starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2019-11808 (published 2019-05-07T07:29Z)

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 3.7, LOW (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-338
cwe_name: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
description: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
extended_description: 
            When a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks.
            Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.
         
         

Fix information:
repo_url: https://github.com/ratpack/ratpack
commit_details: repo_url: https://github.com/ratpack/ratpack
author: Luke Daley
author_date: 2019-04-23 11:28:28+10:00
msg: Use UUID directly for generating session IDs
repository: repo_url: https://github.com/ratpack/ratpack
repo_name: ratpack/ratpack
description: Lean & powerful HTTP apps
repo_language: Java
owner: ratpack
file_changes: filename: SessionModule.java
change_type: ModificationType.MODIFY
diff: @@ -194,6 +194,7 @@ public class SessionModule extends ConfigurableModule<SessionCookieConfig> {
   }
 
   @Provides
+  @Singleton
   SessionIdGenerator sessionIdGenerator() {
     return new DefaultSessionIdGenerator();
   }

programming_language: Java
filename: DefaultSessionIdGenerator.java
change_type: ModificationType.MODIFY
diff: @@ -16,18 +16,17 @@
 
 package ratpack.session.internal;
 
+import com.google.inject.Singleton;
 import io.netty.util.AsciiString;
 import ratpack.session.SessionIdGenerator;
 
 import java.util.UUID;
-import java.util.concurrent.ThreadLocalRandom;
 
+@Singleton
 public class DefaultSessionIdGenerator implements SessionIdGenerator {
 
   public AsciiString generateSessionId() {
-    ThreadLocalRandom random = ThreadLocalRandom.current();
-    UUID uuid = new UUID(random.nextLong(), random.nextLong());
-    return AsciiString.of(uuid.toString());
+    return AsciiString.cached(UUID.randomUUID().toString());
   }
 
 }

programming_language: Java
CVE-2021-23803 (published 2021-12-17T20:15Z)

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/nette/latte
commit_details: repo_url: https://github.com/nette/latte
author: David Grudl
author_date: 2021-11-23 12:30:19+01:00
msg: Parser: removes all control characters from template [Closes #279]
repository: repo_url: https://github.com/nette/latte
repo_name: nette/latte
description: ☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.
repo_language: PHP
owner: nette
file_changes: filename: Parser.php
change_type: ModificationType.MODIFY
diff: @@ -94,6 +94,11 @@ public function parse(string $input): array
 			$input = substr($input, 3);
 		}
 
+		if (preg_match('#[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]#', $input, $m, PREG_OFFSET_CAPTURE)) {
+			trigger_error('Template contains control character \x' . dechex(ord($m[0][0])) . ' on line ' . (substr_count($input, "\n", 0, $m[0][1]) + 1) . '.', E_USER_WARNING);
+			$input = preg_replace('#[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]#', '', $input);
+		}
+
 		$this->input = $input = str_replace("\r\n", "\n", $input);
 		$this->offset = 0;
 		$this->line = 1;

programming_language: PHP
filename: Parser.errors.phpt
change_type: ModificationType.MODIFY
diff: @@ -60,3 +60,10 @@
 	$parser->parse("\n{");
 }, Latte\CompileException::class, 'Malformed tag.');
 Assert::same(2, $parser->getLine());
+
+
+Assert::error(function () use (&$res) {
+	$parser = new Parser;
+	$res = $parser->parse("a\x00\x1F\x7Fb");
+}, E_USER_WARNING, 'Template contains control character \x0 on line 1.');
+Assert::same('ab', $res[0]->text);

programming_language: PHP
CVE-2023-5535 (published 2023-10-11T20:15Z)

Use After Free in GitHub repository vim/vim prior to v9.0.2010.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Christian Brabandt
author_date: 2023-10-11 21:08:13+02:00
msg: patch 9.0.2010: [security] use-after-free from buf_contents_changed()

Problem:  [security] use-after-free from buf_contents_changed()
Solution: block autocommands

Signed-off-by: Christian Brabandt <cb@256bit.org>
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: buffer.c
change_type: ModificationType.MODIFY
diff: @@ -6013,6 +6013,9 @@ buf_contents_changed(buf_T *buf)
 	return TRUE;
     }
 
+    // We don't want to trigger autocommands now, they may have nasty
+    // side-effects like wiping buffers
+    block_autocmds();
     if (ml_open(curbuf) == OK
 	    && readfile(buf->b_ffname, buf->b_fname,
 				  (linenr_T)0, (linenr_T)0, (linenr_T)MAXLNUM,
@@ -6038,6 +6041,8 @@ buf_contents_changed(buf_T *buf)
     if (curbuf != newbuf)	// safety check
 	wipe_buffer(newbuf, FALSE);
 
+    unblock_autocmds();
+
     return differ;
 }
 

programming_language: C
filename: test_crash.vim
change_type: ModificationType.MODIFY
diff: @@ -78,6 +78,14 @@ func Test_crash1()
     \ '  && echo "crash 9: [OK]" >> X_crash1_result.txt' .. "\<cr>")
   call TermWait(buf, 1000)
 
+  let file = 'crash/editing_arg_idx_POC_1'
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args ..
+    \ '  || echo "crash 10: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+  call TermWait(buf, 1000)
+  call delete('Xerr')
+  call delete('@')
+
   " clean up
   exe buf .. "bw!"
 
@@ -93,6 +101,7 @@ func Test_crash1()
       \ 'crash 7: [OK]',
       \ 'crash 8: [OK]',
       \ 'crash 9: [OK]',
+      \ 'crash 10: [OK]',
       \ ]
 
   call assert_equal(expected, getline(1, '$'))

programming_language: Shell
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2010,
 /**/
     2009,
 /**/

programming_language: Ruby
CVE-2024-29898 (published 2024-03-28T14:15Z)

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the `(read)` permission. This vulnerability is fixed in 8f8442ed5299510ea3e58416004b9334134c149c.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/miraheze/CreateWiki
commit_details: repo_url: https://github.com/miraheze/CreateWiki
author: Alex
author_date: 2024-03-27 21:50:50+01:00
msg: Remove checks for `(read)` (#497)

Unnecessary checks, since if the user doesn't have this perm it should
not be able to reach the special pages or APIs to begin with.
repository: repo_url: https://github.com/miraheze/CreateWiki
repo_name: miraheze/CreateWiki
description: The extension used at Miraheze for requesting & creating wikis
repo_language: PHP
owner: miraheze
file_changes: filename: RestWikiRequest.php
change_type: ModificationType.MODIFY
diff: @@ -68,7 +68,7 @@ class RestWikiRequest extends SimpleHandler {
 			 * being revealed to local suppressors/sysops
 			 */
 
-			if ( $wikiRequestVisibility !== 'read' && $this->getAuthority()->isAllowed( 'read' ) ) {
+			if ( $wikiRequestVisibility !== 'read' ) {
 				if ( !$this->getAuthority()->isAllowedAll( 'createwiki', $wikiRequestVisibility ) ) {
 					// User does not have permission to view this request
 					return $this->getResponseFactory()->createHttpError( 404, ['message' => 'Request not found'] );

programming_language: PHP
filename: RequestWikiRequestViewer.php
change_type: ModificationType.MODIFY
diff: @@ -44,7 +44,7 @@ class RequestWikiRequestViewer {
 		// but if we can't view the request, it also doesn't exist
 		$permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
 
-		if ( $visibilityConds[$request->visibility] !== 'read' && $permissionManager->userHasRight( $userR, 'read' ) ) {
+		if ( $visibilityConds[$request->visibility] !== 'read' ) {
 			if ( !$permissionManager->userHasAllRights( $userR, 'createwiki', $visibilityConds[$request->visibility] ) ) {
 				$context->getOutput()->addHTML( Html::errorBox( wfMessage( 'requestwiki-unknown' )->escaped() ) );
 

programming_language: PHP
CVE-2023-50008 (published 2024-04-19T17:15Z)

Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the av_malloc function in libavutil/mem.c:105:9 component.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Paul B Mahol
author_date: 2023-11-27 12:08:20+01:00
msg: avfilter/vf_colorcorrect: fix memory leaks
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: vf_colorcorrect.c
change_type: ModificationType.MODIFY
diff: @@ -497,6 +497,8 @@ static av_cold void uninit(AVFilterContext *ctx)
     ColorCorrectContext *s = ctx->priv;
 
     av_freep(&s->analyzeret);
+    av_freep(&s->uhistogram);
+    av_freep(&s->vhistogram);
 }
 
 static const AVFilterPad colorcorrect_inputs[] = {

programming_language: C
CVE-2017-6349 (published 2017-02-27T07:59Z)

An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2017-02-26 18:11:36+01:00
msg: patch 8.0.0377: possible overflow when reading corrupted undo file

Problem:    Possible overflow when reading corrupted undo file.
Solution:   Check if allocated size is not too big. (King)
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: undo.c
change_type: ModificationType.MODIFY
diff: @@ -1787,7 +1787,7 @@ u_read_undo(char_u *name, char_u *hash, char_u *orig_name)
     linenr_T	line_lnum;
     colnr_T	line_colnr;
     linenr_T	line_count;
-    int		num_head = 0;
+    long	num_head = 0;
     long	old_header_seq, new_header_seq, cur_header_seq;
     long	seq_last, seq_cur;
     long	last_save_nr = 0;
@@ -1974,7 +1974,8 @@ u_read_undo(char_u *name, char_u *hash, char_u *orig_name)
      * When there are no headers uhp_table is NULL. */
     if (num_head > 0)
     {
-	uhp_table = (u_header_T **)U_ALLOC_LINE(
+	if (num_head < LONG_MAX / (long)sizeof(u_header_T *))
+	    uhp_table = (u_header_T **)U_ALLOC_LINE(
 					     num_head * sizeof(u_header_T *));
 	if (uhp_table == NULL)
 	    goto error;

programming_language: C
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    377,
 /**/
     376,
 /**/

programming_language: Ruby
CVE-2021-3796 (published 2021-09-15T13:15Z)

vim is vulnerable to Use After Free

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.3, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2021-09-11 21:14:20+02:00
msg: patch 8.2.3428: using freed memory when replacing

Problem:    Using freed memory when replacing. (Dhiraj Mishra)
Solution:   Get the line pointer after calling ins_copychar().
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: normal.c
change_type: ModificationType.MODIFY
diff: @@ -5099,19 +5099,23 @@ nv_replace(cmdarg_T *cap)
 	    {
 		/*
 		 * Get ptr again, because u_save and/or showmatch() will have
-		 * released the line.  At the same time we let know that the
-		 * line will be changed.
+		 * released the line.  This may also happen in ins_copychar().
+		 * At the same time we let know that the line will be changed.
 		 */
-		ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
 		if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
 		{
 		  int c = ins_copychar(curwin->w_cursor.lnum
 					   + (cap->nchar == Ctrl_Y ? -1 : 1));
+
+		  ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
 		  if (c != NUL)
 		    ptr[curwin->w_cursor.col] = c;
 		}
 		else
+		{
+		    ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
 		    ptr[curwin->w_cursor.col] = cap->nchar;
+		}
 		if (p_sm && msg_silent == 0)
 		    showmatch(cap->nchar);
 		++curwin->w_cursor.col;

programming_language: C
filename: test_edit.vim
change_type: ModificationType.MODIFY
diff: @@ -1895,4 +1895,16 @@ func Test_edit_revins()
   bw!
 endfunc
 
+" Test for getting the character of the line below after "p"
+func Test_edit_put_CTRL_E()
+  set encoding=latin1
+  new
+  let @" = ''
+  sil! norm orggRx
+  sil! norm pr
+  call assert_equal(['r', 'r'], getline(1, 2))
+  bwipe!
+  set encoding=utf-8
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -755,6 +755,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3428,
 /**/
     3427,
 /**/

programming_language: Ruby
CVE-2022-1718 (published 2022-09-29T03:15Z)

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/polonel/trudesk
commit_details: repo_url: https://github.com/polonel/trudesk
author: Chris Brame
author_date: 2022-05-14 15:39:02-04:00
msg: fix(account): security fix
repository: repo_url: https://github.com/polonel/trudesk
repo_name: polonel/trudesk
description:  :coffee: :seedling: Trudesk is an open-source help desk/ticketing solution.
repo_language: JavaScript
owner: polonel
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -17,6 +17,13 @@ const xss = require('xss')
 const fs = require('fs')
 const piexifjs = require('piexifjs')
 
+const MAX_FIELD_TEXT_LENGTH = 255
+const MAX_SHORT_FIELD_TEXT_LENGTH = 25
+
+module.exports.applyMaxShortTextLength = function (text) {
+  return text.toString().substring(0, MAX_SHORT_FIELD_TEXT_LENGTH)
+}
+
 module.exports.sanitizeFieldPlainText = function (text) {
   return xss(text, {
     whileList: {},

programming_language: JavaScript
filename: user.js
change_type: ModificationType.MODIFY
diff: @@ -90,11 +90,11 @@ userSchema.pre('findOne', autoPopulateRole).pre('find', autoPopulateRole)
 userSchema.pre('save', function (next) {
   var user = this
 
-  user.username = utils.sanitizeFieldPlainText(user.username.toLowerCase().trim())
+  user.username = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.username.toLowerCase().trim()))
   user.email = utils.sanitizeFieldPlainText(user.email.trim())
 
-  if (user.fullname) user.fullname = utils.sanitizeFieldPlainText(user.fullname.trim())
-  if (user.title) user.title = utils.sanitizeFieldPlainText(user.title.trim())
+  if (user.fullname) user.fullname = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.fullname.trim()))
+  if (user.title) user.title = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.title.trim()))
 
   if (!user.isModified('password')) {
     return next()

programming_language: JavaScript
CVE-2023-47637 (published 2023-11-15T20:15Z)

Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL.  One implementation of `getFilterCondition()` is in `Multiselect`, which does not normalize/escape/validate the passed value. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. This vulnerability has been addressed in version 11.1.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: robertSt7
author_date: 2023-11-07 09:27:56+01:00
msg: Fix: escape filter values
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: Multiselect.php
change_type: ModificationType.MODIFY
diff: @@ -302,8 +302,8 @@ class Multiselect extends Data implements
             }
 
             $value = $operator === '='
-                ? "'%,".$value.",%'"
-                : "'%,%".$value."%,%'";
+                ? $db->quote("%,". $value . ",%")
+                : $db->quote("%,%" .Helper::escapeLike($value). "%,%");
 
             return $key.' LIKE '.$value.' ';
         }

programming_language: PHP