troubadix 25.3.0__tar.gz → 25.3.2__tar.gz

{troubadix-25.3.0 → troubadix-25.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: troubadix
-Version: 25.3.0
+Version: 25.3.2
 Summary: A linting and QA check tool for NASL files
 License: GPL-3.0-or-later
 Author: Greenbone
@@ -21,6 +21,7 @@ Requires-Dist: chardet (>=4,<6)
 Requires-Dist: charset-normalizer (>=3.2.0,<4.0.0)
 Requires-Dist: codespell (==2.4.1)
 Requires-Dist: gitpython (>=3.1.31,<4.0.0)
+Requires-Dist: networkx (>=3.4.2,<4.0.0)
 Requires-Dist: pontos (>=22.7,<26.0)
 Requires-Dist: python-magic (>=0.4.25,<0.5.0)
 Requires-Dist: validators (>=0.34.0,<0.35.0)

{troubadix-25.3.0 → troubadix-25.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "troubadix"
-version = "25.3.0"
+version = "25.3.2"
 description = "A linting and QA check tool for NASL files"
 authors = ["Greenbone <info@greenbone.net>"]
 license = "GPL-3.0-or-later"
@@ -32,6 +32,7 @@ chardet = ">=4,<6"
 validators = "^0.34.0"
 gitpython = "^3.1.31"
 charset-normalizer = "^3.2.0"
+networkx = "^3.4.2"
 
 [tool.poetry.group.dev.dependencies]
 autohooks = ">=21.7.0"
@@ -81,6 +82,7 @@ troubadix-changed-cves = 'troubadix.standalone_plugins.changed_cves:main'
 troubadix-allowed-rev-diff = 'troubadix.standalone_plugins.allowed_rev_diff:main'
 troubadix-file-extensions = 'troubadix.standalone_plugins.file_extensions:main'
 troubadix-deprecate-vts = 'troubadix.standalone_plugins.deprecate_vts:main'
+troubadix-dependency-graph = 'troubadix.standalone_plugins.dependency_graph.dependency_graph:main'
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]

troubadix-25.3.2/tests/standalone_plugins/nasl/21.04/21_script.nasl

@@ -0,0 +1,6 @@
+if(description)
+{
+  script_category(ACT_GATHER_INFO);
+  script_dependencies( "foo.nasl" );
+  exit(0);
+}

troubadix-25.3.2/tests/standalone_plugins/nasl/22.04/22_script.nasl

@@ -0,0 +1,6 @@
+if(description)
+{
+  script_category(ACT_GATHER_INFO);
+  script_dependencies( "foo.nasl" );
+  exit(0);
+}

troubadix-25.3.2/tests/standalone_plugins/nasl/common/bar.nasl

@@ -0,0 +1,10 @@
+if(description)
+{
+  script_category(ACT_GATHER_INFO);
+  script_dependencies( "foo.nasl", "foo.nasl" );
+
+  if(FEED_NAME == "GSF" || FEED_NAME == "GEF" || FEED_NAME == "SCM")
+    script_dependencies("gsf/enterprise_script.nasl");
+
+  exit(0);
+}

troubadix-25.3.2/tests/standalone_plugins/nasl/common/foo.nasl

@@ -0,0 +1,8 @@
+if(description)
+{
+  script_category(ACT_ATTACK);
+  script_dependencies( "foobar.nasl", "gsf/enterprise_script.nasl" );
+  exit(0);
+}
+
+script_dependencies( "missing.nasl" );

troubadix-25.3.2/tests/standalone_plugins/nasl/common/foobar.nasl

@@ -0,0 +1,7 @@
+if(description)
+{
+  script_category(ACT_GATHER_INFO);
+  script_dependencies( "bar.nasl" );
+  exit(0);
+  script_tag(name:"deprecated", value:TRUE);
+}

troubadix-25.3.2/tests/standalone_plugins/nasl/common/gsf/enterprise_script.nasl

@@ -0,0 +1,5 @@
+if(description)
+{
+  script_category(ACT_GATHER_INFO);
+  exit(0);
+}

troubadix-25.3.2/tests/standalone_plugins/test_dependency_graph.py

@@ -0,0 +1,201 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-FileCopyrightText: 2024 Greenbone AG
+import os
+import unittest
+from io import StringIO
+from pathlib import Path
+from unittest.mock import patch
+
+from troubadix.plugins.dependency_category_order import VTCategory
+from troubadix.standalone_plugins.dependency_graph.cli import parse_args
+from troubadix.standalone_plugins.dependency_graph.dependency_graph import (
+    Reporter,
+    create_graph,
+    determine_feed,
+    extract_category,
+    extract_dependencies,
+    get_feed,
+    get_scripts,
+    main,
+)
+from troubadix.standalone_plugins.dependency_graph.models import (
+    Dependency,
+    Feed,
+    Result,
+    Script,
+)
+
+
+class TestReporter(unittest.TestCase):
+    def setUp(self):
+        self.result = Result(
+            name="TestScript",
+            warnings=["duplicate dependencies"],
+            errors=["missing dependencies"],
+        )
+
+    @patch("sys.stdout", new_callable=StringIO)
+    def test_report_verbosity_2(self, mock_stdout):
+        reporter = Reporter(verbosity=2)
+        reporter.report([self.result])
+
+        output = mock_stdout.getvalue()
+
+        self.assertIn("TestScript - warnings: 1, errors: 1", output)
+        self.assertIn("warning: duplicate dependencies", output)
+        self.assertIn("error: missing dependencies", output)
+
+
+class TestCLIArgs(unittest.TestCase):
+    @patch(
+        "sys.argv",
+        [
+            "prog",
+            "--root",
+            "tests/standalone_plugins/nasl",
+            "--feed",
+            "feed_22_04",
+            "--log",
+            "info",
+        ],
+    )
+    def test_parse_args_ok(self):
+        args = parse_args()
+        self.assertEqual(args.root, Path("tests/standalone_plugins/nasl"))
+        self.assertEqual(args.feed, [Feed.FEED_22_04])
+        self.assertEqual(args.log, "info")
+
+    @patch("sys.stderr", new_callable=StringIO)
+    @patch("sys.argv", ["prog", "--root", "not_real_dir"])
+    def test_parse_args_no_dir(self, mock_stderr):
+        with self.assertRaises(SystemExit):
+            parse_args()
+        self.assertRegex(mock_stderr.getvalue(), "invalid directory_type")
+
+    @patch("sys.stderr", new_callable=StringIO)
+    @patch(
+        "sys.argv",
+        [
+            "prog",
+            "--root",
+            "tests/standalone_plugins/nasl",
+            "--feed",
+            "invalid_feed",
+        ],
+    )
+    def test_parse_args_invalid_feed(self, mock_stderr):
+        with self.assertRaises(SystemExit):
+            parse_args()
+        self.assertRegex(mock_stderr.getvalue(), "Invalid Feed value")
+
+    @patch.dict(os.environ, {"VTDIR": "/mock/env/path"})
+    @patch("sys.argv", ["prog"])
+    def test_parse_args_with_env(self):
+        args = parse_args()
+        self.assertEqual(args.root, Path("/mock/env/path"))
+
+    @patch("sys.argv", ["prog", "--root", "tests/standalone_plugins/nasl"])
+    def test_parse_args_defaults(self):
+        args = parse_args()
+        self.assertEqual(args.log, "WARNING")
+        self.assertEqual(args.feed, [Feed.FULL])
+
+
+class TestDependencyGraph(unittest.TestCase):
+
+    def setUp(self) -> None:
+        self.local_root = "tests/standalone_plugins/nasl"
+        self.script_content = """
+if(description)
+{
+  script_category(ACT_GATHER_INFO);
+  script_dependencies( "foo.nasl", "foo.nasl" );
+
+  if(FEED_NAME == "GSF" || FEED_NAME == "GEF" || FEED_NAME == "SCM")
+    script_dependencies("gsf/enterprise_script.nasl");
+
+  exit(0);
+}
+        """
+
+    def test_get_feed(self):
+        feed = [Feed.FULL]
+        scripts = get_feed(Path(self.local_root), feed)
+        self.assertEqual(len(scripts), 6)
+
+    @patch("pathlib.Path.read_text")
+    def test_get_scripts(self, mock_read_text):
+        mock_read_text.return_value = self.script_content
+        scripts = get_scripts(Path(self.local_root) / "common")
+        self.assertEqual(len(scripts), 4)
+        self.assertEqual(scripts[0].feed, "community")
+        self.assertEqual(len(scripts[0].dependencies), 3)
+        self.assertEqual(scripts[0].category, VTCategory.ACT_GATHER_INFO)
+        self.assertEqual(scripts[0].deprecated, False)
+
+    def test_determine_feed(self):
+        community_script = Path("foo/script.nasl")
+        enterprise_script = Path("gsf/script.nasl")
+
+        self.assertEqual(determine_feed(community_script), "community")
+        self.assertEqual(determine_feed(enterprise_script), "enterprise")
+
+    def test_extract_dependencies(self):
+        dependencies = extract_dependencies(self.script_content)
+        self.assertEqual(len(dependencies), 3)
+        self.assertEqual(dependencies[0].name, "foo.nasl")
+        self.assertEqual(dependencies[1].name, "foo.nasl")
+        self.assertEqual(dependencies[2].name, "gsf/enterprise_script.nasl")
+        self.assertEqual(dependencies[0].is_enterprise_feed, False)
+        self.assertEqual(dependencies[1].is_enterprise_feed, False)
+        self.assertEqual(dependencies[2].is_enterprise_feed, True)
+
+    def test_extract_category(self):
+        category = extract_category(self.script_content)
+        self.assertEqual(category, VTCategory.ACT_GATHER_INFO)
+
+    def test_create_graph(self):
+        dependency1 = Dependency("bar.nasl", False)
+        scripts = [
+            Script("foo.nasl", "community", [dependency1], 0, False),
+            Script("bar.nasl", "enterprise", [], 0, False),
+        ]
+        graph = create_graph(scripts)
+        self.assertEqual(len(list(graph.nodes)), 2)
+
+    @patch("sys.stdout", new_callable=StringIO)  # mock_stdout (second argument)
+    @patch("sys.stderr", new_callable=StringIO)  # mock_stderr (first argument)
+    @patch(
+        "sys.argv", ["prog", "--root", "tests/standalone_plugins/nasl", "-v"]
+    )  # no argument
+    def test_full_run(self, mock_stderr, mock_stdout):
+        return_code = main()
+        output = mock_stdout.getvalue()
+
+        self.assertIn("error: missing dependency file: missing.nasl:", output)
+        self.assertIn(
+            "error: cyclic dependency: ",  # order is random so can't match the output
+            output,
+        )
+        self.assertIn(
+            "error: unchecked cross-feed-dependency: foo.nasl(community feed) depends on"
+            " gsf/enterprise_script.nasl(enterprise feed), but the"
+            " current feed is not properly checked",
+            output,
+        )
+        self.assertIn(
+            "error: bar.nasl depends on foo.nasl which has a lower category order",
+            output,
+        )
+        self.assertIn(
+            "error: foo.nasl depends on deprecated script foobar.nasl", output
+        )
+        self.assertIn(
+            "warning: Duplicate dependencies in bar.nasl: foo.nasl", output
+        )
+        self.assertIn(
+            "warning: cross-feed-dependency: bar.nasl(community feed)"
+            " depends on gsf/enterprise_script.nasl(enterprise feed)",
+            output,
+        )
+        self.assertEqual(return_code, 1)

{troubadix-25.3.0 → troubadix-25.3.2}/tests/test_naslinter.py

@@ -44,6 +44,7 @@ class TestNASLinter(unittest.TestCase):
                 "**/templates/*/*.nasl",
                 "**/test_files/*",
                 "**/test_files/**/*.nasl",
+                "**/tests/standalone_plugins/**/*.nasl",
             ],
             include_patterns=["**/*.nasl", "**/*.inc"],
         )

{troubadix-25.3.0 → troubadix-25.3.2}/troubadix/__version__.py

@@ -2,4 +2,4 @@
 
 # THIS IS AN AUTOGENERATED FILE. DO NOT TOUCH!
 
-__version__ = "25.3.0"
+__version__ = "25.3.2"

{troubadix-25.3.0 → troubadix-25.3.2}/troubadix/argparser.py

@@ -26,6 +26,7 @@ from pathlib import Path
 from pontos.terminal import Terminal
 
 
+# allows non existent paths and directory paths
 def directory_type(string: str) -> Path:
     directory_path = Path(string)
     if directory_path.exists() and not directory_path.is_dir():
@@ -33,6 +34,15 @@ def directory_type(string: str) -> Path:
     return directory_path
 
 
+# allows only existing directory paths
+def directory_type_existing(string: str) -> Path:
+    directory_path = Path(string)
+    if not directory_path.is_dir():
+        raise ValueError(f"{string} is not a directory.")
+    return directory_path
+
+
+# allows non existent paths and file paths
 def file_type(string: str) -> Path:
     file_path = Path(string)
     if file_path.exists() and not file_path.is_file():
@@ -40,6 +50,14 @@ def file_type(string: str) -> Path:
     return file_path
 
 
+# allows only existing file paths
+def file_type_existing(string: str) -> Path:
+    file_path = Path(string)
+    if not file_path.is_file():
+        raise ValueError(f"{string} is not a file.")
+    return file_path
+
+
 def check_cpu_count(number: str) -> int:
     """Make sure this value is valid
     Default: use half of the available cores to not block the machine"""

{troubadix-25.3.0 → troubadix-25.3.2}/troubadix/codespell/codespell.exclude

@@ -34,6 +34,7 @@
 0x20:  C8 E6 AB 65 3B A9 5A 0E 14 00 00 05 41 44 4D 49    ...e;.Z.....ADMI
 0x20:  D5 A6 22 5D 33 E4 C6 0E 14 00 00 05 61 64 6D 69    .."]3.......admi
 0x40:  61 6C 64 6F 6D 61 69 6E 00 07 64 65 66 61 75 6C    aldomain..defaul
+0x40:  66 6C 61 74 65 3D 67 7A 69 70 0D 0A 66 69 6C 65    flate=gzip..file
 # 0x50:  72 6F 2E 70 72 6F 64 75 63 74 2E 64 65 76 69 63    ro.product.devic
 # 0x50:  74 72 69 6E 67 20 6D 69 73 73 69 6E 67 20 6F 72    tring missing or
 # 0x50:  75 65 73 74 3A 20 47 45 54 20 2F 20                uest: GET / # nb: Trailing space
@@ -231,6 +232,7 @@ Claus Wahlers reported that random images from GPU memory
                clen +
   clen = "567";
   clen = data_len( data:_ciphers );
+  - Cleo Streem
 "cliente",
 cmd = 'for usr in $(cut -d: -f1 /etc/shadow); do [[ $(chage --list $usr | grep \'^Last password change\' | cut -d: -f2) > $(date) ]] && echo "$usr :$(chage --list $usr | grep \'^Last password change\' | cut -d: -f2)"; done';
 cmd = "mount | grep -w ro";
@@ -262,6 +264,9 @@ Corrected a badly constracted file which could have allowed treating of
  could lead to shared memory segments of other users beeing freed
   cpe = build_cpe(value:appVer, exp:"^([0-9]\.[0-9]+\.[0-9]+)", base:"cpe:/a:shemes:grabit:");
     cpe = build_cpe(value:ver, exp:"^([0-9.]+)", base:"cpe:/a:mitre:ovaldi:");
+    cpe = build_cpe(value: vers, exp: "^([0-9.]+)", base: "cpe:/a:aprox:aproxengine:");
+      cpe = "cpe:/a:aprox:aproxengine";
+CPE = "cpe:/a:aprox:aproxengine";
 CPE = "cpe:/a:mapp:webtrekk:";
       cpe = "cpe:/a:mitre:ovaldi";
 CPE = "cpe:/a:netsparker:wass";
@@ -270,6 +275,7 @@ CPE:           cpe:/a:tawk:tawk.to_live_chat:0.8.0
     cpe =~ "^cpe:/o:hp:laserjet_pro_420[1-3](cdn|dn|dw|dne|dwe)_firmware") {
  CPU' could have occured because a retry loop continually finds the same
 crafted IFF ILBM file. NOTE: some of these details are obtained from
+crafted wLongsPerEntry or nEntriesInUse value in the indx chunk, which
       crapData = string("ALLO ", crap(length: 25000),"\r\n");
 crash) via a malformed file with UPack encoding (CVE-2009-1371).
 Create all system-defined macros defore processing command-line given
@@ -340,6 +346,7 @@ CVE-2020-36158: Fixed an issue wich might have allowed a remote
 CVE-2020-5208: Fixed multiple remote code executtion vulnerabilities
 CVE-2020-8492: Fixed a regular expression in urrlib that was prone to
 CVE-2021-30004: Fixed an issue where forging attacks might have occured
+  * CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
 dass eine geeignete Windows 8.1 Version, vorzugsweise eine 64-Bit Variante, eingesetzt werden muss.");
 "DataArchivingService/webcontent/aas",
   "/DataArchivingService/webcontent/aas/aas_store.jsp");
@@ -398,7 +405,7 @@ Enable log information of starting/stoping services. (bsc#1144923,
 <!-- Ende Message Box -->
   Engineering (TE) database and then a subsequent operation attempts to process these, rpd will
 Engineering (TE) tunnel's physical source interface is not propagated to hardware after the adjacency is lost.
-- ERRO[0000] Error creating docker key file: CreateKeyFile write root.key file failed. open /root/.docker/root.key: permission denied 
+- ERRO[0000] Error creating docker key file: CreateKeyFile write root.key file failed. open /root/.docker/root.key: permission denied
   eSpace IAD, eSpace U1981 and eSpace USM.");
   establishment of the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch
   exact-width integer types int{N}_t and uint{N}_t.
@@ -410,10 +417,13 @@ EXP=expext.dll
   expressions that are not properly handled by a stap script that
  * extended EAP-SIM/AKA fast re-authentication to allow use with FILS
 extended EAP-SIM/AKA fast re-authentication to allow use with FILS
+  - Extended HTTP methods: ACL, BASELINE-CONTROL, BIND, CHECKIN, CHECKOUT, COPY, LABEL, LINK, LOCK,
+extended_methods = make_list("ACL", "BASELINE-CONTROL", "BIND", "CHECKIN", "CHECKOUT", "COPY",
  external emulators, which may have cuased Xen to crash, resulting in a
 'facsimiletelephonenumber' to the Access Control Instruction (ACI) for user
   family_id = 'oval:org.mitre.oval:obj:99';
   family_xml = '\t\t<family_item xmlns="http://oval.mitre.org/XMLSchema/oval-sys' +
+      "Faroe Islands" : [ "FO", "English", "PAL", "(UTC+00:00) Dublin", 0 ],
 (FATE#312793, bnc#782369). The userland utilities were published seperately to support this feature.
 (FATE#313309) The ipset userland utility will be published seperately to support this feature.
 (FATE#314441). A seperate hyper-v package will be published to support this feature.
@@ -546,6 +556,7 @@ if (http_vuln_check(port: port, url: url, pattern: "<title>WAN Setup", check_hea
   if(!isnull(res = isdpkgvuln(pkg:"nd", ver:"0.5.0-1woody1", rls:"DEB3.0"))) {
   if(!isnull(res = isrpmvuln(pkg:"libell", rpm:"libell~0.26~1.fc31", rls:"FC31"))) {
 if( "Login successed" >< recv ) {
+  if (methods = egrep(pattern: "^([Aa]llow|[Pp]ublic)\s*:", string: res, icase: FALSE)) {
   if( model =~ "^(RICOH|LANIER|SAVIN|NRG)" && "Network Printer" >< model ) {
 if( ( model =~ '^RP200' || model =~ '^TE[3456]0' ) && revcomp( a: version, b: "v600r006c00spc500" ) < 0) {
 if( model =~ '^TE[3456]0' && revcomp( a: version, b: "v600r006c00spc500" ) < 0 ) {
@@ -565,7 +576,9 @@ if (prod =~ "^BMX\s*NOE\s*0110$") {
 if (prod =~ "^BMX\s*NOE\s*0110$" || prod =~ "^BMX\s*NOE\s*0110H$") {
 if (prod =~ "^BMX\s*NOE\s*0110" && version_is_less(version: version, test_version: "6.5")) {
 if (prod =~ "^BMX\s*NOE\s*0110" && version_is_less(version: version, test_version: "6.70")) {
+if (prod =~ "^BMX\s*NOE\s*0200") {
 if (!prod || (prod !~ "^BMX\s*P34" && prod !~ "^BMX\s*NOE\s*01[01]0"))
+if (!prod || (prod !~ "^BMX\s*P34" && prod !~ "^BMX\s*NOE\s*0(1[01]|20)0"))
 if (!prod || (prod !~ "^BMX\s*P34" && prod !~ "^BMX\s*NOR\s*0200H" && prod !~ "^BMX\s*NOE\s*0100" &&
 if( r =~ " (A\. A\. Milne|Albert Einstein|Anonimo|Antico proverbio cinese|Autor desconocido|Charles Dickens|Francisco de Quevedo y Villegas|George Bernard Shaw|Jaime Balmes|Johann Wolfgang von Goethe|Jil Sander|Juana de Asbaje|Konfucius|Lord Philip Chesterfield|Montaigne|Petrarca|Ralph Waldo Emerson|Seneca|Syrus|Werner von Siemens)" ||
   if(rcvRes && '>iAm[i]nE<' >< rcvRes)
@@ -585,6 +598,7 @@ if( "Server: Boa" >!< banner || ( "AirLive" >!< banner && banner !~ "(WL|MD|BU|P
 if (sysdesc =~ "^(RICOH|LANIER|SAVIN|NRG)" && (sysdesc =~ "(RICOH|LANIER|SAVIN|NRG) Network Printer" ||
 if ("<title>Cisco NFVIS</title>" >< res && 'content="Xenon Boostrap Admin Panel"' >< res) {
 if ("<title>COMfortel</title>" >< res && "/statics/script/pageChallenge.js" >< res) {
+  if( "<title>Login to Axis2:: Administartion page</title>" >< buf8 ||
         if( "[Xx]-[Aa]dobe-[Cc]ontent" >< pattern )
       if( "[Xx]-[Aa]dobe-[Cc]ontent" >< pattern )
 If you disable this policy setting, transcripting of PowerShell-based applications is disabled by
@@ -678,7 +692,9 @@ kJtP0F6mv/Afe/5s7yd3ZJ/72yT73NjLg0vWbmLkop6eOR+CKw4nxorWxpocAj0p
 # Kubernetes Dashboard Public WAN (Internet) Accessible
 L3: conring size for XEN HV's with huge memory to small. Inital Xen logs
 LAST_PATCH_UPDATE UpToDate
+  "leadin/readme.txt", "HubSpot#---#=== HubSpot -#---#Stable tag: ([0-9.]+)#---#cpe:/a:hubspot:hubspot",
  leaks because of a missing check when transfering pages via
+<li><a href="Status_Router.asp"><strong><script type="text/javascript">Capture(bmenu.statu)</script></strong></a></li>
 library: Increment to 7:0:1 No changes, no removals New fuctions:
 [link moved to references] has more informations.
 <link rel="stylesheet" href="/bui/base.css?v=GWAY-8.3.1-0086" />
@@ -718,6 +734,7 @@ Mark Shepard discovered a double free in the TCP listener cleanup which could re
 "messasges",
     "Metastasio (Ipermestra)" >< banner || '"\r\nAnonimo' >< banner || banner =~ '^"[^"]+" *Autor desconocido[ \t\r\n]*$' || "/usr/games/fortune: not found" >< banner ||
     "Metastasio (Ipermestra)" >< r || '"\r\nAnonimo' >< r || r =~ '^"[^"]+" *Autor desconocido[ \t\r\n]*$' ) {
+    methods = eregmatch(pattern: "^([Aa]llow|[Pp]ublic)\s*:\s*([A-Z,]+\s*([A-Z ,]+)?)", string: methods,
  MFSA 2012-27 / CVE-2012-0474: Security researchers Jordi Chancel and Eddy Bordi reported that they could short-circuit page loads to show the address of a different site than what is ... [Please see the references for more information on the vulnerabilities]");
  MFSA 2012-75 / CVE-2012-3984: Security researcher David Bloom of Cue discovered that 'select' elements are always-on-top chromeless windows and that navigation away from a page with an active 'select' menu does not remove this window.When another menu is opened programmatically on a new page, the original 'select' menu can be retained and arbitrary HTML content within it rendered, allowing an attacker to cover arbitrary portions of the new page through absolute positioning/scrolling, leading to spoofing attacks. Security researcher Jordi Chancel found a variation that would allow for click-jacking attacks was well.
  MFSA 2013-23 / CVE-2013-0765: Mozilla developer Boris Zbarsky reported that in some circumstances a wrapped WebIDL object can be wrapped multiple times, overwriting the existing wrapp... [Please see the references for more information on the vulnerabilities]");
@@ -863,6 +880,7 @@ reenable php7-dba support of Berkeley DB (bsc#1108554)");
 # Ref : http://www.hsc.fr/ressources/articles/win_net_srv/index.html.en by Jean-Baptiste Marchand
         register_and_report_cpe( app:"Netsparker - Web Application Security Scanner", ver:netVer, base:"cpe:/a:netsparker:wass:", expr:"^([0-9.]+)", insloc:netPath );
     register_and_report_cpe(app:"Wiesemann & Theis GmbH " + appName, ver:version, concluded:concluded,
+  * [REGRESSION] 'call into AER handling regardless of severity' triggers
     reg_xml = '\t\t<registry_item' + status + ' xmlns="http://oval.mitre.org/' +
 Reject invalid eliptic curve point coordinates (bsc#1131291)");
  rejection for EXTRAVERSION = -xfs, but likely little else will be
@@ -891,6 +909,7 @@ req = string("POST /UE/ProcessForm HTTP/1.1\r\n",
   res = http_get_cache(port: port, item: dir + "/product.comparision.php");
 - Restrict envrionment variable expansion to `ENV`, `ADD`, `COPY`,
   result = "Diese Vorgabe muss manuell ueberprueft werden.";
+  "resutls": {
                 return -1, "The following script_xref of VT '" + str(file) + "' is pointing to Mitre/NVD which is already covered by the script_cve_id. This is a redundant info and the script_xref needs to be removed:" + nvd_mitre_link_tags
   return("Diese Vorgabe muss manuell ueberprueft werden.");
         return make_list( "error", text_response + 'Ueberpruefung fehlgeschlagen. Die Verwendung der benoetigten win_cmd_exec Funktion wurde in "Options for Local Security Checks (OID: 1.3.6.1.4.1.25623.1.0.100509)" manuell deaktiviert.\n' );
@@ -939,6 +958,7 @@ SAML/CAS tokens in the session database, an attacker can open an anonymous
   script_mandatory_keys("Jasig CAS server/Installed");
   script_mandatory_keys("shttp/detected");
   script_mandatory_keys("telnet/huawei/te/detected");
+  script_mandatory_keys("wordpress/plugin/leadin/detected");
   script_mandatory_keys("wordpress/plugin/mailin/detected");
   script_name("Acronis Cyber Infrastructure (ACI) Detection (HTTP)");
   script_name("Acronis Cyber Infrastructure (ACI) RCE Vulnerability (SEC-6452)");
@@ -1002,6 +1022,7 @@ SAML/CAS tokens in the session database, an attacker can open an anonymous
   script_tag(name:"affected", value:"Petite Annonce version 1.0 is known to be affected. Other
   script_tag(name:"affected", value:"RV320 Dual Gigabit WAN VPN Router and RV325 Dual Gigabit WAN
   script_tag(name:"affected", value:"RV320 Dual Gigabit WAN VPN Router and RV325 Dual Gigabit WAN VPN Router.");
+  script_tag(name:"affected", value:"Symantec Encryption Management Server (SEMS)
   script_tag(name:"affected", value:"tre on Fedora 23");
   script_tag(name:"affected", value:"tre on Fedora 24");
   script_tag(name:"affected", value:"tre on Fedora 25");
@@ -1042,6 +1063,7 @@ SAML/CAS tokens in the session database, an attacker can open an anonymous
   script_tag(name:"insight", value:"Federico Manuel Bento discovered that the Linux kernel did not properly
   script_tag(name:"insight", value:"FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN contain two bugs when
   script_tag(name:"insight", value:"In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.
+  script_tag(name:"insight", value:"It was discovered that a race condition existed in the ARC EMAC ethernet
   script_tag(name:"insight", value:"It was discovered that a specially-crafted packet sent to the racoon ipsec key exchange server could cause a tunnel to crash, resulting in a denial of service.
   script_tag(name:"insight", value:"It was discovered that the VLC CAF demuxer incorrectly handled certain
   script_tag(name:"insight", value:"James Troup discovered that MAAS stored RabbitMQ
@@ -1053,6 +1075,7 @@ SAML/CAS tokens in the session database, an attacker can open an anonymous
   script_tag(name:"insight", value:"Juraj Somorovsky, Robert Merget and Nimrod Aviram discovered a padding oracle attack in OpenSSL.
   script_tag(name:"insight", value:"Juraj Somorovsky, Robert Merget, and Nimrod Aviram discovered that certain
   script_tag(name:"insight", value:"libsoup without ca path added, accepted all SSL certificats as trusted. This has been fixed. CVE-2012-2132 has been assigned to this issue.
+  script_tag(name:"insight", value:"Local ABL Client bypass of the required PASOE security checks
   script_tag(name:"insight", value:"LSAT insecurely creates temporary files which can lead to symlink attacks
   script_tag(name:"insight", value:"Manuel Nickschas discovered that Konversation did not properly perform
   script_tag(name:"insight", value:"Meh Chang discovered that Exim incorrectly
@@ -1126,6 +1149,7 @@ SAML/CAS tokens in the session database, an attacker can open an anonymous
   script_tag(name:"summary", value:"Palo Alto PAN-OS is prone to a vulnerability in Panorama SD WAN.");
   script_tag(name:"summary", value:"Petite Annonce is prone to a cross-site scripting (XSS)
   script_tag(name:"summary", value:"Telnet based detection of Huawei TE (Telepresence and
+  script_tag(name:"summary", value:"The management console for Symantec Encryption Management Server (SEMS) is susceptible to potential OS command execution,
   script_tag(name:"summary", value:"The remote host is a SIP Express Router (SER).
   script_tag(name:"summary", value:"The remote host is missing an update for the 'Recommended udpate for SUSE Manager Client Tools' package(s) announced via the SUSE-SU-2016:1366-1 advisory.");
   script_tag(name:"summary", value:"The remote host is missing an update for the 'tre'
@@ -1471,6 +1495,7 @@ url = "/statics/html/index.htm";
 url = "/statics/pageChallenge.html";
       url = "/status/infomation.htm";
   url = string(dir, "/config.xml.sav");
+  url = string( dir, "/index.php?file=Liens&op=", raw_string( 0x22 ), "><script>window.alert('test');</script>" );
   url = string(openVer[2], "/obj/autorisation.class.php?path_om=../../../../../../../../vt-rfi.txt");
 url = "/UE/advanced.html";
 url = "/UE/welcome_login.html";
@@ -1578,4 +1603,3 @@ xml += string( '<oval_system_characteristics xmlns="http://oval.mitre.org/XMLSch
   - XSS via a crafted WAN name on the General Setup screen (CVE-2019-16534)");
   "^[Xx]-[Aa]dobe-[Cc]ontent\s*:\s*AEM" );
   Zhongling Wen discovered that the h323 conntrack handler did not correctly
-    * CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).

{troubadix-25.3.0 → troubadix-25.3.2}/troubadix/codespell/codespell.ignore

@@ -22,10 +22,14 @@ complies
 # mentioned here this correction is fully ingored.
 racoon
 # re-use vs. reuse currently unclear, e.g. there is the following from https://dict.leo.org/forum/viewGeneraldiscussion.php?idForum=4&idThread=5586&lp=ende&lang=en:
-# Not even the wise and educated English native speakers seem to have a rule on hyphenation and there are differences between BE and AE.
-# As e.g. the spelling correction in Mozilla Firefox is accepting both we're excluding this for now
+# > Not even the wise and educated English native speakers seem to have a rule on hyphenation and there are differences between BE and AE.
+# https://en.wiktionary.org/wiki/re-uses lists and https://en.wiktionary.org/wiki/re-use lists these as valid as well.
+# As e.g. the spelling correction in Mozilla Firefox is accepting all we're excluding this for now
 re-use
+re-used
+re-uses
 re-usable
+re-using
 # Bootup is commonly used in e.g. example output and seems to be also generally valid like seen on:
 # https://en.wiktionary.org/wiki/bootup
 # so it is ignored (at least for now)

{troubadix-25.3.0 → troubadix-25.3.2}/troubadix/plugins/dependencies.py

@@ -31,6 +31,20 @@ from troubadix.plugin import (
 )
 
 
+def split_dependencies(value: str) -> list[str]:
+    """
+    Remove single and/or double quotes, spaces
+    and create a list by using the comma as a separator
+    additionally, check and filter for inline comments
+    """
+    dependencies = []
+    for line in value.splitlines():
+        subject = line[: line.index("#")] if "#" in line else line
+        _dependencies = re.sub(r'[\'"\s]', "", subject).split(",")
+        dependencies += [dep for dep in _dependencies if dep != ""]
+    return dependencies
+
+
 class CheckDependencies(FilePlugin):
     name = "check_dependencies"
 
@@ -60,17 +74,7 @@ class CheckDependencies(FilePlugin):
 
         for match in matches:
             if match:
-                # Remove single and/or double quotes, spaces
-                # and create a list by using the comma as a separator
-                # additionally, check and filter for inline comments
-                dependencies = []
-
-                for line in match.group("value").splitlines():
-                    subject = line[: line.index("#")] if "#" in line else line
-                    _dependencies = re.sub(r'[\'"\s]', "", subject).split(",")
-                    dependencies += [dep for dep in _dependencies if dep != ""]
-
-                for dep in dependencies:
+                for dep in split_dependencies(match.group("value")):
                     if not any(
                         (root / vers / dep).exists() for vers in FEED_VERSIONS
                     ):

{troubadix-25.3.0 → troubadix-25.3.2}/troubadix/plugins/grammar.py

@@ -34,6 +34,7 @@ exceptions = [
     TextCheck("Multiple '/' Vulnerability"),
     TextCheck("an attackers choise"),
     TextCheck("multiple error handling vulnerabilities"),
+    TextCheck("multiple error messages"),
     # Like seen in 2022/debian/deb_dla_2981.nasl
     TextCheck("a multiple concurrency"),
     # From 2008/debian/deb_1017_1.nasl

{troubadix-25.3.0 → troubadix-25.3.2}/troubadix/plugins/spaces_before_dots.py

@@ -41,8 +41,8 @@ IGNORE = [
     "common/2008/freebsd/freebsdsa_cpio.nasl",
     "common/2008/freebsd/freebsdsa_cvs2.nasl",
     "common/2009/osc_photoGallery_sql_injection.nasl",
-    "common/2009/secpod_novell_edir_mult_vuln_jul09_lin.nasl",
-    "common/2009/secpod_novell_edir_mult_vuln_jul09_win.nasl",
+    "common/2009/gb_novell_edir_mult_vuln_jul09_lin.nasl",
+    "common/2009/gb_novell_edir_mult_vuln_jul09_win.nasl",
     "common/2010/freebsd/freebsd_3a7c5fc4.nasl",
     "common/2012/freebsd/freebsd_a4a809d8.nasl",
     "common/2015/amazon/alas-2014-455.nasl",

{troubadix-25.3.0 → troubadix-25.3.2}/troubadix/plugins/valid_oid.py

@@ -434,8 +434,8 @@ class CheckValidOID(FileContentPlugin):
             "2008/asterisk_pbx_guest_access_enabled.nasl",
             "2008/asterisk_null_pointer_dereference.nasl",
             "2008/goaheadwebserver_source_disclosure.nasl",
-            "2011/secpod_ibm_lotus_domino_rpc_auth_dos_vuln.nasl",
-            "2011/secpod_cubecart_mult_xss_and_sql_inj_vuln.nasl",
+            "2011/gb_ibm_lotus_domino_rpc_auth_dos_vuln.nasl",
+            "2011/gb_cubecart_mult_xss_and_sql_inj_vuln.nasl",
             "2016/gb_adobe_air_mult_vuln_feb16_macosx.nasl",
             "attic/gb_cybozu_garoon_mult_vuln_aug16.nasl",
             "2017/gb_openssh_mult_vuln_jan17_lin.nasl",

{troubadix-25.3.0 → troubadix-25.3.2}/troubadix/standalone_plugins/changed_oid.py

@@ -23,16 +23,10 @@ from argparse import ArgumentParser, Namespace
 from pathlib import Path
 from typing import Iterable
 
+from troubadix.argparser import file_type_existing
 from troubadix.standalone_plugins.common import git
 
 
-def file_type(string: str) -> Path:
-    file_path = Path(string)
-    if not file_path.is_file():
-        raise ValueError(f"{string} is not a file.")
-    return file_path
-
-
 def parse_args(args: Iterable[str]) -> Namespace:
     parser = ArgumentParser(
         description="Check for changed oid",
@@ -52,7 +46,7 @@ def parse_args(args: Iterable[str]) -> Namespace:
         "-f",
         "--files",
         nargs="+",
-        type=file_type,
+        type=file_type_existing,
         default=[],
         help=(
             "List of files to diff. "

troubadix-25.3.2/troubadix/standalone_plugins/dependency_graph/__init__.py

@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-FileCopyrightText: 2025 Greenbone AG