Items tagged: @github (60)

Recent Commits to smarty:master

  • 29/06/2026 6:47

    Security: validate nested stream wrapper in stream: resource (CWE-22)…

    wisskid
    Security: validate nested stream wrapper in stream: resource (CWE-22) (#1195)

The built-in stream: resource type let a template bypass Security stream
restrictions. BasePlugin::load() matches the 'stream' sysplugin before the
stream_get_wrappers()/isTrustedStream() check, so a resource such as
stream:php://filter/read=convert.base64-encode/resource=/path was opened by
StreamPlugin::getContent() via fopen() on the nested php:// wrapper without
ever validating it. This bypassed Security::$streams (including
Security::$streams = null) and allowed reading arbitrary local files.

Parse the wrapper scheme from the resolved path in StreamPlugin::getContent()
and validate it with Security::isTrustedStream() before fopen(), giving the
stream: resource the same check the direct wrapper path already receives.

Adds regression tests covering the disabled-streams bypass, the
not-on-allowlist case, and a positive test that an explicitly allowed wrapper
still works.
    Tags:

Recent Commits to requests

  • 31/05/2026 10:35

    Add AI Policy

    sigmavirus24
    Add AI Policy

The immense influx of low-quality pull requests, many of which are
duplicated tens of times, are creating unnecessary toil. As such, we now
need to spell out what used to be basic, decent, and reasonable open
source behaviour because many are just using LLMs to spam and reputation
farm instead of trying to make meaningful contributions.
    Tags:

elcio's Activity

Recent Commits to freecom:master

  • 27/09/2025 9:06

    support up to LASTDRIVE=32 (lDOS or patched MS-DOS v7)

    ecm-pushbx
    support up to LASTDRIVE=32 (lDOS or patched MS-DOS v7)

Changing to a drive or running DIR with only a drive letter and
colon didn't work. (DIR with drive letter, colon, backslash did
work already.) Without this patch applied:

C:\>]:
Bad command or filename - "]:".
C:\>dir ]:
File not found. - ']:'
C:\>dir ]:\
 Volume in drive ] is SRDXMS 2.10
 Directory of ]:\

LDEBUG   COM        94,208  09-19-25  6:35p
         1 file(s)         94,208 bytes
         0 dir(s)         948,224 bytes free

With this patch applied:

C:\>]:
]:\>dir ]:
 Volume in drive ] is SRDXMS 2.10

 Directory of ]:\

LDEBUG   COM        94,208  09-19-25  6:35p
         1 file(s)         94,208 bytes
         0 dir(s)         948,224 bytes free
    Tags:

plainspooky's Activity

Recent Commits to documents

elcio's Activity

Recent Commits to styleguide:gh-pages

  • 06/11/2024 7:53

    Update the HTML Document Type guidance (#862)

    tonyruscoe
    Update the HTML Document Type guidance (#862)

This update explicitly declares quirks mode to be against the style guide and strengthens the recommendation from “preferred” to “mandatory”. It also updates examples to use lowercase for consistency and clarifies that the style guide applies to Sass.
    Tags:

Recent Commits to documents

elcio's Activity

Recent Commits to python-fire:master

Recent Commits to kint:master

  • 09/09/2024 7:56

    Use more modern tricks

    jnvsor
    Use more modern tricks

We've got a few new features between 7.1 and 7.4 so this is nice.
Unfortunately we still have to use array_merge for arrays with
string keys since that wasn't supported until 8.1
    Tags:

Recent Commits to styleguide:gh-pages

  • 05/09/2024 17:32

    Update C++ style guide (#835)

    zetafunction
    Update C++ style guide (#835)

- Explicitly ban `long double`
- Use absl formatting libraries or `std::ostream` over printf-style
  functions.
- Portability: use serialization libraries instead of copying the
  in-memory representation.
- Update guidance to use `uintptr_t` (previously `intptr_t`) when
  working with pointers as integers.
- Ban C++20 modules.
- Ban coroutines (though this is expected to be temporary).
- Minor wording updates.
    Tags:

Recent Commits to kint:master

Recent Commits to awesome-php:master

  • 28/08/2024 19:11

    Update link for PHP_CodeSniffer

    jrfnl
    Update link for PHP_CodeSniffer

PHP_CodeSniffer is under new management since December last year.
See: https://github.com/squizlabs/PHP_CodeSniffer/issues/3932

The package is now maintained in the https://github.com/PHPCSStandards/PHP_CodeSniffer repo.
    Tags:
  • 28/08/2024 19:05

    Update phpDocumentor info

    jrfnl
    Update phpDocumentor info

* Fix to use the official name.
* Remove the version reference. Version 3 was released four years ago.
* Point the link to the official website, not the GH repo.
    Tags:

Recent Commits to kint:master

plainspooky's Activity

Gnustavo's Favorite Links from Diigo

plainspooky's Activity

Recent Commits to readexe:master

Recent Commits to python-patterns:master

  • 11/06/2024 2:29

    Update README.md

    azarboon
    Update README.md

Before diving into any of the patterns, readers should be reminded of two fundamental laws in software architecture:

1.Everything is a trade-ff
2."Why is more important than the how"

So, readers face the nuances and reality of these patterns from the beginning. These two laws are coined by two thought leaders in software architecture: Mark Richards and Neal Ford. They have explained these two laws in various conference talks and books. For example, Here you can read about these two laws here:

https://www.infoq.com/podcasts/software-architecture-hard-parts/


Also, here is a book for reference:
https://a.co/d/fKOodW9
    Tags:

Recent Commits to policies:main

Gnustavo's Favorite Links from Diigo

Recent Commits to awesome-php:master

Gnustavo's Favorite Links from Diigo

elcio's Activity

Recent Commits to Search-Replace-DB:master

  • 23/02/2024 15:50

    Fix unserialize() warnings, deprecated warnings.

    colinfoster
    Fix unserialize() warnings, deprecated warnings.

As of PHP 8.3 unserialize() triggers E_WARNING instead of E_NOTICE causing SRDB to dump thousands of notices to the screen as it tries to unserialized non-serialized strings. It now checks for serialized data before trying to unserialize.

Fixed Deprecation warning creating dynamic property: alter_collation.

Fixed Deprecation warning when passing null to htmlentities().
    Tags:

Recent Commits to sudo:main

  • 14/02/2024 17:07

    README.md: expand credit for original (#43)

    IanDarwin
    README.md: expand credit for original (#43)

* README.md: expand credit for original

Sudo was invented on Berkeley Unix on a VAX, and the current version is maintained by Todd Miller of the OpenBSD Unix project. It is thus correct to refer to the original as Unix/Linux as it is not a project originated by the Linux developers.

* Update README.md again, in ref to original sudo

Suggested by "omni" to have 'less occurrences of "Unix/Linux" in the README' - reads better this way.
    Tags:

Recent Commits to Mobile-Detect

Recent Commits to sudo:main

Gnustavo's Favorite Links from Diigo

Recent Commits to You-Dont-Need-Momentjs:master

Recent Commits to hypnotix:master

elcio's Activity

plainspooky's Activity

Recent Commits to python-patterns:master

plainspooky's Activity

elcio's Activity

plainspooky's Activity

elcio's Activity

plainspooky's Activity

Gnustavo's Favorite Links from Diigo

elcio's Activity

Gnustavo's Favorite Links from Diigo

plainspooky's Activity

Pinboard (brandizzi)

  • 27/01/2022 11:06

    Job Application for Junior Security Researcher at GitHub

    brandizzi
    RT @GitHubSecurity: GitHub is looking for a Junior Security Researcher to join our Security Lab team. As a member of the GitHub Security Lab you will make a direct impact on the security of the open source software the world depends on. #InfoSecJobs #Hiring #RemoteJob
    Tags:

plainspooky's Activity

Log in