Skip to content

Commit 702d5ee

Browse files
postmodernpostmodern
committed
title: should be parsed as a single line String.
* Also ensure that YAML stays within 80 columns.
1 parent 8b3fba3 commit 702d5ee

34 files changed

+49
-51
lines changed

Diff for: ‎CONTRIBUTING.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ bundle exec rspec
1818
cve: 2013-0156
1919
date: 2013-05-01
2020
url: https://github.com/rubysec/ruby-advisory-db/issues/123456
21-
title: |
21+
title:
2222
Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
2323
Remote Code Execution
2424

Diff for: ‎README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ Each advisory file contains the advisory information in [YAML] format:
2929
cve: 2013-0156
3030
date: 2013-05-01
3131
url: https://github.com/rubysec/ruby-advisory-db/issues/123456
32-
title: |
32+
title:
3333
Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
3434
Remote Code Execution
3535

@@ -69,9 +69,9 @@ Each advisory file contains the advisory information in [YAML] format:
6969
* `osvdb` \[Integer\] (optional): Open Sourced Vulnerability Database (OSVDB) ID.
7070
* `ghsa` \[String\] (optional): GitHub Security Advisory (GHSA) ID.
7171
* `url` \[String\] (required): The URL to the full advisory.
72-
* `title` \[String\] (required): The title of the advisory or individual vulnerability.
72+
* `title` \[String\] (required): The title of the advisory or individual vulnerability. It must be a single line sentence.
7373
* `date` \[Date\] (required): The public disclosure date of the advisory.
74-
* `description` \[String\] (required): One or more paragraphs describing the vulnerability.
74+
* `description` \[String\] (required): One or more paragraphs describing the vulnerability. It may contain multiple paragraphs.
7575
* `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
7676
* `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability.
7777
* `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the

Diff for: ‎gems/activerecord-jdbc-adapter/OSVDB-114854.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ gem: activerecord-jdbc-adapter
33
platform: jruby
44
osvdb: 114854
55
url: http://osvdb.org/show/osvdb/114854
6-
title: |
6+
title:
77
ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub()
88
Function SQL Injection
99
date: 2013-02-25

Diff for: ‎gems/auto_awesomplete/OSVDB-132800.yml

+1-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
gem: auto_awesomplete
33
osvdb: 132800
44
url: https://github.com/Tab10id/auto_awesomplete/issues/2
5-
title: |
6-
auto_awesomplete Gem for Ruby allows arbitrary search execution
5+
title: auto_awesomplete Gem for Ruby allows arbitrary search execution
76
date: 2016-01-08
87
description: |
98
auto_awesomplete Gem for Ruby contains a flaw that is triggered when handling the

Diff for: ‎gems/auto_select2/OSVDB-132800.yml

+1-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
gem: auto_select2
33
osvdb: 132800
44
url: https://github.com/Loriowar/auto_select2/issues/4
5-
title: |
6-
auto_select2 Gem for Ruby allows arbitrary search execution
5+
title: auto_select2 Gem for Ruby allows arbitrary search execution
76
date: 2016-01-08
87
description: |
98
auto_select2 Gem for Ruby contains a flaw that is triggered when handling the

Diff for: ‎gems/doorkeeper/CVE-2014-8144.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ cve: 2014-8144
44
osvdb: 116010
55
ghsa: 685w-vc84-wxcx
66
url: https://groups.google.com/forum/#!topic/ruby-security-ann/5_VqJtNc8jw
7-
title: |
8-
Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0
9-
and earlier.
7+
title:
8+
Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0 and
9+
earlier.
1010
date: 2014-12-18
1111
description: |
1212
Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0

Diff for: ‎gems/doorkeeper/OSVDB-118830.yml

+1-3
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,7 @@
22
gem: doorkeeper
33
osvdb: 118830
44
url: http://www.osvdb.org/show/osvdb/118830
5-
title: |
6-
Doorkeeper Gem for Ruby stores sensitive information
7-
in production logs
5+
title: Doorkeeper Gem for Ruby stores sensitive information in production logs
86
date: 2015-02-10
97
description: |
108
Doorkeeper Gem for Ruby contains a flaw in lib/doorkeeper/engine.rb.

Diff for: ‎gems/ember-source/CVE-2013-4170.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
gem: ember-source
33
cve: 2013-4170
44
url: https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM
5-
title: |
5+
title:
66
Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
77
date: 2013-07-25
88
description: |

Diff for: ‎gems/ember-source/CVE-2014-0013.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ gem: ember-source
33
cve: 2014-0013
44
ghsa: 8xm3-gm7c-5fjx
55
url: https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4
6-
title: |
6+
title:
77
Ember.js Potential XSS Exploit With User-Supplied Data When Binding
88
Primitive Values
99
date: 2014-01-14

Diff for: ‎gems/ember-source/CVE-2014-0014.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ gem: ember-source
33
cve: 2014-0014
44
ghsa: rcx6-7jp6-pqf2
55
url: https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4
6-
title: |
6+
title:
77
Ember.js Potential XSS Exploit With User-Supplied Data When Using {{group}}
88
Helper
99
date: 2014-01-14

Diff for: ‎gems/flavour_saver/OSVDB-110796.yml

+1-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
gem: flavour_saver
33
osvdb: 110796
44
url: http://osvdb.org/show/osvdb/110796
5-
title: |
6-
FlavourSaver handlebars helper remote code execution.
5+
title: FlavourSaver handlebars helper remote code execution.
76
date: 2014-09-04
87
description: |
98
FlavourSaver contains a flaw in helper method dispatch where it uses

Diff for: ‎gems/gollum-grit_adapter/CVE-2014-9489.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
gem: gollum-grit_adapter
33
cve: 2014-9489
44
url: https://github.com/gollum/gollum/issues/913
5-
title: |
5+
title:
66
gollum-grit_adapter Search Functionality Allows Arbitrary Command
77
Execution
88
date: 2014-12-04

Diff for: ‎gems/json-jwt/CVE-2019-18848.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ cve: 2019-18848
44
ghsa: cff7-6h4q-q5pj
55
url: https://github.com/nov/json-jwt/commit/ada16e772906efdd035e3df49cb2ae372f0f948a
66
date: 2019-11-14
7-
title: |
8-
json-jwt improper input validation due to lack of element count when
9-
splitting string
7+
title:
8+
json-jwt improper input validation due to lack of element count when splitting
9+
string
1010
description: |
1111
The json-jwt gem before 1.11.0 for Ruby lacks an element count during
1212
the splitting of a JWE string.

Diff for: ‎gems/mail/CVE-2011-0739.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ cve: 2011-0739
44
osvdb: 70667
55
ghsa: cpjc-p7fc-j9xh
66
url: https://nvd.nist.gov/vuln/detail/CVE-2011-0739
7-
title: |
8-
Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb Email From:
9-
Address Arbitrary Shell Command Injection
7+
title:
8+
"Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb Email From:
9+
Address Arbitrary Shell Command Injection"
1010
date: 2011-01-25
1111
description: |
1212
Mail Gem for Ruby contains a flaw related to the failure to properly sanitise

Diff for: ‎gems/nokogiri/OSVDB-118481.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ gem: nokogiri
33
platform: jruby
44
osvdb: 118481
55
url: https://github.com/sparklemotion/nokogiri/pull/1087
6-
title: |
6+
title:
77
Nokogiri Gem for JRuby XML Document Root Element Handling Memory Consumption
88
Remote DoS
99
date: 2014-04-30

Diff for: ‎gems/paperclip/CVE-2017-0889.yml

+4-3
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ gem: paperclip
33
cve: 2017-0889
44
ghsa: 5jcf-c5rg-rmm8
55
url: https://github.com/thoughtbot/paperclip/pull/2435
6-
title: |
7-
Paperclip ruby gem suffers from a Server-Side Request Forgery (SSRF) vulnerability
8-
in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter class.
6+
title:
7+
Paperclip ruby gem suffers from a Server-Side Request Forgery (SSRF)
8+
vulnerability in the Paperclip::UriAdapter and
9+
Paperclip::HttpUrlProxyAdapter class.
910
date: 2018-01-23
1011
description: |
1112
Paperclip gem provides multiple ways a file can be uploaded to a web server.

Diff for: ‎gems/rack-attack/OSVDB-132234.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
gem: rack-attack
33
osvdb: 132234
44
url: https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1
5-
title: |
5+
title:
66
rack-attack Gem for Ruby missing normalization before request path
77
processing
88
date: 2015-12-18

Diff for: ‎gems/rubygems-update/CVE-2015-4020.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ gem: rubygems-update
33
library: rubygems
44
cve: 2015-4020
55
url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478
6-
title: |
6+
title:
77
RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record
88
Hostname Validation Request Hijacking
99
date: 2015-06-08

Diff for: ‎gems/sidekiq-pro/OSVDB-126329.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
gem: sidekiq-pro
33
osvdb: 126329
44
url: https://github.com/mperham/sidekiq/commit/a695ff347ae50f641dfc35189131b232ea0aa1db
5-
title: |
5+
title:
66
Sidekiq Pro Gem for Ruby web/views/batch.erb Class and ErrorMessage Elements
77
Reflected XSS
88
date: 2015-05-11

Diff for: ‎gems/sidekiq-pro/OSVDB-126330.yml

+1-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
gem: sidekiq-pro
33
osvdb: 126330
44
url: https://github.com/mperham/sidekiq/commit/99b12fb50fe244c5a317f03f1bed9b333ec56ebe
5-
title: |
6-
Sidekiq Pro Gem for Ruby web/views/batch{,es}.erb Description Element XSS
5+
title: Sidekiq Pro Gem for Ruby web/views/batch{,es}.erb Description Element XSS
76
date: 2014-10-13
87
description: XSS via batch description in Sidekiq::Web
98
patched_versions:

Diff for: ‎gems/sidekiq/OSVDB-125676.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
gem: sidekiq
33
osvdb: 125676
44
url: https://github.com/mperham/sidekiq/issues/2330
5-
title: |
5+
title:
66
Sidekiq Gem for Ruby web/views/queue.erb CurrentMessagesInQueue Element
77
Reflected XSS
88
date: 2015-06-04

Diff for: ‎gems/spree/CVE-2008-7310.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ cve: 2008-7310
44
osvdb: 81505
55
ghsa: 7h48-m3rw-vr27
66
url: https://spreecommerce.com/blog/security-vulnerability-mass-assignment
7-
title: "Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation"
7+
title:
8+
Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation
89
date: 2008-09-22
910
description: |
1011
Spree contains a hash restriction weakness that occurs when parsing a

Diff for: ‎gems/spree/CVE-2008-7311.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ cve: 2008-7311
44
osvdb: 81506
55
ghsa: g466-57gh-cqfw
66
url: https://spreecommerce.com/blog/security-vulernability-session-cookie-store
7-
title: |
7+
title:
88
Spree Hardcoded config.action_controller_session Hash Value Cryptographic
99
Protection Weakness
1010
date: 2008-08-12

Diff for: ‎gems/spree/CVE-2010-3978.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ cve: 2010-3978
44
osvdb: 69098
55
ghsa: hwrx-wc75-mgh7
66
url: https://spreecommerce.com/blog/json-hijacking-vulnerability
7-
title: |
7+
title:
88
Spree Multiple Script JSON Request Validation Weakness Remote Information
99
Disclosure
1010
date: 2010-11-02

Diff for: ‎gems/spree/CVE-2013-2506.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ gem: spree
33
cve: 2013-2506
44
osvdb: 90865
55
url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
6-
title: |
6+
title:
77
Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege
88
Escalation
99
date: 2013-02-21

Diff for: ‎gems/spree/OSVDB-125699.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
gem: spree
33
osvdb: 125699
44
url: https://spreecommerce.com/blog/security-updates-2015-7-28
5-
title: |
5+
title:
66
Spree RABL templates rendering allows Arbitrary Code Execution and File
77
Disclosure
88
date: 2015-07-28

Diff for: ‎gems/spree/OSVDB-125701.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
gem: spree
33
osvdb: 125701
44
url: https://spreecommerce.com/blog/security-updates-2015-7-20
5-
title: |
5+
title:
66
Spree RABL templates rendering allows Arbitrary Code Execution and File
77
Disclosure
88
date: 2015-07-20

Diff for: ‎gems/spree/OSVDB-125712.yml

+1-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
gem: spree
33
osvdb: 125712
44
url: https://spreecommerce.com/blog/security-issue-all-versions
5-
title: |
6-
Product Scopes could allow for unauthenticated remote command execution
5+
title: Product Scopes could allow for unauthenticated remote command execution
76
date: 2012-07-02
87
description: |
98
Product Scopes could allow for unauthenticated remote command execution.

Diff for: ‎gems/spree/OSVDB-125713.yml

+1-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
gem: spree
33
osvdb: 125713
44
url: https://spreecommerce.com/blog/security-issue-all-versions
5-
title: |
6-
Potential XSS vulnerability related to the analytics dashboard
5+
title: Potential XSS vulnerability related to the analytics dashboard
76
date: 2012-07-02
87
description: |
98
Spree has a flaw in its analytics dashboard where keywords are not escaped,

Diff for: ‎gems/spree/OSVDB-76011.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
gem: spree
33
osvdb: 76011
44
url: https://spreecommerce.com/blog/remote-command-product-group
5-
title: |
5+
title:
66
Spree Search ProductScope Class search[send][] Parameter Arbitrary Command
77
Execution
88
date: 2011-10-05

Diff for: ‎gems/spree_auth/CVE-2013-2506.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ gem: spree_auth
33
cve: 2013-2506
44
osvdb: 90865
55
url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
6-
title: |
6+
title:
77
Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege
88
Escalation
99
date: 2013-02-21

Diff for: ‎rubies/ruby/CVE-2011-3009.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
engine: ruby
33
cve: 2011-3009
44
url: https://osdir.com/ml/lang-ruby-core/2011-01/msg00917.html
5-
title: |
5+
title:
66
Ruby Properly initialize the random number generator when forking new process
77
date: 2011-07-02
88
description: |

Diff for: ‎rubies/ruby/CVE-2012-4481.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
engine: ruby
33
cve: 2012-4481
44
url: http://www.openwall.com/lists/oss-security/2012/10/05/2
5-
title: |
5+
title:
66
Ruby incomplete fix for CVE-2011-1005 for NameError#to_s method when used on
77
objects
88
date: 2012-10-05

Diff for: ‎spec/advisory_example.rb

+4
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,10 @@
110110

111111
it { is_expected.to be_kind_of(String) }
112112
it { is_expected.not_to be_empty }
113+
114+
it "must be one line" do
115+
is_expected.to_not include("\n")
116+
end
113117
end
114118

115119
describe "date" do

0 commit comments

Comments
 (0)