starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-37471 (published 2023-07-20T17:15Z)

Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in  OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. See the linked GHSA for details.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/OpenIdentityPlatform/OpenAM
commit_details: repo_url: https://github.com/OpenIdentityPlatform/OpenAM
author: Maxim Thomas
author_date: 2023-07-18 16:05:03+03:00
msg: GHSL-2023-143, GHSL-2023-144, deny unsigned SAML response (#624)
repository: repo_url: https://github.com/OpenIdentityPlatform/OpenAM
repo_name: OpenIdentityPlatform/OpenAM
description: OpenAM is an open access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security.
repo_language: Java
owner: OpenIdentityPlatform
file_changes: filename: SAMLUtils.java
change_type: ModificationType.MODIFY
diff: @@ -951,6 +951,10 @@ public class SAMLUtils  extends SAMLUtilsCommon {
      */
     public static boolean verifyResponse(Response response,
     String requestUrl, HttpServletRequest request) {
+        if(!response.isSigned()) {
+            debug.message("verifyResponse: Response is not signed");
+            return false;
+        }
         if (!response.isSignatureValid()) {
             debug.message("verifyResponse: Response's signature is invalid.");
             return false;
@@ -1585,13 +1589,13 @@ public class SAMLUtils  extends SAMLUtilsCommon {
         List assertions = null;    
         SAMLServiceManager.SOAPEntry partnerdest = null;
         Subject assertionSubject = null;
-        if (samlResponse.isSigned()) {
-            // verify the signature
-            boolean isSignedandValid = verifySignature(samlResponse);
-            if (!isSignedandValid) {
-                throw new SAMLException(bundle.getString("invalidResponse"));
-            }
+
+        // verify the signature
+        boolean isSignedandValid = verifySignature(samlResponse);
+        if (!isSignedandValid) {
+            throw new SAMLException(bundle.getString("invalidResponse"));
         }
+
         // check Assertion and get back a Map of relevant data including,
         // Subject, SOAPEntry for the partner and the List of Assertions.
         Map ssMap = verifyAssertionAndGetSSMap(samlResponse);

programming_language: Java
CVE-2023-1307 (published 2023-03-10T01:15Z)

Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-305
cwe_name: Authentication Bypass by Primary Weakness
description: The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/froxlor/froxlor
commit_details: repo_url: https://github.com/froxlor/froxlor
author: Michael Kaufmann
author_date: 2023-02-22 09:35:27+01:00
msg: type-safe comparsion of md5-compatibility hash-validation

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
repository: repo_url: https://github.com/froxlor/froxlor
repo_name: froxlor/Froxlor
description: The server administration software for your needs - The official Froxlor development Git repository
repo_language: PHP
owner: froxlor
file_changes: filename: Crypt.php
change_type: ModificationType.MODIFY
diff: @@ -198,7 +198,7 @@ class Crypt
 			$update_hash = true;
 		}
 
-		if ($pwd_hash == $pwd_check || password_verify($password, $pwd_hash)) {
+		if ($pwd_hash === $pwd_check || password_verify($password, $pwd_hash)) {
 			// check for update of hash (only if our database is ready to handle the bigger string)
 			$is_ready = Froxlor::versionCompare2("0.9.33", Froxlor::getVersion()) <= 0;
 			if ((password_needs_rehash($pwd_hash, $algo) || $update_hash) && $is_ready) {

programming_language: PHP
CVE-2018-12249 (published 2018-06-12T14:29Z)

An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject" is not properly supported in class.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2018-06-08 14:13:06+09:00
msg: `mrb_class_real()` did not work for `BasicObject`; fix #4037
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: class.c
change_type: ModificationType.MODIFY
diff: @@ -1763,10 +1763,10 @@ mrb_class_path(mrb_state *mrb, struct RClass *c)
 MRB_API struct RClass*
 mrb_class_real(struct RClass* cl)
 {
-  if (cl == 0)
-    return NULL;
+  if (cl == 0) return NULL;
   while ((cl->tt == MRB_TT_SCLASS) || (cl->tt == MRB_TT_ICLASS)) {
     cl = cl->super;
+    if (cl == 0) return NULL;
   }
   return cl;
 }

programming_language: C
CVE-2019-20788 (published 2020-04-23T19:15Z)

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/LibVNC/libvncserver
commit_details: repo_url: https://github.com/LibVNC/libvncserver
author: Christian Beier
author_date: 2019-11-17 17:18:35+01:00
msg: libvncclient/cursor: limit width/height input values

Avoids a possible heap overflow reported by Pavel Cheremushkin
<Pavel.Cheremushkin@kaspersky.com>.

re #275
repository: repo_url: https://github.com/LibVNC/libvncserver
repo_name: LibVNC/libvncserver
description: LibVNCServer/LibVNCClient are cross-platform C libraries that allow you to easily implement VNC server or client functionality in your program.
repo_language: C
owner: LibVNC
file_changes: filename: cursor.c
change_type: ModificationType.MODIFY
diff: @@ -28,6 +28,8 @@
 #define OPER_SAVE     0
 #define OPER_RESTORE  1
 
+#define MAX_CURSOR_SIZE 1024
+
 #define RGB24_TO_PIXEL(bpp,r,g,b)                                       \
    ((((uint##bpp##_t)(r) & 0xFF) * client->format.redMax + 127) / 255             \
     << client->format.redShift |                                              \
@@ -54,6 +56,9 @@ rfbBool HandleCursorShape(rfbClient* client,int xhot, int yhot, int width, int h
   if (width * height == 0)
     return TRUE;
 
+  if (width >= MAX_CURSOR_SIZE || height >= MAX_CURSOR_SIZE)
+    return FALSE;
+
   /* Allocate memory for pixel data and temporary mask data. */
   if(client->rcSource)
     free(client->rcSource);

programming_language: C++
CVE-2019-16318 (published 2019-09-14T18:15Z)

In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: Bernhard Rusch
author_date: 2019-03-19 14:56:35+01:00
msg: [Asset] do not allow filenames longer than 255 characters
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: Asset.php
change_type: ModificationType.MODIFY
diff: @@ -623,6 +623,10 @@ class Asset extends Element\AbstractElement
             $this->setFilename($this->getFilename() . '.txt');
         }
 
+        if(mb_strlen($this->getFilename()) > 255) {
+            throw new \Exception('Filenames longer than 255 characters are not allowed');
+        }
+
         if (Asset\Service::pathExists($this->getRealFullPath())) {
             $duplicate = Asset::getByPath($this->getRealFullPath());
             if ($duplicate instanceof Asset and $duplicate->getId() != $this->getId()) {

programming_language: PHP
CVE-2022-1427 (published 2022-04-23T00:15Z)

Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-04-22 08:32:18+09:00
msg: vm.c: check if target_class is NULL (when prepended).
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: vm.c
change_type: ModificationType.MODIFY
diff: @@ -1750,10 +1750,7 @@ RETRY_TRY_BLOCK:
         mrb_exc_set(mrb, exc);
         goto L_RAISE;
       }
-      if (target_class->flags & MRB_FL_CLASS_IS_PREPENDED) {
-        target_class = mrb_vm_ci_target_class(ci);
-      }
-      else if (target_class->tt == MRB_TT_MODULE) {
+      if ((target_class->flags & MRB_FL_CLASS_IS_PREPENDED) || target_class->tt == MRB_TT_MODULE) {
         target_class = mrb_vm_ci_target_class(ci);
         if (!target_class || target_class->tt != MRB_TT_ICLASS) {
           goto super_typeerror;

programming_language: C
CVE-2017-13007 (published 2017-09-14T06:29Z)

The Apple PKTAP parser in tcpdump before 4.9.2 has a buffer over-read in print-pktap.c:pktap_if_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-03-05 20:21:48-08:00
msg: CVE-2017-13007/PKTAP: Pass a properly updated struct pcap_pkthdr to the sub-dissector.

The sub-dissector expects that the length and captured length will
reflect the actual remaining data in the packet, not the raw amount
including the PKTAP header; pass an updated header, just as we do for
PPI.

This fixes a buffer over-read discovered by Yannick Formaggio.

Add a test using the capture file supplied by the reporter(s).
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-pktap.c
change_type: ModificationType.MODIFY
diff: @@ -104,6 +104,7 @@ pktap_if_print(netdissect_options *ndo,
 	u_int length = h->len;
 	if_printer printer;
 	const pktap_header_t *hdr;
+	struct pcap_pkthdr nhdr;
 
 	if (caplen < sizeof(pktap_header_t) || length < sizeof(pktap_header_t)) {
 		ND_PRINT((ndo, "[|pktap]"));
@@ -144,7 +145,10 @@ pktap_if_print(netdissect_options *ndo,
 
 	case PKT_REC_PACKET:
 		if ((printer = lookup_printer(dlt)) != NULL) {
-			hdrlen += printer(ndo, h, p);
+			nhdr = *h;
+			nhdr.caplen = caplen;
+			nhdr.len = length;
+			hdrlen += printer(ndo, &nhdr, p);
 		} else {
 			if (!ndo->ndo_eflag)
 				pktap_header_print(ndo, (const u_char *)hdr,

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -502,6 +502,7 @@ juniper_es		juniper_es.pcap			juniper_es.out	-vvv -e
 
 # bad packets from Yannick Formaggio
 l2tp-avp-overflow	l2tp-avp-overflow.pcap		l2tp-avp-overflow.out	-v
+pktap-heap-overflow	pktap-heap-overflow.pcap	pktap-heap-overflow.out	-v
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: pktap-heap-overflow.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,3 @@
+[|pktap]
+[|ppp]
+EXIT CODE 00000100

programming_language: SQL
CVE-2012-0044 (published 2012-05-17T11:00Z)

Integer overflow in the drm_mode_dirtyfb_ioctl function in drivers/gpu/drm/drm_crtc.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.1.5 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted ioctl call.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Xi Wang
author_date: 2011-11-23 01:12:01-05:00
msg: drm: integer overflow in drm_mode_dirtyfb_ioctl()

There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.

Reported-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: drm_crtc.c
change_type: ModificationType.MODIFY
diff: @@ -1873,6 +1873,10 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
 	}
 
 	if (num_clips && clips_ptr) {
+		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
+			ret = -EINVAL;
+			goto out_err1;
+		}
 		clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
 		if (!clips) {
 			ret = -ENOMEM;

programming_language: C
filename: drm_mode.h
change_type: ModificationType.MODIFY
diff: @@ -235,6 +235,8 @@ struct drm_mode_fb_cmd {
 #define DRM_MODE_FB_DIRTY_ANNOTATE_FILL 0x02
 #define DRM_MODE_FB_DIRTY_FLAGS         0x03
 
+#define DRM_MODE_FB_DIRTY_MAX_CLIPS     256
+
 /*
  * Mark a region of a framebuffer as dirty.
  *

programming_language: C
CVE-2022-36028 (published 2024-04-25T21:15Z)

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/bigbluebutton/greenlight
commit_details: repo_url: https://github.com/bigbluebutton/greenlight
author: Ahmad Farhat
author_date: 2022-07-11 14:29:35-04:00
msg: Added additional check when redirecting with return_to (#3631)

* Added additional check when redirecting with return_to

* Fixed test
repository: repo_url: https://github.com/bigbluebutton/greenlight
repo_name: bigbluebutton/greenlight
description: A really simple end-user interface for your BigBlueButton server.
repo_language: Ruby
owner: bigbluebutton
file_changes: filename: authenticator.rb
change_type: ModificationType.MODIFY
diff: @@ -50,7 +50,9 @@ module Authenticator
         dont_redirect_to.push(File.join(ENV['OAUTH2_REDIRECT'], "auth", "openid_connect", "callback"))
       end
 
-      url = if cookies[:return_to] && !dont_redirect_to.include?(cookies[:return_to])
+      valid_url = cookies[:return_to] && URI.parse(cookies[:return_to]).host == URI.parse(request.original_url).host
+
+      url = if cookies[:return_to] && valid_url && !dont_redirect_to.include?(cookies[:return_to])
         cookies[:return_to]
       elsif user.role.get_permission("can_create_rooms")
         user.main_room

programming_language: Ruby
filename: sessions_controller_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -171,7 +171,7 @@ describe SessionsController, type: :controller do
       user = create(:user, provider: "greenlight",
         password: "Example1!", password_confirmation: 'example')
 
-      url = Faker::Internet.domain_name
+      url = "http://test.host/test"
 
       @request.cookies[:return_to] = url
 

programming_language: Ruby
CVE-2015-6564 (published 2015-08-24T01:59Z)

Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.

Severity: MEDIUM
CVSS v2 base score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/openssh/openssh-portable
commit_details: repo_url: https://github.com/openssh/openssh-portable
author: Damien Miller
author_date: 2015-08-11 13:34:12+10:00
msg: set sshpam_ctxt to NULL after free

Avoids use-after-free in monitor when privsep child is compromised.
Reported by Moritz Jodeit; ok dtucker@
repository: repo_url: https://github.com/openssh/openssh-portable
repo_name: openssh/openssh-portable
description: Portable OpenSSH
repo_language: C
owner: openssh
file_changes: filename: monitor.c
change_type: ModificationType.MODIFY
diff: @@ -1166,14 +1166,16 @@ mm_answer_pam_respond(int sock, Buffer *m)
 int
 mm_answer_pam_free_ctx(int sock, Buffer *m)
 {
+	int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt;
 
 	debug3("%s", __func__);
 	(sshpam_device.free_ctx)(sshpam_ctxt);
+	sshpam_ctxt = sshpam_authok = NULL;
 	buffer_clear(m);
 	mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
 	auth_method = "keyboard-interactive";
 	auth_submethod = "pam";
-	return (sshpam_authok == sshpam_ctxt);
+	return r;
 }
 #endif
 

programming_language: C
CVE-2017-20156 (published 2022-12-31T10:15Z)

A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The patch is named 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/exciting-io/printer
commit_details: repo_url: https://github.com/exciting-io/printer
author: James Adam
author_date: 2017-07-08 11:32:01+01:00
msg: Patch shell injection vulnerability in prepare page

By escaping the URL argument, we prevent arbitrary commands from being
able to be injected there.

Fixes #56
repository: repo_url: https://github.com/exciting-io/printer
repo_name: exciting-io/printer
description: Tools for exploring the possibilities of "internet of things" printing.
repo_language: Ruby
owner: exciting-io
file_changes: filename: prepare_page.rb
change_type: ModificationType.MODIFY
diff: @@ -3,6 +3,7 @@ require "printer/jobs/image_to_bits"
 require "printer/id_generator"
 require "printer/preview"
 require "timeout"
+require "shellwords"
 
 class Printer::Jobs::PreparePage
   def self.queue
@@ -36,7 +37,7 @@ class Printer::Jobs::PreparePage
   end
 
   def self.save_url_to_path(url, width, path)
-    cmd = "phantomjs rasterise.js #{url} #{width} #{path}"
+    cmd = "phantomjs rasterise.js #{url.shellescape} #{width} #{path}"
     run(cmd)
   end
 

programming_language: Ruby