly, and returns -ENXIO if we haven't set
one up.

Do the same for the allocated path, avoiding a NULL pointer dereference
when trying to find a free bit.

Fixes: a7c41b4687f5 ("io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: io_uring.c
change_type: ModificationType.MODIFY
diff: @@ -7973,6 +7973,9 @@ static int io_files_update_with_index_alloc(struct io_kiocb *req,
 	struct file *file;
 	int ret, fd;
 
+	if (!req->ctx->file_data)
+		return -ENXIO;
+
 	for (done = 0; done < req->rsrc_update.nr_args; done++) {
 		if (copy_from_user(&fd, &fds[done], sizeof(fd))) {
 			ret = -EFAULT;

programming_language: C
CVE-2016-7799 (published 2017-01-18T17:59Z)

MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-09-30 15:19:06-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/280
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: profile.c
change_type: ModificationType.MODIFY
diff: @@ -2032,7 +2032,7 @@ MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)
         break;  /* corrupt EXIF */
       tag_value=(ssize_t) ReadProfileShort(endian,q);
       format=(ssize_t) ReadProfileShort(endian,q+2);
-      if ((format-1) >= EXIF_NUM_FORMATS)
+      if ((format < 0) || ((format-1) >= EXIF_NUM_FORMATS))
         break;
       components=(ssize_t) ReadProfileLong(endian,q+4);
       if (components < 0)

programming_language: Objective-C
CVE-2024-32480 (published 2024-04-22T23:15Z)

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is obtained from `$request`. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resulting in a SQL injection vulnerability. An attacker may extract a whole database this way. Version 24.4.0 fixes the issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/librenms/librenms
commit_details: repo_url: https://github.com/librenms/librenms
author: Jellyfrog
author_date: 2024-04-16 17:38:17+02:00
msg: Improve order validation in list_devices function to prevent SQL injection (#15885)
repository: repo_url: https://github.com/librenms/librenms
repo_name: librenms/librenms
description: Community-based GPL-licensed network monitoring system
repo_language: PHP
owner: librenms
file_changes: filename: api_functions.inc.php
change_type: ModificationType.MODIFY
diff: @@ -313,12 +313,10 @@ function list_devices(Illuminate\Http\Request $request)
     $query = $request->get('query');
     $param = [];
 
-    if (empty($order)) {
-        $order = 'hostname';
-    }
-
-    if (stristr($order, ' desc') === false && stristr($order, ' asc') === false) {
-        $order = 'd.`' . $order . '` ASC';
+    if (preg_match('/^([a-z_]+)(?: (desc|asc))?$/i', $order, $matches)) {
+        $order = "d.`$matches[1]` " . ($matches[2] ?? 'ASC');
+    } else {
+        $order = 'd.`hostname` ASC';
     }
 
     $select = ' d.*, GROUP_CONCAT(dd.device_id) AS dependency_parent_id, GROUP_CONCAT(dd.hostname) AS dependency_parent_hostname, `location`, `lat`, `lng` ';

programming_language: PHP
CVE-2022-35978 (published 2022-08-15T19:15Z)

Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

CVSS v3 base score: 10.0, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/minetest/minetest
commit_details: repo_url: https://github.com/minetest/minetest
author: sfan5
author_date: 2022-05-25 19:07:49+02:00
msg: Protect a few more settings from being set from mods

Of those settings main_menu_script has concrete security impact, the rest are added out of abundance of caution.
repository: repo_url: https://github.com/minetest/minetest
repo_name: minetest/minetest
description: Minetest is an open source voxel game-creation platform with easy modding and game creation
repo_language: C++
owner: minetest
file_changes: filename: l_settings.cpp
change_type: ModificationType.MODIFY
diff: @@ -27,9 +27,11 @@ with this program; if not, write to the Free Software Foundation, Inc.,
 #include "log.h"
 
 
-/* This protects:
- * 'secure.*' settings from being set
- * some mapgen settings from being set
+/* This protects the following from being set:
+ * 'secure.*' settings
+ * some security-relevant settings
+ *   (better solution pending)
+ * some mapgen settings
  *   (not security-criticial, just to avoid messing up user configs)
  */
 #define CHECK_SETTING_SECURITY(L, name) \
@@ -41,7 +43,7 @@ with this program; if not, write to the Free Software Foundation, Inc.,
 static inline int checkSettingSecurity(lua_State* L, const std::string &name)
 {
 	if (ScriptApiSecurity::isSecure(L) && name.compare(0, 7, "secure.") == 0)
-		throw LuaError("Attempt to set secure setting.");
+		throw LuaError("Attempted to set secure setting.");
 
 	bool is_mainmenu = false;
 #ifndef SERVER
@@ -54,6 +56,17 @@ static inline int checkSettingSecurity(lua_State* L, const std::string &name)
 		return -1;
 	}
 
+	const char *disallowed[] = {
+		"main_menu_script", "shader_path", "texture_path", "screenshot_path",
+		"serverlist_file", "serverlist_url", "map-dir", "contentdb_url",
+	};
+	if (!is_mainmenu) {
+		for (const char *name2 : disallowed) {
+			if (name == name2)
+				throw LuaError("Attempted to set disallowed setting.");
+		}
+	}
+
 	return 0;
 }
 

programming_language: C++
CVE-2014-125082 (published 2023-01-18T00:15Z)

A vulnerability was found in nivit redports. It has been declared as critical. This vulnerability affects unknown code of the file redports-trac/redports/model.py. The manipulation leads to sql injection. The name of the patch is fc2c1ea1b8d795094abb15ac73cab90830534e04. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218464.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/nivit/redports
commit_details: repo_url: https://github.com/nivit/redports
author: Bernhard Fröhlich
author_date: 2014-01-14 16:22:47+00:00
msg: redports-trac:
- Fix a possible SQL injection
repository: repo_url: https://github.com/nivit/redports
repo_name: nivit/redports
description: Redports is a continuous integration platform for FreeBSD ports. It helps ports developers to test changes in clean environments and provides a nice web-based user interface. 
repo_language: JavaScript
owner: nivit
file_changes: filename: model.py
change_type: ModificationType.MODIFY
diff: @@ -757,7 +757,7 @@ class BuildarchiveIterator(object):
     def filter(self, owner=None, queueid=None, revision=None, uniqueports=False):
         self.owner = owner
         self.queueid = queueid
-	self.revision = int(revision)
+	self.revision = revision
         self.uniqueports = uniqueports
 
     def count(self):
@@ -772,13 +772,13 @@ class BuildarchiveIterator(object):
         filter = ''
 
         if self.queueid:
-            filter += "AND buildqueue.id = '%s'" % (self.queueid)
+            filter += "AND buildqueue.id = '%s'" % (re.sub("[\"']", "", self.queueid))
 
         if self.owner:
-            filter += "AND buildqueue.owner = '%s'" % (self.owner)
+            filter += "AND buildqueue.owner = '%s'" % (re.sub("[\"']", "", self.owner))
 
 	if self.revision:
-            filter += "AND buildqueue.revision = '%s'" % (self.revision)
+            filter += "AND buildqueue.revision = %s" % (int(self.revision))
 
         return filter
 

programming_language: Python
CVE-2016-7444 (published 2016-09-27T15:59Z)

The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://gitlab.com/gnutls/gnutls
commit_details: repo_url: https://gitlab.com/gnutls/gnutls
author: Nikos Mavrogiannopoulos
author_date: 2016-08-27 17:00:22+02:00
msg: ocsp: corrected the comparison of the serial size in OCSP response

Previously the OCSP certificate check wouldn't verify the serial length
and could succeed in cases it shouldn't.

Reported by Stefan Buehler.
repository: repo_url: https://gitlab.com/gnutls/gnutls
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: gnutls
file_changes: filename: ocsp.c
change_type: ModificationType.MODIFY
diff: @@ -1318,6 +1318,7 @@ gnutls_ocsp_resp_check_crt(gnutls_ocsp_resp_t resp,
 		gnutls_assert();
 		goto cleanup;
 	}
+	cserial.size = t;
 
 	if (rserial.size != cserial.size
 	    || memcmp(cserial.data, rserial.data, rserial.size) != 0) {

programming_language: C
CVE-2016-5096 (published 2016-08-07T10:59Z)

Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.6, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/php/php-src
commit_details: repo_url: https://github.com/php/php-src
author: Stanislav Malyshev
author_date: 2016-05-09 21:55:29-07:00
msg: Fix bug #72114 - int/size_t confusion in fread
repository: repo_url: https://github.com/php/php-src
repo_name: php/php-src
description: The PHP Interpreter
repo_language: C
owner: php
file_changes: filename: file.c
change_type: ModificationType.MODIFY
diff: @@ -1758,6 +1758,12 @@ PHPAPI PHP_FUNCTION(fread)
 		RETURN_FALSE;
 	}
 
+	if (len > INT_MAX) {
+		/* string length is int in 5.x so we can not read more than int */
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be no more than %d", INT_MAX);
+		RETURN_FALSE;
+	}
+
 	Z_STRVAL_P(return_value) = emalloc(len + 1);
 	Z_STRLEN_P(return_value) = php_stream_read(stream, Z_STRVAL_P(return_value), len);
 

programming_language: C
filename: bug72114.phpt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,12 @@
+--TEST--
+Bug #72114 (Integer underflow / arbitrary null write in fread/gzread)
+--FILE--
+<?php
+ini_set('memory_limit', "2500M");
+$fp = fopen("/dev/zero", "r");
+fread($fp, 2147483648);
+?>
+Done
+--EXPECTF--
+Warning: fread(): Length parameter must be no more than 2147483647 in %s/bug72114.php on line %d
+Done

programming_language: PHP
CVE-2015-4085 (published 2017-09-07T20:29Z)

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/ether/etherpad-lite
commit_details: repo_url: https://github.com/ether/etherpad-lite
author: Tom Hunkapiller
author_date: 2015-04-10 19:25:52-05:00
msg: fix an issue in the path handling that allowed directory traversal
repository: repo_url: https://github.com/ether/etherpad-lite
repo_name: ether/etherpad-lite
description: Etherpad: A modern really-real-time collaborative document editor.
repo_language: JavaScript
owner: ether
file_changes: filename: tests.js
change_type: ModificationType.MODIFY
diff: @@ -23,6 +23,7 @@ exports.expressCreateServer = function (hook_name, args, cb) {
 
   });
 
+  var rootTestFolder = path.join(npm.root, "..", "/tests/frontend/");
   var url2FilePath = function(url){
     var subPath = url.substr("/tests/frontend".length);
     if (subPath == ""){
@@ -30,8 +31,11 @@ exports.expressCreateServer = function (hook_name, args, cb) {
     }
     subPath = subPath.split("?")[0];
 
-    var filePath = path.normalize(npm.root + "/../tests/frontend/")
-    filePath += subPath.replace("..", "");
+    var filePath = path.normalize(path.join(rootTestFolder, subPath));
+    // make sure we jail the paths to the test folder, otherwise serve index
+    if (filePath.indexOf(rootTestFolder) !== 0) {
+      filePath = path.normalize(path.join(rootTestFolder, "index.html"));
+    }
     return filePath;
   }
 

programming_language: JavaScript