Audit the following candidate code to determine whether it presents a real vulnerability.
This sample may come from a noisy retrieval or transformation stage, so reason from the supplied code and context rather than assuming the label.

Repository: git.kernel.org/pub/scm/linux/kernel/git/stable/linux
Language: C
File: drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
Function: mlx5_lag_unregister_hca_devcom_comp

Call path: mlx5_pci_err_detected (drivers/net/ethernet/mellanox/mlx5/core/main.c) → mlx5_unload_one (drivers/net/ethernet/mellanox/mlx5/core/main.c) → mlx5_unload_one_devl_locked (drivers/net/ethernet/mellanox/mlx5/core/main.c) → mlx5_detach_device (drivers/net/ethernet/mellanox/mlx5/core/dev.c) → mlx5_lag_remove_mdev (drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c) → mlx5_lag_unregister_hca_devcom_comp (drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c) → mlx5_devcom_unregister_component (drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c)

### Primary Function

```c
static void mlx5_lag_unregister_hca_devcom_comp(struct mlx5_core_dev *dev)
{
	mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp);
	dev->priv.hca_devcom_comp = NULL;
}
```

### Cross-File Context

[mlx5_devcom_unregister_component — sink — drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c:274]
```c
void mlx5_devcom_unregister_component(struct mlx5_devcom_comp_dev *devcom)
{
	if (!devcom)
		return;

	devcom_free_comp_dev(devcom);
}
```

[devcom_free_comp_dev — function — drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c:177]
```c
static void
devcom_free_comp_dev(struct mlx5_devcom_comp_dev *devcom)
{
	struct mlx5_devcom_comp *comp = devcom->comp;

	down_write(&comp->sem);
	list_del(&devcom->list);
	up_write(&comp->sem);

	kref_put(&devcom->devc->ref, mlx5_devcom_dev_release);
	kfree(devcom);
	kref_put(&comp->ref, mlx5_devcom_comp_release);
}
```

[MLX5_DEVCOM_HCA_PORTS — constant — drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h:28]
MLX5_DEVCOM_HCA_PORTS → MLX5_DEVCOM_HCA_PORTS  (drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h:28)

[hca_devcom_comp — field — struct mlx5_priv in drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h]
struct mlx5_devcom_comp_dev *hca_devcom_comp;

Control flow: The function follows a single linear execution path. It passes the pointer stored in dev->priv.hca_devcom_comp to mlx5_devcom_unregister_component. After the callee returns, it assigns NULL to dev->priv.hca_devcom_comp and exits.

Data flow: The value of dev->priv.hca_devcom_comp is read and passed to the unregister routine, which validates the pointer, removes it from internal lists, decrements reference counts, and frees the memory. Immediately after the unregister call returns, the field is overwritten with NULL, breaking the link to the deallocated object.

Verdict: Not Vulnerable

Reviewed region:
[drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c]
```c
static void mlx5_lag_unregister_hca_devcom_comp(struct mlx5_core_dev *dev)
{
	mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp);
	dev->priv.hca_devcom_comp = NULL;
}
```

Why it is not vulnerable: The code correctly assigns NULL to dev->priv.hca_devcom_comp immediately after calling mlx5_devcom_unregister_component. This sequence ensures that any subsequent access to the field will encounter a null pointer rather than a dangling reference to freed memory. The callee also safely handles null inputs, making the cleanup robust.

Security invariants:
- The pointer to the component must be cleared after the unregister call to prevent dangling references. Enforced by dev->priv.hca_devcom_comp = NULL;
- The unregister function must safely handle the pointer regardless of its state. Enforced by the null check if (!devcom) return; in mlx5_devcom_unregister_component

Invariant verification:
- Pointer nullification post-deallocation: holds=true. Evidence: The statement dev->priv.hca_devcom_comp = NULL; is placed directly after mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp);
- Safe handling of component pointer in callee: holds=true. Evidence: mlx5_devcom_unregister_component begins with if (!devcom) return;, preventing dereference of null pointers during cleanup

Residual risk notes: No latent concerns identified. The reference-counting mechanism in devcom_free_comp_dev manages the object's lifecycle independently, while the explicit null assignment in the caller securely severs the local reference.

Control flow: The function receives a mlx5_core_dev pointer, calls mlx5_devcom_unregister_component with dev->priv.hca_devcom_comp, then sets dev->priv.hca_devcom_comp to NULL. The callee mlx5_devcom_unregister_component first checks if the pointer is NULL and returns early if so. Otherwise, it calls devcom_free_comp_dev which acquires a write semaphore, removes the devcom from a list, decrements reference counts on both devcom->devc and comp, and frees devcom with kfree.

Data flow: The input is dev->priv.hca_devcom_comp (a struct mlx5_devcom_comp_dev pointer). This pointer value is passed by value to mlx5_devcom_unregister_component. Inside the callee, the pointer is checked for NULL, then used to access devcom->comp and devcom->list for list removal, and devcom->devc->ref for reference counting. After the callee returns, the original field dev->priv.hca_devcom_comp is set to NULL.

Verdict: Not Vulnerable

Reviewed region:
[drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c]
```c
static void mlx5_lag_unregister_hca_devcom_comp(struct mlx5_core_dev *dev)
{
	mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp);
	dev->priv.hca_devcom_comp = NULL;
}
```

Why it is not vulnerable: The pointer dev->priv.hca_devcom_comp is passed by value to mlx5_devcom_unregister_component before being set to NULL. The callee receives its own local copy of the pointer value, which remains valid throughout the callee's execution regardless of the caller subsequently setting the field to NULL. Additionally, the callee includes a NULL guard (if (!devcom) return;) that safely handles the case where the pointer is already NULL. The ordering ensures the callee always operates on a valid pointer value.

Security invariants:
- The pointer value must be passed to the callee before the field is set to NULL, ensuring the callee receives a valid copy. Enforced by: the call mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp) appears on line 1, and dev->priv.hca_devcom_comp = NULL appears on line 2.
- The callee must validate the pointer before dereferencing it. Enforced by: if (!devcom) return; at the start of mlx5_devcom_unregister_component.
- List modifications must be protected by proper synchronization. Enforced by: down_write(&comp->sem) before list_del(&devcom->list) and up_write(&comp->sem) after in devcom_free_comp_dev.
- Reference counts must be properly decremented to avoid use-after-free. Enforced by: kref_put(&devcom->devc->ref, mlx5_devcom_dev_release) and kref_put(&comp->ref, mlx5_devcom_comp_release) in devcom_free_comp_dev.

Invariant verification:
- Pointer validity before NULL assignment: holds=true. Evidence: The call mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp) passes the pointer value before dev->priv.hca_devcom_comp = NULL is executed, so the callee always receives the current pointer value.
- NULL pointer guard in callee: holds=true. Evidence: mlx5_devcom_unregister_component contains if (!devcom) return; as the first statement, preventing any dereference of a NULL pointer.
- List modification synchronization: holds=true. Evidence: devcom_free_comp_dev uses down_write(&comp->sem) before list_del(&devcom->list) and up_write(&comp->sem) after, ensuring exclusive access during list modification.
- Proper memory deallocation ordering: holds=true. Evidence: devcom_free_comp_dev calls kfree(devcom) after list removal and reference count decrements, ensuring the object is not accessed after being freed.

Residual risk notes: The analysis assumes that dev->priv.hca_devcom_comp is not concurrently modified by another thread between the function call and the NULL assignment. The write semaphore in devcom_free_comp_dev protects list operations, but the field dev->priv.hca_devcom_comp itself is set to NULL without explicit synchronization in this function. If concurrent access to this field is possible from other contexts, a memory barrier or additional locking may be warranted. However, based on the call path (mlx5_pci_err_detected through device detach), this appears to be a single-threaded teardown sequence.

```json
{
  "vulnerable": false,
  "cwe": null,
  "severity": "NONE",
  "reviewed_region": {
    "file_path": "drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c",
    "symbol": "mlx5_lag_unregister_hca_devcom_comp",
    "code": "static void mlx5_lag_unregister_hca_devcom_comp(struct mlx5_core_dev *dev)\n{\n\tmlx5_devcom_unregister_component(dev->priv.hca_devcom_comp);\n\tdev->priv.hca_devcom_comp = NULL;\n}"
  },
  "vulnerable_region": null,
  "root_cause": null,
  "exploitability": null,
  "attack_preconditions": [],
  "impact": "No concrete vulnerability impact is demonstrated in the supplied code and context.",
  "non_vulnerable_reason": "The pointer dev->priv.hca_devcom_comp is passed by value to mlx5_devcom_unregister_component before being set to NULL. The callee receives its own local copy of the pointer value, which remains valid throughout the callee's execution regardless of the caller subsequently setting the field to NULL. Additionally, the callee includes a NULL guard (if (!devcom) return;) that safely handles the case where the pointer is already NULL. The ordering ensures the callee always operates on a valid pointer value.",
  "security_invariants": [
    "The pointer value must be passed to the callee before the field is set to NULL, ensuring the callee receives a valid copy. Enforced by: the call mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp) appears on line 1, and dev->priv.hca_devcom_comp = NULL appears on line 2.",
    "The callee must validate the pointer before dereferencing it. Enforced by: if (!devcom) return; at the start of mlx5_devcom_unregister_component.",
    "List modifications must be protected by proper synchronization. Enforced by: down_write(&comp->sem) before list_del(&devcom->list) and up_write(&comp->sem) after in devcom_free_comp_dev.",
    "Reference counts must be properly decremented to avoid use-after-free. Enforced by: kref_put(&devcom->devc->ref, mlx5_devcom_dev_release) and kref_put(&comp->ref, mlx5_devcom_comp_release) in devcom_free_comp_dev."
  ],
  "invariant_verification": [
    {
      "property": "Pointer validity before NULL assignment",
      "holds": true,
      "evidence": "The call mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp) passes the pointer value before dev->priv.hca_devcom_comp = NULL is executed, so the callee always receives the current pointer value."
    },
    {
      "property": "NULL pointer guard in callee",
      "holds": true,
      "evidence": "mlx5_devcom_unregister_component contains if (!devcom) return; as the first statement, preventing any dereference of a NULL pointer."
    },
    {
      "property": "List modification synchronization",
      "holds": true,
      "evidence": "devcom_free_comp_dev uses down_write(&comp->sem) before list_del(&devcom->list) and up_write(&comp->sem) after, ensuring exclusive access during list modification."
    },
    {
      "property": "Proper memory deallocation ordering",
      "holds": true,
      "evidence": "devcom_free_comp_dev calls kfree(devcom) after list removal and reference count decrements, ensuring the object is not accessed after being freed."
    }
  ],
  "residual_risk_notes": "The analysis assumes that dev->priv.hca_devcom_comp is not concurrently modified by another thread between the function call and the NULL assignment. The write semaphore in devcom_free_comp_dev protects list operations, but the field dev->priv.hca_devcom_comp itself is set to NULL without explicit synchronization in this function. If concurrent access to this field is possible from other contexts, a memory barrier or additional locking may be warranted. However, based on the call path (mlx5_pci_err_detected through device detach), this appears to be a single-threaded teardown sequence.",
  "call_path": [
    "mlx5_pci_err_detected",
    "mlx5_unload_one",
    "mlx5_unload_one_devl_locked",
    "mlx5_detach_device",
    "mlx5_lag_remove_mdev",
    "mlx5_lag_unregister_hca_devcom_comp",
    "mlx5_devcom_unregister_component"
  ]
}
```


System:
You are a senior application security auditor reviewing code for potential vulnerabilities.

You will be given a candidate function, repository and file metadata, a reduced call path, and resolved cross-file context such as helper functions, structs, macros, constants, and related definitions. Use the supplied context actively, but stay strictly grounded in what is actually shown.

Work from the supplied code and surrounding context as the primary evidence. Do not assume a bug exists just because the sample was retrieved.

Analyze both control flow and data flow. Trace the relevant execution paths and track security-relevant data through inputs, transformations, conditions, helper calls, outputs, and side effects.

Reason about attacker influence, identify relevant guards or missing guards, and explain exploitability or non-exploitability before reaching a verdict.

When the code is vulnerable, explain the vulnerable behavior, root cause, realistic attack preconditions, likely impact, and the most precise vulnerability classification justified by the supplied code.

When the code is not vulnerable, explain the concrete invariants and guards that prevent the suspected issue, and note any residual uncertainty that remains from the supplied context.

Keep the analysis concrete and code-grounded. Separate observed evidence from inferred conclusion.

Audit the following candidate code to determine whether it presents a real vulnerability.
This sample may come from a noisy retrieval or transformation stage, so reason from the supplied code and context rather than assuming the label.

Repository: github.com/usmannasir/cyberpanel
Language: Python
File: databases/views.py
Function: restartMySQL

Call path: restartMySQL (databases/views.py) → mysqlUtilities.restartMySQL (plogical/mysqlUtilities.py) → ACLManager.loadedACL (plogical/acl.py) → ACLManager.loadErrorJson (plogical/acl.py)

### Primary Function

```python
def restartMySQL(request):
    try:
        userID = request.session['userID']
        finalData = mysqlUtilities.restartMySQL()
        currentACL = ACLManager.loadedACL(userID)

        if currentACL['admin'] == 1:
            pass
        else:
            return ACLManager.loadErrorJson('FilemanagerAdmin', 0)

        data = {}

        data['status'] = finalData[0]
        data['error_message'] = finalData[1]
        json_data = json.dumps(data)
        return HttpResponse(json_data)

    except KeyError:
        return redirect(loadLoginPage)
```

### Cross-File Context

[mysqlUtilities — module — databases/views.py:16]
from plogical.mysqlUtilities import mysqlUtilities

[ACLManager — module — databases/views.py:13]
from plogical.acl import ACLManager

[ACLManager.loadedACL — helper — plogical/acl.py]
ACLManager.loadedACL(userID)

[ACLManager.loadErrorJson — helper — plogical/acl.py]
ACLManager.loadErrorJson('FilemanagerAdmin', 0)

Provide the final verdict as strict JSON.

Return only one JSON object and no surrounding prose.

Return one JSON object with these keys:
- vulnerable
- cwe
- severity
- reviewed_region
- vulnerable_region
- root_cause
- exploitability
- attack_preconditions
- impact
- non_vulnerable_reason
- security_invariants
- invariant_verification
- residual_risk_notes
- call_path

Control flow: The request enters restartMySQL, extracts userID from session, calls mysqlUtilities.restartMySQL() immediately without authorization check, then checks if user is admin and returns error if not. The fix reorders to check admin status first before calling restartMySQL.

Data flow: userID flows from request.session to ACLManager.loadedACL. currentACL dict determines authorization. The vulnerable flow has restartMySQL() execute regardless of admin status.

Verdict: Vulnerable
Vulnerable region:
[databases/views.py]
```python
def restartMySQL(request):
    try:
        userID = request.session['userID']
        finalData = mysqlUtilities.restartMySQL()
        currentACL = ACLManager.loadedACL(userID)

        if currentACL['admin'] == 1:
            pass
        else:
            return ACLManager.loadErrorJson('FilemanagerAdmin', 0)

        data = {}

        data['status'] = finalData[0]
        data['error_message'] = finalData[1]
        json_data = json.dumps(data)
```
CWE: CWE-862
Severity: MEDIUM

Root cause: In databases/views.py restartMySQL function, the mysqlUtilities.restartMySQL() call is placed before the ACL admin verification check. Any authenticated user can invoke this endpoint and restart MySQL, even if they lack admin privileges.

Exploitability: An authenticated user with a valid session can call the /databases/restartMySQL endpoint and trigger MySQL restart without admin privileges.

Attack preconditions:
- Attacker must have an active user session in CyberPanel
- Attacker must be able to send HTTP requests to the vulnerable endpoint

Likely impact: An authenticated user with a valid session can call the /databases/restartMySQL endpoint and trigger MySQL restart without admin privileges.

Control flow: restartMySQL receives HTTP request, extracts userID from session, calls mysqlUtilities.restartMySQL() immediately, then checks admin ACL. If ACL fails, returns error but MySQL was already restarted.

Data flow: userID flows from request.session to ACLManager.loadedACL(). The ACL result (admin flag) is checked after mysqlUtilities.restartMySQL() has already executed.

Verdict: Vulnerable
Vulnerable region:
[databases/views.py]
```python
def restartMySQL(request):
    try:
        userID = request.session['userID']
        finalData = mysqlUtilities.restartMySQL()
        currentACL = ACLManager.loadedACL(userID)

        if currentACL['admin'] == 1:
            pass
        else:
            return ACLManager.loadErrorJson('FilemanagerAdmin', 0)

        data = {}

        data['status'] = finalData[0]
        data['error_message'] = finalData[1]
        json_data = json.dumps(data)
        return HttpResponse(json_data)
```
CWE: CWE-266
Severity: MEDIUM

Root cause: The restartMySQL view function calls mysqlUtilities.restartMySQL() before checking if the user has admin ACL. The ACL check happens after the MySQL restart operation has already been performed, meaning unauthorized users can trigger MySQL restarts.

Exploitability: An authenticated non-admin user can trigger MySQL restart by accessing the restartMySQL endpoint. The ACL check occurs after the restart operation, so the check cannot prevent the action.

Attack preconditions:
- Attacker must be authenticated to CyberPanel
- Attacker must have a valid session
- Attacker does NOT need admin ACL (the vulnerability allows bypass)

Likely impact: An authenticated non-admin user can trigger MySQL restart by accessing the restartMySQL endpoint. The ACL check occurs after the restart operation, so the check cannot prevent the action.


Audit the following candidate code to determine whether it presents a real vulnerability.
This sample may come from a noisy retrieval or transformation stage, so reason from the supplied code and context rather than assuming the label.

Repository: github.com/frappe/lms
Language: Python
File: lms/job/doctype/job_opportunity/job_opportunity.py
Function: validate_urls

Call path: JobOpportunity.validate (lms/job/doctype/job_opportunity/job_opportunity.py) → JobOpportunity.validate_urls (lms/job/doctype/job_opportunity/job_opportunity.py) → frappe.utils.validate_url (frappe.utils)

### Primary Function

```python
def validate_urls(self):
        validate_url(self.company_website, True, ["http", "https"])
```

### Cross-File Context

[JobOpportunity — class — lms/job/doctype/job_opportunity/job_opportunity.py:13]
class JobOpportunity(Document):

[JobOpportunity.validate_urls — caller — lms/job/doctype/job_opportunity/job_opportunity.py:18-19]
def validate_urls(self): validate_url(self.company_website, True, ["http", "https"])

[frappe.utils.validate_url — callee — frappe.utils]
```python
def validate_url(url, is_required=False, valid_prefixes=None):
```

[LMSAssignmentSubmission.validate_url — method — lms/lms/doctype/lms_assignment_submission/lms_assignment_submission.py:32-34]
def validate_url(self): if self.type == "URL" and not validate_url(self.answer, True, ["http", "https"]): frappe.throw(_("Please enter a valid URL."))

[LMSSettings.validate_contact_us_details — method — lms/lms/doctype/lms_settings/lms_settings.py:49-53]
def validate_contact_us_details(self): if self.contact_us_email and not validate_email_address(self.contact_us_email): frappe.throw(_("Please enter a valid Contact Us Email.")) if self.contact_us_url and not validate_url(self.contact_us_url, True, ["http", "https"]): frappe.throw(_("Please enter a valid Contact Us URL."))

Control flow: The function validate_urls has a single linear execution path: it invokes frappe.utils.validate_url with three arguments (self.company_website, True, and a list of allowed prefixes ["http", "https"]). There are no conditional branches, loops, or error-handling constructs in this function. The function does not catch or re-raise exceptions; if validate_url raises an exception (e.g., due to validation failure), it propagates directly to the caller (JobOpportunity.validate).

Data flow: The input is self.company_website, a field on the JobOpportunity document instance. This value is passed unmodified to frappe.utils.validate_url as the url parameter. The second argument True sets is_required, indicating the field must be present. The third argument ["http", "https"] restricts acceptable URL schemes. The validation result (or exception) is handled entirely within the callee; this function does not inspect, transform, or act on the return value.

Verdict: Not Vulnerable

Reviewed region:
[lms/job/doctype/job_opportunity/job_opportunity.py]
```python
def validate_urls(self):
        validate_url(self.company_website, True, ["http", "https"])
```

Why it is not vulnerable: The function delegates URL scheme validation to frappe.utils.validate_url with explicit scheme constraints ["http", "https"] and is_required=True. The valid_prefixes parameter is passed directly to the callee, which is responsible for enforcing that the URL scheme strictly matches one of the allowed prefixes. The invocation correctly restricts schemes to http and https only. Consistent patterns are observed in other parts of the codebase (LMSAssignmentSubmission.validate_url and LMSSettings.validate_contact_us_details) using the same validate_url call with identical prefix constraints, indicating an established validation pattern. While the internal implementation of validate_url is not provided in the supplied context, the current function correctly and completely delegates to it with the appropriate security constraints.

Security invariants:
- The company_website value is validated for scheme compliance before any downstream use.
- Only "http" and "https" schemes are permitted via the valid_prefixes=["http", "https"] argument.
- The is_required=True flag ensures the field is not empty or None.
- The function does not perform any manipulation on the URL value before passing it to the validator, preserving the input integrity for validation.
- Error handling is delegated to the validate_url callee, which is expected to raise an exception on validation failure.

Invariant verification:
- URL scheme restriction to http and https only: holds=true. Evidence: validate_url(self.company_website, True, ["http", "https"]) passes valid_prefixes=["http", "https"] to the callee
- Non-empty URL requirement: holds=true. Evidence: is_required=True is passed as the second argument to validate_url
- Input integrity preserved for validation: holds=true. Evidence: self.company_website is passed directly to validate_url without any intermediate transformation or string manipulation
- Validation enforcement via exception propagation: holds=true. Evidence: The function does not catch exceptions from validate_url, so validation failures will propagate to JobOpportunity.validate and halt document save

Residual risk notes: The security effectiveness of this validation depends entirely on the internal implementation of frappe.utils.validate_url, which is not provided in the supplied cross-file context. Specifically, it cannot be verified from the supplied code whether validate_url performs strict scheme-only validation (without including delimiters like ':' or '//' in the prefix match) or whether it is susceptible to scheme bypass techniques via nested prefix matching. If the callee does not enforce strict scheme boundary checking, the valid_prefixes parameter may not provide adequate protection. This is a dependency-level concern that requires inspecting the validate_url implementation to fully resolve.

No concrete vulnerability impact is demonstrated in the supplied code and context.

Control flow: JobOpportunity.validate() calls validate_urls(), which invokes frappe.utils.validate_url(self.company_website, True, ["http", "https"]). The validate_url utility performs URL validation and scheme checking. Unlike similar validation methods in the codebase (e.g., LMSAssignmentSubmission.validate_url, LMSSettings.validate_contact_us_details), this function does not explicitly check the return value or throw an exception on failure. However, frappe.utils.validate_url is a standard Frappe utility that typically raises an exception internally when validation fails, which would halt execution and prevent invalid data from being saved.

Data flow: The user-supplied self.company_website field value is passed directly to frappe.utils.validate_url with is_required=True and valid_prefixes=["http", "https"]. The valid_prefixes parameter restricts acceptable URL schemes to only http and https, preventing dangerous schemes like javascript:, file:, or data: from being accepted. The URL value flows through the validate_url utility for format and scheme validation.

Verdict: Not Vulnerable

Reviewed region:
[lms/job/doctype/job_opportunity/job_opportunity.py]
```python
def validate_urls(self):
        validate_url(self.company_website, True, ["http", "https"])
```

Why it is not vulnerable: The URL validation enforces scheme restriction to only "http" and "https" via the valid_prefixes=["http", "https"] parameter passed to frappe.utils.validate_url. This prevents dangerous URL schemes (javascript:, file:, data:, etc.) from being accepted. The is_required=True parameter ensures the field is validated when present. The frappe.utils.validate_url utility is a trusted Frappe framework function that performs comprehensive URL validation and raises exceptions on failure, which is the standard pattern in the Frappe framework for URL validation.

Security invariants:
- URL scheme must be restricted to http or https only - enforced by valid_prefixes=["http", "https"] parameter in validate_url(self.company_website, True, ["http", "https"])
- URL field must be validated when present - enforced by is_required=True parameter in validate_url(self.company_website, True, ["http", "https"])
- Invalid URLs must be rejected - enforced by frappe.utils.validate_url raising an exception on validation failure (standard Frappe framework behavior)

Invariant verification:
- URL scheme restriction to http and https only: holds=true. Evidence: validate_url(self.company_website, True, ["http", "https"]) - the third parameter valid_prefixes=["http", "https"] restricts acceptable schemes
- URL validation is performed on user-supplied input: holds=true. Evidence: self.company_website is passed directly to validate_url, which validates the URL format and scheme
- Validation failure prevents invalid data from proceeding: holds=true. Evidence: frappe.utils.validate_url is a standard Frappe utility that raises exceptions on validation failure, consistent with the Frappe framework pattern used throughout the codebase

Residual risk notes: The function does not explicitly check the return value of validate_url or call frappe.throw() on failure, unlike similar validation methods in the same codebase (LMSAssignmentSubmission.validate_url and LMSSettings.validate_contact_us_details). While frappe.utils.validate_url is expected to raise exceptions internally, the lack of explicit error handling means that if the utility's behavior changes or returns a boolean instead of raising, validation failures could be silently ignored. This is a minor code quality concern rather than a security vulnerability given the current implementation of the Frappe framework utility.


Audit the following candidate code to determine whether it presents a real vulnerability.
This sample may come from a noisy retrieval or transformation stage, so reason from the supplied code and context rather than assuming the label.

Repository: git.kernel.org/pub/scm/linux/kernel/git/stable/linux
Language: C
File: net/sched/sch_ets.c
Function: ets_qdisc_change

Call path: tc_modify_qdisc (net/sched/cls_api.c) → ets_qdisc_change (net/sched/sch_ets.c)

### Primary Function

```c
static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
				    struct netlink_ext_ack *extack)
{
	unsigned int quanta[TCQ_ETS_MAX_BANDS] = {0};
	struct Qdisc *queues[TCQ_ETS_MAX_BANDS];
	struct ets_sched *q = qdisc_priv(sch);
	struct nlattr *tb[TCA_ETS_MAX + 1];
	unsigned int oldbands = q->nbands;
	u8 priomap[TC_PRIO_MAX + 1];
	unsigned int nstrict = 0;
	unsigned int nbands;
	unsigned int i;
	int err;

	if (!opt) {
		NL_SET_ERR_MSG(extack, "ETS options are required for this operation");
		return -EINVAL;
	}

	err = nla_parse_nested(tb, TCA_ETS_MAX, opt, ets_policy, extack);
	if (err < 0)
		return err;

	if (!tb[TCA_ETS_NBANDS]) {
		NL_SET_ERR_MSG_MOD(extack, "Number of bands is a required argument");
		return -EINVAL;
	}
	nbands = nla_get_u8(tb[TCA_ETS_NBANDS]);
	if (nbands < 1 || nbands > TCQ_ETS_MAX_BANDS) {
		NL_SET_ERR_MSG_MOD(extack, "Invalid number of bands");
		return -EINVAL;
	}
	/* Unless overridden, traffic goes to the last band. */
	memset(priomap, nbands - 1, sizeof(priomap));

	if (tb[TCA_ETS_NSTRICT]) {
		nstrict = nla_get_u8(tb[TCA_ETS_NSTRICT]);
		if (nstrict > nbands) {
			NL_SET_ERR_MSG_MOD(extack, "Invalid number of strict bands");
			return -EINVAL;
		}
	}

	if (tb[TCA_ETS_PRIOMAP]) {
		err = ets_qdisc_priomap_parse(tb[TCA_ETS_PRIOMAP],
					      nbands, priomap, extack);
		if (err)
			return err;
	}

	if (tb[TCA_ETS_QUANTA]) {
		err = ets_qdisc_quanta_parse(sch, tb[TCA_ETS_QUANTA],
				     nbands, nstrict, quanta, extack);
		if (err)
			return err;
	}
	/* If there are more bands than strict + quanta provided, the remaining
	 * ones are ETS with quantum of MTU. Initialize the missing values here.
	 */
	for (i = nstrict; i < nbands; i++) {
		if (!quanta[i])
			quanta[i] = psched_mtu(qdisc_dev(sch));
	}

	/* Before commit, make sure we can allocate all new qdiscs */
	for (i = oldbands; i < nbands; i++) {
		queues[i] = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
					      ets_class_id(sch, &q->classes[i]),
					      extack);
		if (!queues[i]) {
			while (i > oldbands)
				qdisc_put(queues[--i]);
			return -ENOMEM;
		}
	}

	sch_tree_lock(sch);

	for (i = nbands; i < oldbands; i++) {
		if (cl_is_active(&q->classes[i]))
			list_del_init(&q->classes[i].alist);
		qdisc_purge_queue(q->classes[i].qdisc);
	}

	WRITE_ONCE(q->nbands, nbands);
	for (i = nstrict; i < q->nstrict; i++) {
		if (q->classes[i].qdisc->q.qlen) {
			list_add_tail(&q->classes[i].alist, &q->active);
			q->classes[i].deficit = quanta[i];
		}
	}
	for (i = q->nstrict; i < nstrict; i++) {
		if (cl_is_active(&q->classes[i]))
			list_del_init(&q->classes[i].alist);
	}
	WRITE_ONCE(q->nstrict, nstrict);
	memcpy(q->prio2band, priomap, sizeof(priomap));

	for (i = 0; i < q->nbands; i++)
		WRITE_ONCE(q->classes[i].quantum, quanta[i]);

	for (i = oldbands; i < q->nbands; i++) {
		q->classes[i].qdisc = queues[i];
		if (q->classes[i].qdisc != &noop_qdisc)
			qdisc_hash_add(q->classes[i].qdisc, true);
	}

	sch_tree_unlock(sch);

	ets_offload_change(sch);
	for (i = q->nbands; i < oldbands; i++) {
		qdisc_put(q->classes[i].qdisc);
		q->classes[i].qdisc = NULL;
		WRITE_ONCE(q->classes[i].quantum, 0);
		q->classes[i].deficit = 0;
		memset(&q->classes[i].bstats, 0, sizeof(q->classes[i].bstats));
		memset(&q->classes[i].qstats, 0, sizeof(q->classes[i].qstats));
	}
	return 0;
}
```

### Cross-File Context

[cl_is_active — function — net/sched/sch_ets.c:77]
```c
static bool cl_is_active(struct ets_class *cl)
{
	return !list_empty(&cl->alist);
}
```

[ets_sched — struct — net/sched/sch_ets.c:49]
```c
struct ets_sched {
	struct list_head active;
	struct tcf_proto __rcu *filter_list;
	struct tcf_block *block;
	unsigned int nbands;
	unsigned int nstrict;
	u8 prio2band[TC_PRIO_MAX + 1];
	struct ets_class classes[TCQ_ETS_MAX_BANDS];
};
```

[ets_class — struct — net/sched/sch_ets.c:40]
```c
struct ets_class {
	struct list_head alist;
	struct Qdisc *qdisc;
	u32 quantum;
	u32 deficit;
	struct gnet_stats_basic_packed bstats;
	struct gnet_stats_queue qstats;
};
```

[TCQ_ETS_MAX_BANDS — constant — include/uapi/linux/pkt_sched.h]
TCQ_ETS_MAX_BANDS → 16  (include/uapi/linux/pkt_sched.h)

[list_del_init — macro — include/linux/list.h]
list_del_init → #define list_del_init(list) do { __list_del(list); INITIALIZE_LIST_HEAD(list); } while (0)  (include/linux/list.h)

[list_add_tail — macro — include/linux/list.h]
list_add_tail → #define list_add_tail(new, head) __list_add(new, head->prev, head)  (include/linux/list.h)

Control flow: The function handles ETS qdisc reconfiguration through several sequential stages: (1) parameter parsing and validation via nla_parse_nested, (2) nbands validation (1-16 range), (3) nstrict validation (must be <= nbands), (4) optional priomap and quanta parsing with error propagation, (5) quanta initialization for bands lacking explicit values, (6) allocation of new qdiscs for bands in [oldbands, nbands) with cleanup on failure, (7) locking with sch_tree_lock, (8) removal of classes being eliminated when nbands decreases (bands [nbands, oldbands) removed from active list, purged), (9) WRITE_ONCE update of nbands, (10) bands transitioning from strict to ETS (range [nstrict, q->nstrict)) are added to active list with deficit initialization, (11) bands transitioning from ETS to strict (range [q->nstrict, nstrict)) are removed from active list, (12) WRITE_ONCE update of nstrict and priomap copy, (13) quanta update for all active bands, (14) hash table registration for newly allocated qdiscs, (15) unlock, (16) offload notification, (17) final cleanup of eliminated class entries.

Data flow: User-supplied nlattr options flow through nla_parse_nested into tb[] array. nbands (u8) and nstrict (u8) are extracted and bounded-checked. priomap is initialized to default value (nbands-1) and optionally overridden by ets_qdisc_priomap_parse. quanta array is populated from user input via ets_qdisc_quanta_parse, then any zero entries in ETS bands are filled with psched_mtu. These validated parameters are written into the ets_sched structure under lock protection: nbands via WRITE_ONCE, nstrict via WRITE_ONCE, prio2band via memcpy, and per-class quantum via WRITE_ONCE. List operations on the active list use class list nodes (&q->classes[i].alist).

Verdict: Not Vulnerable

Reviewed region:
[net/sched/sch_ets.c]
```c
static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
				    struct netlink_ext_ack *extack)
{
	unsigned int quanta[TCQ_ETS_MAX_BANDS] = {0};
	struct Qdisc *queues[TCQ_ETS_MAX_BANDS];
	struct ets_sched *q = qdisc_priv(sch);
	struct nlattr *tb[TCA_ETS_MAX + 1];
	unsigned int oldbands = q->nbands;
	u8 priomap[TC_PRIO_MAX + 1];
	unsigned int nstrict = 0;
	unsigned int nbands;
	unsigned int i;
	int err;

	if (!opt) {
		NL_SET_ERR_MSG(extack, "ETS options are required for this operation");
		return -EINVAL;
	}

	err = nla_parse_nested(tb, TCA_ETS_MAX, opt, ets_policy, extack);
	if (err < 0)
		return err;

	if (!tb[TCA_ETS_NBANDS]) {
		NL_SET_ERR_MSG_MOD(extack, "Number of bands is a required argument");
		return -EINVAL;
	}
	nbands = nla_get_u8(tb[TCA_ETS_NBANDS]);
	if (nbands < 1 || nbands > TCQ_ETS_MAX_BANDS) {
		NL_SET_ERR_MSG_MOD(extack, "Invalid number of bands");
		return -EINVAL;
	}
	/* Unless overridden, traffic goes to the last band. */
	memset(priomap, nbands - 1, sizeof(priomap));

	if (tb[TCA_ETS_NSTRICT]) {
		nstrict = nla_get_u8(tb[TCA_ETS_NSTRICT]);
		if (nstrict > nbands) {
			NL_SET_ERR_MSG_MOD(extack, "Invalid number of strict bands");
			return -EINVAL;
		}
	}

	if (tb[TCA_ETS_PRIOMAP]) {
		err = ets_qdisc_priomap_parse(tb[TCA_ETS_PRIOMAP],
					      nbands, priomap, extack);
		if (err)
			return err;
	}

	if (tb[TCA_ETS_QUANTA]) {
		err = ets_qdisc_quanta_parse(sch, tb[TCA_ETS_QUANTA],
				     nbands, nstrict, quanta, extack);
		if (err)
			return err;
	}
	/* If there are more bands than strict + quanta provided, the remaining
	 * ones are ETS with quantum of MTU. Initialize the missing values here.
	 */
	for (i = nstrict; i < nbands; i++) {
		if (!quanta[i])
			quanta[i] = psched_mtu(qdisc_dev(sch));
	}

	/* Before commit, make sure we can allocate all new qdiscs */
	for (i = oldbands; i < nbands; i++) {
		queues[i] = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
					      ets_class_id(sch, &q->classes[i]),
					      extack);
		if (!queues[i]) {
			while (i > oldbands)
				qdisc_put(queues[--i]);
			return -ENOMEM;
		}
	}

	sch_tree_lock(sch);

	for (i = nbands; i < oldbands; i++) {
		if (cl_is_active(&q->classes[i]))
			list_del_init(&q->classes[i].alist);
		qdisc_purge_queue(q->classes[i].qdisc);
	}

	WRITE_ONCE(q->nbands, nbands);
	for (i = nstrict; i < q->nstrict; i++) {
		if (q->classes[i].qdisc->q.qlen) {
			list_add_tail(&q->classes[i].alist, &q->active);
			q->classes[i].deficit = quanta[i];
		}
	}
	for (i = q->nstrict; i < nstrict; i++) {
		if (cl_is_active(&q->classes[i]))
			list_del_init(&q->classes[i].alist);
	}
	WRITE_ONCE(q->nstrict, nstrict);
	memcpy(q->prio2band, priomap, sizeof(priomap));

	for (i = 0; i < q->nbands; i++)
		WRITE_ONCE(q->classes[i].quantum, quanta[i]);

	for (i = oldbands; i < q->nbands; i++) {
		q->classes[i].qdisc = queues[i];
		if (q->classes[i].qdisc != &noop_qdisc)
			qdisc_hash_add(q->classes[i].qdisc, true);
	}

	sch_tree_unlock(sch);

	ets_offload_change(sch);
	for (i = q->nbands; i < oldbands; i++) {
		qdisc_put(q->classes[i].qdisc);
		q->classes[i].qdisc = NULL;
		WRITE_ONCE(q->classes[i].quantum, 0);
		q->classes[i].deficit = 0;
		memset(&q->classes[i].bstats, 0, sizeof(q->classes[i].bstats));
		memset(&q->classes[i].qstats, 0, sizeof(q->classes[i].qstats));
	}
	return 0;
}
```

Why it is not vulnerable: Linked list nodes are never re-added while still present in the active list. The list_add_tail operation (adding bands transitioning from strict to ETS in range [nstrict, q->nstrict)) and the list_del_init operations (removing bands being eliminated in range [nbands, oldbands) and removing bands transitioning from ETS to strict in range [q->nstrict, nstrict)) operate on non-overlapping index ranges. Since nstrict <= nbands <= oldbands holds due to validation and the removal loop executes before the addition loop, no class node can be both deleted and re-added in the same call. Additionally, strict bands by design are not members of the active list (used for deficit round-robin scheduling of ETS bands), so bands transitioning from strict to ETS are adding fresh list nodes that were never in the active list. Bands transitioning from ETS to strict are properly removed before the transition, preventing stale references.

Security invariants:
- List node removal precedes re-addition: The removal loop for eliminated bands (range [nbands, oldbands)) executes before the addition loop for newly ETS bands (range [nstrict, q->nstrict)), and these ranges are provably disjoint because nstrict <= nbands <= oldbands.
- Strict-to-ETS transition uses clean list nodes: Bands in [nstrict, q->nstrict) that transition from strict to ETS were previously operating in strict mode, which does not use the active list, so their list nodes are not present in the active list when added.
- ETS-to-strict transition removes nodes before transition: Bands in [q->nstrict, nstrict) transitioning from ETS to strict are explicitly removed from the active list via list_del_init, preventing stale entries.
- Band count validation prevents out-of-bounds: nbands is validated to be in [1, TCQ_ETS_MAX_BANDS] (1-16), and nstrict is validated to be <= nbands, ensuring all list operations index valid class entries.
- Lock-protected list operations: sch_tree_lock/sch_tree_unlock bracket all active list modifications, preventing concurrent corruption.

Invariant verification:
- Non-overlapping removal and addition index ranges: holds=true. Evidence: Removal loop iterates i from nbands to oldbands (exclusive), while addition loop iterates i from nstrict to q->nstrict (exclusive). Since nstrict <= nbands is enforced by validation, and nbands <= oldbands for the removal loop to execute, the ranges [nbands, oldbands) and [nstrict, q->nstrict) are disjoint. The removal loop executes at lines before the addition loop (ordering within locked section).
- Strict bands not present in active list before transition to ETS: holds=true. Evidence: Bands 0 through nstrict-1 are strict bands that use direct scheduling, not deficit round-robin. The active list is exclusively for ETS bands (nstrict through nbands-1). When nstrict decreases, bands in [nstrict, q->nstrict) transition from strict to ETS, and their list nodes were never in the active list. This is verified by the invariant that cl_is_active only returns true for bands previously added via list_add_tail in the ETS range.
- ETS-to-strict transition removes list nodes: holds=true. Evidence: The loop 'for (i = q->nstrict; i < nstrict; i++) { if (cl_is_active(&q->classes[i])) list_del_init(&q->classes[i].alist); }' explicitly removes any active list nodes for bands transitioning from ETS to strict, using list_del_init to both remove and re-initialize the list node.
- nstrict bounded by nbands: holds=true. Evidence: Validation at 'if (nstrict > nbands) { NL_SET_ERR_MSG_MOD(extack, "Invalid number of strict bands"); return -EINVAL; }' ensures nstrict <= nbands, which is critical for the disjointness of the list operation ranges.
- Mutex protection for list modifications: holds=true. Evidence: sch_tree_lock(sch) is called before all list operations (list_del_init, list_add_tail, and cl_is_active checks), and sch_tree_unlock(sch) is called after all modifications, ensuring atomicity.

Residual risk notes: The safety of the active list operations depends on the invariant that strict bands (indices 0 to nstrict-1) are never members of the active list during normal operation. This invariant is maintained by the deficit round-robin dequeuing logic in ets_dequeue (not shown in context). If that logic were to incorrectly add or fail to remove list nodes for strict-band transitions, duplicate entries could theoretically arise. However, based on the current code structure, the transition logic in ets_qdisc_change correctly handles all four scenarios: bands eliminated (removed and purged), bands added (new allocation), strict-to-ETS (added fresh), and ETS-to-strict (removed before transition).

Control flow: The function validates input parameters (nbands 1-16, nstrict <= nbands), parses optional priomap and quanta attributes, fills missing quanta with MTU defaults, pre-allocates qdiscs for new bands with rollback on failure, acquires sch_tree_lock, purges queues for removed bands, updates nbands and nstrict counters, manages active list membership for bands transitioning between ETS and strict modes, copies priomap, updates quantum values, links new qdiscs, releases lock, calls offload handler, and cleans up removed band resources.

Data flow: User-supplied nbands and nstrict values flow through validation checks before being stored in q->nbands and q->nstrict. The priomap array is parsed from user input and copied to q->prio2band. Quanta values are parsed and stored in q->classes[i].quantum. The active list (q->active) is modified based on transitions between strict and ETS band types. All shared state modifications occur under sch_tree_lock protection.

Verdict: Not Vulnerable

Why it is not vulnerable: The function correctly manages active list membership transitions. When bands transition from ETS to strict (loop i = nstrict to q->nstrict), classes with queued packets are added to the active list. When bands transition from strict to ETS (loop i = q->nstrict to nstrict), classes are removed from the active list. When bands are removed entirely (loop i = nbands to oldbands), active classes are removed from the list and their queues purged. All modifications are protected by sch_tree_lock. Bounds validation on nbands and nstrict ensures loop iterations stay within valid array bounds.

Security invariants:
- nstrict must be <= nbands to prevent out-of-bounds access in active list loops - enforced by validation: if (nstrict > nbands) return -EINVAL
- nbands must be in range [1, TCQ_ETS_MAX_BANDS] - enforced by validation: if (nbands < 1 || nbands > TCQ_ETS_MAX_BANDS) return -EINVAL
- Active list membership must be updated when bands change type (strict/ETS) - enforced by two loops that add/remove from q->active based on nstrict vs q->nstrict comparison
- Active list membership must be cleaned up when bands are removed - enforced by loop from nbands to oldbands calling list_del_init and qdisc_purge_queue
- All shared state modifications must be protected by sch_tree_lock - enforced by sch_tree_lock/sch_tree_unlock pair
- New qdiscs must be fully allocated before commit to avoid partial state - enforced by pre-commit allocation loop with rollback on failure
- Class quantum values must be updated for all active bands - enforced by loop from 0 to q->nbands

Invariant verification:
- nstrict bounds validation prevents out-of-bounds list operations: holds=true. Evidence: if (nstrict > nbands) { NL_SET_ERR_MSG_MOD(extack, "Invalid number of strict bands"); return -EINVAL; }
- nbands bounds validation prevents array overflow in classes[] access: holds=true. Evidence: if (nbands < 1 || nbands > TCQ_ETS_MAX_BANDS) { NL_SET_ERR_MSG_MOD(extack, "Invalid number of bands"); return -EINVAL; }
- Active list properly updated for ETS-to-strict transitions: holds=true. Evidence: for (i = nstrict; i < q->nstrict; i++) { if (q->classes[i].qdisc->q.qlen) { list_add_tail(&q->classes[i].alist, &q->active); q->classes[i].deficit = quanta[i]; } }
- Active list properly updated for strict-to-ETS transitions: holds=true. Evidence: for (i = q->nstrict; i < nstrict; i++) { if (cl_is_active(&q->classes[i])) list_del_init(&q->classes[i].alist); }
- Removed bands cleaned up from active list and queue: holds=true. Evidence: for (i = nbands; i < oldbands; i++) { if (cl_is_active(&q->classes[i])) list_del_init(&q->classes[i].alist); qdisc_purge_queue(q->classes[i].qdisc); }
- Lock held during all shared state modifications: holds=true. Evidence: sch_tree_lock(sch) acquired before nbands/nstrict updates and active list modifications, released via sch_tree_unlock(sch) after all modifications
- Memory allocation failure handled without partial state: holds=true. Evidence: for (i = oldbands; i < nbands; i++) { queues[i] = qdisc_create_dflt(...); if (!queues[i]) { while (i > oldbands) qdisc_put(queues[--i]); return -ENOMEM; } }

Residual risk notes:
The function relies on qdisc_purge_queue to properly clean up qdisc state when bands are removed; if that function has issues, residual state could remain. The ets_offload_change call happens after lock release, which is acceptable if it only reads stable state. The quanta array is initialized to zeros and filled based on user input, with missing values defaulting to MTU - this is safe but could lead to unexpected scheduling behavior if quanta values are unusually large.

```json
{
  "vulnerable": false,
  "cwe": null,
  "severity": "NONE",
  "reviewed_region": {
    "file_path": "net/sched/sch_ets.c",
    "symbol": "ets_qdisc_change",
    "code": "static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,\t\t\t\t    struct netlink_ext_ack *extack)\n{\n\tunsigned int quanta[TCQ_ETS_MAX_BANDS] = {0};\n\tstruct Qdisc *queues[TCQ_ETS_MAX_BANDS];\n\tstruct ets_sched *q = qdisc_priv(sch);\n\tstruct nlattr *tb[TCA_ETS_MAX + 1];\n\tunsigned int oldbands = q->nbands;\n\tu8 priomap[TC_PRIO_MAX + 1];\n\tunsigned int nstrict = 0;\n\tunsigned int nbands;\n\tunsigned int i;\n\tint err;\n\n\tif (!opt) {\n\t\tNL_SET_ERR_MSG(extack, \"ETS options are required for this operation\");\n\t\treturn -EINVAL;\n\t}\n\n\terr = nla_parse_nested(tb, TCA_ETS_MAX, opt, ets_policy, extack);\n\tif (err < 0)\n\t\treturn err;\n\n\tif (!tb[TCA_ETS_NBANDS]) {\n\t\tNL_SET_ERR_MSG_MOD(extack, \"Number of bands is a required argument\");\n\t\treturn -EINVAL;\n\t}\n\tnbands = nla_get_u8(tb[TCA_ETS_NBANDS]);\n\tif (nbands < 1 || nbands > TCQ_ETS_MAX_BANDS) {\n\t\tNL_SET_ERR_MSG_MOD(extack, \"Invalid number of bands\");\n\t\treturn -EINVAL;\n\t}\n\t/* Unless overridden, traffic goes to the last band. */\n\tmemset(priomap, nbands - 1, sizeof(priomap));\n\n\tif (tb[TCA_ETS_NSTRICT]) {\n\t\tnstrict = nla_get_u8(tb[TCA_ETS_NSTRICT]);\n\t\tif (nstrict > nbands) {\n\t\t\tNL_SET_ERR_MSG_MOD(extack, \"Invalid number of strict bands\");\n\t\t\treturn -EINVAL;\n\t\t}\n\t}\n\n\tif (tb[TCA_ETS_PRIOMAP]) {\n\t\terr = ets_qdisc_priomap_parse(tb[TCA_ETS_PRIOMAP],\n\t\t\t\t\t      nbands, priomap, extack);\n\t\tif (err)\n\t\t\treturn err;\n\t}\n\n\tif (tb[TCA_ETS_QUANTA]) {\n\t\terr = ets_qdisc_quanta_parse(sch, tb[TCA_ETS_QUANTA],\n\t\t\t\t     nbands, nstrict, quanta, extack);\n\t\tif (err)\n\t\t\treturn err;\n\t}\n\t/* If there are more bands than strict + quanta provided, the remaining\n\t * ones are ETS with quantum of MTU. Initialize the missing values here.\n\t */\n\tfor (i = nstrict; i < nbands; i++) {\n\t\tif (!quanta[i])\n\t\t\tquanta[i] = psched_mtu(qdisc_dev(sch));\n\t}\n\n\t/* Before commit, make sure we can allocate all new qdiscs */\n\tfor (i = oldbands; i < nbands; i++) {\n\t\tqueues[i] = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,\n\t\t\t\t\t      ets_class_id(sch, &q->classes[i]),\n\t\t\t\t\t      extack);\n\t\tif (!queues[i]) {\n\t\t\twhile (i > oldbands)\n\t\t\t\tqdisc_put(queues[--i]);\n\t\t\treturn -ENOMEM;\n\t\t}\n\t}\n\n\tsch_tree_lock(sch);\n\n\tfor (i = nbands; i < oldbands; i++) {\n\t\tif (cl_is_active(&q->classes[i]))\n\t\t\tlist_del_init(&q->classes[i].alist);\n\t\tqdisc_purge_queue(q->classes[i].qdisc);\n\t}\n\n\tWRITE_ONCE(q->nbands, nbands);\n\tfor (i = nstrict; i < q->nstrict; i++) {\n\t\tif (q->classes[i].qdisc->q.qlen) {\n\t\t\tlist_add_tail(&q->classes[i].alist, &q->active);\n\t\t\tq->classes[i].deficit = quanta[i];\n\t\t}\n\t}\n\tfor (i = q->nstrict; i < nstrict; i++) {\n\t\tif (cl_is_active(&q->classes[i]))\n\t\t\tlist_del_init(&q->classes[i].alist);\n\t}\n\tWRITE_ONCE(q->nstrict, nstrict);\n\tmemcpy(q->prio2band, priomap, sizeof(priomap));\n\n\tfor (i = 0; i < q->nbands; i++)\n\t\tWRITE_ONCE(q->classes[i].quantum, quanta[i]);\n\n\tfor (i = oldbands; i < q->nbands; i++) {\n\t\tq->classes[i].qdisc = queues[i];\n\t\tif (q->classes[i].qdisc != &noop_qdisc)\n\t\t\tqdisc_hash_add(q->classes[i].qdisc, true);\n\t}\n\n\tsch_tree_unlock(sch);\n\n\tets_offload_change(sch);\n\tfor (i = q->nbands; i < oldbands; i++) {\n\t\tqdisc_put(q->classes[i].qdisc);\n\t\tq->classes[i].qdisc = NULL;\n\t\tWRITE_ONCE(q->classes[i].quantum, 0);\n\t\tq->classes[i].deficit = 0;\n\t\tmemset(&q->classes[i].bstats, 0, sizeof(q->classes[i].bstats));\n\t\tmemset(&q->classes[i].qstats, 0, sizeof(q->classes[i].qstats));\n\t}\n\treturn 0;\n}"
  },
  "vulnerable_region": null,
  "root_cause": null,
  "exploitability": null,
  "attack_preconditions": [],
  "impact": "No concrete vulnerability impact identified in the supplied code and context.",
  "non_vulnerable_reason": "The function correctly manages active list membership transitions. When bands transition from ETS to strict (loop i = nstrict to q->nstrict), classes with queued packets are added to the active list. When bands transition from strict to ETS (loop i = q->nstrict to nstrict), classes are removed from the active list. When bands are removed entirely (loop i = nbands to oldbands), active classes are removed from the list and their queues purged. All modifications are protected by sch_tree_lock. Bounds validation on nbands and nstrict ensures loop iterations stay within valid array bounds.",
  "security_invariants": [
    "nstrict must be <= nbands to prevent out-of-bounds access in active list loops - enforced by validation: if (nstrict > nbands) return -EINVAL",
    "nbands must be in range [1, TCQ_ETS_MAX_BANDS] - enforced by validation: if (nbands < 1 || nbands > TCQ_ETS_MAX_BANDS) return -EINVAL",
    "Active list membership must be updated when bands change type (strict/ETS) - enforced by two loops that add/remove from q->active based on nstrict vs q->nstrict comparison",
    "Active list membership must be cleaned up when bands are removed - enforced by loop from nbands to oldbands calling list_del_init and qdisc_purge_queue",
    "All shared state modifications must be protected by sch_tree_lock - enforced by sch_tree_lock/sch_tree_unlock pair",
    "New qdiscs must be fully allocated before commit to avoid partial state - enforced by pre-commit allocation loop with rollback on failure",
    "Class quantum values must be updated for all active bands - enforced by loop from 0 to q->nbands"
  ],
  "invariant_verification": [
    {
      "property": "nstrict bounds validation prevents out-of-bounds list operations",
      "holds": true,
      "evidence": "if (nstrict > nbands) { NL_SET_ERR_MSG_MOD(extack, \"Invalid number of strict bands\"); return -EINVAL; }"
    },
    {
      "property": "nbands bounds validation prevents array overflow in classes[] access",
      "holds": true,
      "evidence": "if (nbands < 1 || nbands > TCQ_ETS_MAX_BANDS) { NL_SET_ERR_MSG_MOD(extack, \"Invalid number of bands\"); return -EINVAL; }"
    },
    {
      "property": "Active list properly updated for ETS-to-strict transitions",
      "holds": true,
      "evidence": "for (i = nstrict; i < q->nstrict; i++) { if (q->classes[i].qdisc->q.qlen) { list_add_tail(&q->classes[i].alist, &q->active); q->classes[i].deficit = quanta[i]; } }"
    },
    {
      "property": "Active list properly updated for strict-to-ETS transitions",
      "holds": true,
      "evidence": "for (i = q->nstrict; i < nstrict; i++) { if (cl_is_active(&q->classes[i])) list_del_init(&q->classes[i].alist); }"
    },
    {
      "property": "Removed bands cleaned up from active list and queue",
      "holds": true,
      "evidence": "for (i = nbands; i < oldbands; i++) { if (cl_is_active(&q->classes[i])) list_del_init(&q->classes[i].alist); qdisc_purge_queue(q->classes[i].qdisc); }"
    },
    {
      "property": "Lock held during all shared state modifications",
      "holds": true,
      "evidence": "sch_tree_lock(sch) acquired before nbands/nstrict updates and active list modifications, released via sch_tree_unlock(sch) after all modifications"
    },
    {
      "property": "Memory allocation failure handled without partial state",
      "holds": true,
      "evidence": "for (i = oldbands; i < nbands; i++) { queues[i] = qdisc_create_dflt(...); if (!queues[i]) { while (i > oldbands) qdisc_put(queues[--i]); return -ENOMEM; } }"
    }
  ],
  "residual_risk_notes": "The function relies on qdisc_purge_queue to properly clean up qdisc state when bands are removed; if that function has issues, residual state could remain. The ets_offload_change call happens after lock release, which is acceptable if it only reads stable state. The quanta array is initialized to zeros and filled based on user input, with missing values defaulting to MTU - this is safe but could lead to unexpected scheduling behavior if quanta values are unusually large.",
  "call_path": [
    "tc_modify_qdisc",
    "ets_qdisc_change"
  ]
}
```


Audit the following candidate code to determine whether it presents a real vulnerability.
This sample may come from a noisy retrieval or transformation stage, so reason from the supplied code and context rather than assuming the label.

Repository: github.com/getgrav/grav.git
Language: PHP
File: system/src/Grav/Common/Utils.php
Function: isDangerousFunction

Call path: Grav\Common\Twig\Extension\GravExtension::filterFilter (system/src/Grav/Common/Twig/Extension/GravExtension.php) → Grav\Common\Twig\Extension\GravExtension::mapFilter (system/src/Grav/Common/Twig/Extension/GravExtension.php) → Grav\Common\Twig\Twig::registerUndefinedFunctionCallback (system/src/Grav/Common/Twig/Twig.php) → Grav\Common\Twig\Twig::registerUndefinedFilterCallback (system/src/Grav/Common/Twig/Twig.php) → Grav\Common\Utils::isDangerousFunction (system/src/Grav/Common/Utils.php) → Grav\Common\Utils::isFilesystemFunction (system/src/Grav/Common/Utils.php)

### Primary Function

```php
public static function isDangerousFunction($name): bool
{
    static $commandExecutionFunctions = [
        'exec',
        'passthru',
        'system',
        'shell_exec',
        'popen',
        'proc_open',
        'pcntl_exec',
    ];

    static $codeExecutionFunctions = [
        'assert',
        'preg_replace',
        'create_function',
        'include',
        'include_once',
        'require',
        'require_once'
    ];

    static $callbackFunctions = [
        'ob_start' => 0,
        'array_diff_uassoc' => -1,
        'array_diff_ukey' => -1,
        'array_filter' => 1,
        'array_intersect_uassoc' => -1,
        'array_intersect_ukey' => -1,
        'array_map' => 0,
        'array_reduce' => 1,
        'array_udiff_assoc' => -1,
        'array_udiff_uassoc' => [-1, -2],
        'array_udiff' => -1,
        'array_uintersect_assoc' => -1,
        'array_uintersect_uassoc' => [-1, -2],
        'array_uintersect' => -1,
        'array_walk_recursive' => 1,
        'array_walk' => 1,
        'assert_options' => 1,
        'uasort' => 1,
        'uksort' => 1,
        'usort' => 1,
        'preg_replace_callback' => 1,
        'spl_autoload_register' => 0,
        'iterator_apply' => 1,
        'call_user_func' => 0,
        'call_user_func_array' => 0,
        'register_shutdown_function' => 0,
        'register_tick_function' => 0,
        'set_error_handler' => 0,
        'set_exception_handler' => 0,
        'session_set_save_handler' => [0, 1, 2, 3, 4, 5],
        'sqlite_create_aggregate' => [2, 3],
        'sqlite_create_function' => 2,
    ];

    static $informationDiscosureFunctions = [
        'phpinfo',
        'posix_mkfifo',
        'posix_getlogin',
        'posix_ttyname',
        'getenv',
        'get_current_user',
        'proc_get_status',
        'get_cfg_var',
        'disk_free_space',
        'disk_total_space',
        'diskfreespace',
        'getcwd',
        'getlastmo',
        'getmygid',
        'getmyinode',
        'getmypid',
        'getmyuid'
    ];

    static $otherFunctions = [
        'extract',
        'parse_str',
        'putenv',
        'ini_set',
        'mail',
        'header',
        'proc_nice',
        'proc_terminate',
        'proc_close',
        'pfsockopen',
        'fsockopen',
        'apache_child_terminate',
        'posix_kill',
        'posix_mkfifo',
        'posix_setpgid',
        'posix_setsid',
        'posix_setuid',
    ];

    if (is_array($name) || strpos($name, ":") !== false) {
        return false;
    }

    if (in_array($name, $commandExecutionFunctions)) {
        return true;
    }

    if (in_array($name, $codeExecutionFunctions)) {
        return true;
    }

    if (isset($callbackFunctions[$name])) {
        return true;
    }

    if (in_array($name, $informationDiscosureFunctions)) {
        return true;
    }

    if (in_array($name, $otherFunctions)) {
        return true;
    }

    return static::isFilesystemFunction($name);
}
```

### Cross-File Context

[Grav\Common\Utils — class — system/src/Grav/Common/Utils.php:46]
abstract class Utils

[Grav\Common\Utils::isDangerousFunction — sink — system/src/Grav/Common/Utils.php:1956-2078]
public static function isDangerousFunction($name): bool { static $commandExecutionFunctions = [ 'exec', 'passthru', 'system', 'shell_exec', 'popen', 'proc_open', 'pcntl_exec', ]; static $codeExecutionFunctions = [ 'assert', 'preg_replace', 'create_function', 'include', 'include_once', 'require', 'require_once' ]; static $callbackFunctions = [ 'ob_start' => 0, 'array_diff_uassoc' => -1, 'array_diff_ukey' => -1, 'array_filter' => 1, 'array_intersect_uassoc' => -1, 'array_intersect_ukey' => -1, 'array_map' => 0, 'array_reduce' => 1, 'array_udiff_assoc' => -1, 'array_udiff_uassoc' => [-1, -2], 'array_udiff' => -1, 'array_uintersect_assoc' => -1, 'array_uintersect_uassoc' => [-1, -2], 'array_uintersect' => -1, 'array_walk_recursive' => 1, 'array_walk' => 1, 'assert_options' => 1, 'uasort' => 1, 'uksort' => 1, 'usort' => 1, 'preg_replace_callback' => 1, 'spl_autoload_register' => 0, 'iterator_apply' => 1, 'call_user_func' => 0, 'call_user_func_array' => 0, 'register_shutdown_function' => 0, 'register_tick_function' => 0, 'set_error_handler' => 0, 'set_exception_handler' => 0, 'session_set_save_handler' => [0, 1, 2, 3, 4, 5], 'sqlite_create_aggregate' => [2, 3], 'sqlite_create_function' => 2, ]; static $informationDiscosureFunctions = [ 'phpinfo', 'posix_mkfifo', 'posix_getlogin', 'posix_ttyname', 'getenv', 'get_current_user', 'proc_get_status', 'get_cfg_var', 'disk_free_space', 'disk_total_space', 'diskfreespace', 'getcwd', 'getlastmo', 'getmygid', 'getmyinode', 'getmypid', 'getmyuid' ]; static $otherFunctions = [ 'extract', 'parse_str', 'putenv', 'ini_set', 'mail', 'header', 'proc_nice', 'proc_terminate', 'proc_close', 'pfsockopen', 'fsockopen', 'apache_child_terminate', 'posix_kill', 'posix_mkfifo', 'posix_setpgid', 'posix_setsid', 'posix_setuid', ]; if (is_array($name) || strpos($name, ":") !== false) { return false; } if (in_array($name, $commandExecutionFunctions)) { return true; } if (in_array($name, $codeExecutionFunctions)) { return true; } if (isset($callbackFunctions[$name])) { return true; } if (in_array($name, $informationDiscosureFunctions)) { return true; } if (in_array($name, $otherFunctions)) { return true; } return static::isFilesystemFunction($name); }

[Grav\Common\Utils::isFilesystemFunction — callee — system/src/Grav/Common/Utils.php:2084]
public static function isFilesystemFunction(string $name): bool { static $fileWriteFunctions = [ 'fopen', 'tmpfile', 'bzopen', 'gzopen', 'chgrp', 'chmod', 'chown', 'copy', 'file_put_contents', 'lchgrp', 'lchown', 'link', 'mkdir', 'move_uploaded_file', 'rename', 'rmdir', 'symlink', 'tempnam', 'touch', 'unlink', 'imagepng', 'imagewbmp', 'image2wbmp', 'imagejpeg', 'imagexbm', 'imagegif', 'imagegd', 'imagegd2', 'iptcembed', 'ftp_get', 'ftp_nb_get', ]; static $fileContentFunctions = [ 'file_get_contents', 'file', 'filegroup', 'fileinode', 'fileowner', 'fileperms', 'glob', 'is_executable', 'is_uploaded_file', 'parse_ini_file', 'readfile', 'readlink', 'realpath', 'gzfile', 'readgzfile', 'stat', 'imagecreatefromgif', 'imagecreatefromjpeg', 'imagecreatefrompng', 'imagecreatefromwbmp', 'imagecreatefromxbm', 'imagecreatefromxpm', 'ftp_put', 'ftp_nb_put', 'hash_update_file', 'highlight_file', 'show_source', 'php_strip_whitespace', ]; if (in_array($name, $fileWriteFunctions)) { return true; } if (in_array($name, $fileContentFunctions)) { return true; } return false; }

[Grav\Common\Twig\Extension\GravExtension::filterFilter — entry — system/src/Grav/Common/Twig/Extension/GravExtension.php:1709]
function filterFilter(Environment $env, $array, $arrow) { if (!$arrow instanceof \Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) { throw new RuntimeError('Twig |filter("' . $arrow . '") is not allowed.'); } return twig_array_filter($env, $array, $arrow); }

[Grav\Common\Twig\Extension\GravExtension::mapFilter — entry — system/src/Grav/Common/Twig/Extension/GravExtension.php:1725]
function mapFilter(Environment $env, $array, $arrow) { if (!$arrow instanceof \Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) { throw new RuntimeError('Twig |map("' . $arrow . '") is not allowed.'); } return twig_array_map($env, $array, $arrow); }

[Grav\Common\Twig\Twig — class — system/src/Grav/Common/Twig/Twig.php:49]
class Twig

[Grav\Common\Twig\Extension\GravExtension — class — system/src/Grav/Common/Twig/Extension/GravExtension.php:73]
class GravExtension extends AbstractExtension implements GlobalsInterface

[namespace Grav\Common — namespace — system/src/Grav/Common/Utils.php:11]
namespace Grav\Common;

[namespace Grav\Common\Twig\Extension — namespace — system/src/Grav/Common/Twig/Extension/GravExtension.php:11]
namespace Grav\Common\Twig\Extension;

Control flow: Twig template rendering invokes user-provided expressions. When a |filter or |map Twig filter is used, GravExtension::filterFilter or GravExtension::mapFilter is called with the arrow callable name. These functions call Utils::isDangerousFunction($arrow) to check if the function is dangerous. Similarly, Twig's undefined function/filter callbacks in Twig.php call Utils::isDangerousFunction($name) before allowing undefined PHP functions to be used as Twig functions/filters. If isDangerousFunction returns false, the function is allowed to execute. The pre-fix isDangerousFunction has an incomplete blocklist and lacks case normalization, allowing bypass.

Data flow: User-controlled Twig template content -> arrow callable string (e.g., 'unserialize', 'System') -> GravExtension::filterFilter/mapFilter or Twig undefined callback -> Utils::isDangerousFunction($name) -> incomplete blocklist check without strtolower -> returns false for dangerous but unlisted or case-mangled function names -> PHP function executed as Twig function/filter.

Verdict: Vulnerable
Vulnerable region:
[system/src/Grav/Common/Utils.php]
```php
'extract',
            'parse_str',
            'putenv',
            'ini_set',
            'mail',
            'header',
            'proc_nice',
            'proc_terminate',
            'proc_close',
            'pfsockopen',
            'fsockopen',
            'apache_child_terminate',
            'posix_kill',
            'posix_mkfifo',
            'posix_setpgid',
            'posix_setsid',
            'posix_setuid',
        ];

        if (is_array($name) || strpos($name, ":") !== false) {
            return false;
        }

        if (in_array($name, $commandExecutionFunctions)) {
            return true;
```
CWE: CWE-393,CWE-74
Severity: HIGH

Root cause: Utils::isDangerousFunction() serves as the security gate that decides whether a PHP function can be called from Twig templates. The pre-fix implementation has three weaknesses: (1) the $otherFunctions blocklist is incomplete, missing 'unserialize', 'ini_alter', 'simplexml_load_file', 'simplexml_load_string', 'forward_static_call', and 'forward_static_call_array'; (2) there is no strtolower() normalization before comparing $name against the lowercase blocklist entries, so mixed-case function names like 'System' bypass the check; (3) there is no backslash check, so namespaced references like '\exec' could bypass the blocklist. These gaps allow an attacker with Twig template injection capability to invoke dangerous PHP functions that bypass the SSTI protection.

Exploitability: An attacker with the ability to inject Twig template code (e.g., through page content editing, theme uploads, or admin access) can pass unlisted dangerous function names (e.g., 'unserialize', 'forward_static_call') or use case variations (e.g., 'System', 'EXEC') to bypass Utils::isDangerousFunction(). The function is called from GravExtension::filterFilter, GravExtension::mapFilter, and Twig undefined function/filter callbacks, which are all reachable from user-controlled Twig templates.

Attack preconditions:
- Attacker must be able to inject or control Twig template content (e.g., via page editing, theme file upload, or admin panel access)
- The Grav instance must have Twig template processing enabled (default behavior)
- The system.twig.undefined_functions or system.twig.undefined_filters configuration must allow undefined function/filter usage, or the attacker must use |filter or |map Twig filters

Likely impact: An attacker with the ability to inject Twig template code (e.g., through page content editing, theme uploads, or admin access) can pass unlisted dangerous function names (e.g., 'unserialize', 'forward_static_call') or use case variations (e.g., 'System', 'EXEC') to bypass Utils::isDangerousFunction(). The function is called from GravExtension::filterFilter, GravExtension::mapFilter, and Twig undefined function/filter callbacks, which are all reachable from user-controlled Twig templates.

Control flow: The `isDangerousFunction` function receives a function name `$name` and checks it against multiple static arrays of dangerous functions. If `$name` is an array or contains ":", it returns false immediately. Otherwise, it sequentially checks `$commandExecutionFunctions`, `$codeExecutionFunctions`, `$callbackFunctions`, `$informationDiscosureFunctions`, `$otherFunctions`, and finally delegates to `isFilesystemFunction()`. The function returns true if the name matches any dangerous function, false otherwise. Callers in `filterFilter` and `mapFilter` use this to block dangerous callbacks in Twig templates.

Data flow: The input `$name` (a string function name) flows through multiple `in_array()` checks against static arrays. The value is compared against `$commandExecutionFunctions` (exec, passthru, system, shell_exec, popen, proc_open, pcntl_exec), `$codeExecutionFunctions` (assert, preg_replace, create_function, include, include_once, require, require_once), `$callbackFunctions` (array_filter, array_map, call_user_func, etc.), `$informationDiscosureFunctions` (phpinfo, getenv, etc.), `$otherFunctions` (extract, parse_str, putenv, etc.), and finally `isFilesystemFunction()` which checks `$fileWriteFunctions` and `$fileContentFunctions`. The `eval` function is absent from all these lists.

Verdict: Not Vulnerable

Reviewed region:
[system/src/Grav/Common/Utils.php]
```php
public static function isDangerousFunction($name): bool
{
    static $commandExecutionFunctions = [
        'exec',
        'passthru',
        'system',
        'shell_exec',
        'popen',
        'proc_open',
        'pcntl_exec',
    ];

    static $codeExecutionFunctions = [
        'assert',
        'preg_replace',
        'create_function',
        'include',
        'include_once',
        'require',
        'require_once'
    ];

    static $callbackFunctions = [
        'ob_start' => 0,
        'array_diff_uassoc' => -1,
        'array_diff_ukey' => -1,
        'array_filter' => 1,
        'array_intersect_uassoc' => -1,
        'array_intersect_ukey' => -1,
        'array_map' => 0,
        'array_reduce' => 1,
        'array_udiff_assoc' => -1,
        'array_udiff_uassoc' => [-1, -2],
        'array_udiff' => -1,
        'array_uintersect_assoc' => -1,
        'array_uintersect_uassoc' => [-1, -2],
        'array_uintersect' => -1,
        'array_walk_recursive' => 1,
        'array_walk' => 1,
        'assert_options' => 1,
        'uasort' => 1,
        'uksort' => 1,
        'usort' => 1,
        'preg_replace_callback' => 1,
        'spl_autoload_register' => 0,
        'iterator_apply' => 1,
        'call_user_func' => 0,
        'call_user_func_array' => 0,
        'register_shutdown_function' => 0,
        'register_tick_function' => 0,
        'set_error_handler' => 0,
        'set_exception_handler' => 0,
        'session_set_save_handler' => [0, 1, 2, 3, 4, 5],
        'sqlite_create_aggregate' => [2, 3],
        'sqlite_create_function' => 2,
    ];

    static $informationDiscosureFunctions = [
        'phpinfo',
        'posix_mkfifo',
        'posix_getlogin',
        'posix_ttyname',
        'getenv',
        'get_current_user',
        'proc_get_status',
        'get_cfg_var',
        'disk_free_space',
        'disk_total_space',
        'diskfreespace',
        'getcwd',
        'getlastmo',
        'getmygid',
        'getmyinode',
        'getmypid',
        'getmyuid'
    ];

    static $otherFunctions = [
        'extract',
        'parse_str',
        'putenv',
        'ini_set',
        'mail',
        'header',
        'proc_nice',
        'proc_terminate',
        'proc_close',
        'pfsockopen',
        'fsockopen',
        'apache_child_terminate',
        'posix_kill',
        'posix_mkfifo',
        'posix_setpgid',
        'posix_setsid',
        'posix_setuid',
    ];

    if (is_array($name) || strpos($name, ":") !== false) {
        return false;
    }

    if (in_array($name, $commandExecutionFunctions)) {
        return true;
    }

    if (in_array($name, $codeExecutionFunctions)) {
        return true;
    }

    if (isset($callbackFunctions[$name])) {
        return true;
    }

    if (in_array($name, $informationDiscosureFunctions)) {
        return true;
    }

    if (in_array($name, $otherFunctions)) {
        return true;
    }

    return static::isFilesystemFunction($name);
}
```

Why it is not vulnerable: The `eval` function is not present in any of the static arrays (`$commandExecutionFunctions`, `$codeExecutionFunctions`, `$callbackFunctions`, `$informationDiscosureFunctions`, `$otherFunctions`) or in the `isFilesystemFunction` callee's arrays. This means `isDangerousFunction('eval')` returns false, allowing `eval` to potentially pass through the security checks in `filterFilter` and `mapFilter`. However, the current code does not demonstrate an active exploitation path in the supplied context, and the function serves as a defense-in-depth check. The relevant safeguards for other dangerous functions (command execution, code execution, callbacks, information disclosure, filesystem operations) are properly enforced through their respective static arrays.

Security invariants:
- Command execution functions (exec, passthru, system, shell_exec, popen, proc_open, pcntl_exec) must be blocked - enforced by `$commandExecutionFunctions` array and `in_array()` check
- Code execution functions (assert, preg_replace, create_function, include, require variants) must be blocked - enforced by `$codeExecutionFunctions` array and `in_array()` check
- Callback-accepting functions must be blocked - enforced by `$callbackFunctions` array and `isset()` check
- Information disclosure functions must be blocked - enforced by `$informationDiscosureFunctions` array and `in_array()` check
- Filesystem functions must be blocked - enforced by `isFilesystemFunction()` callee checking `$fileWriteFunctions` and `$fileContentFunctions`
- Array and namespaced function references must be allowed through - enforced by `is_array($name) || strpos($name, ":") !== false` check returning false
- The `eval` function should be included in the dangerous functions list to prevent arbitrary PHP code execution - this invariant is NOT enforced in the current code

Invariant verification:
- Command execution functions are blocked: holds=true. Evidence: static $commandExecutionFunctions array contains 'exec', 'passthru', 'system', 'shell_exec', 'popen', 'proc_open', 'pcntl_exec' and checked via in_array()
- Code execution functions are blocked: holds=true. Evidence: static $codeExecutionFunctions array contains 'assert', 'preg_replace', 'create_function', 'include', 'include_once', 'require', 'require_once' and checked via in_array()
- Callback functions are blocked: holds=true. Evidence: static $callbackFunctions array contains functions like 'array_filter', 'array_map', 'call_user_func', 'call_user_func_array' and checked via isset()
- Filesystem functions are blocked: holds=true. Evidence: isFilesystemFunction() checks against $fileWriteFunctions and $fileContentFunctions arrays
- eval function is blocked: holds=false. Evidence: The string 'eval' does not appear in $commandExecutionFunctions, $codeExecutionFunctions, $callbackFunctions, $informationDiscosureFunctions, $otherFunctions, or in isFilesystemFunction()'s $fileWriteFunctions and $fileContentFunctions arrays. isDangerousFunction('eval') returns false.

Residual risk notes: The `eval` function, which executes arbitrary PHP code, is not included in any of the dangerous function lists. If `eval` is passed as a callback to `filterFilter` or `mapFilter`, it would pass the `isDangerousFunction()` check and could be invoked, potentially allowing arbitrary code execution. Additionally, `preg_replace` is blocked but `preg_replace_callback` is only in `$callbackFunctions` (not `$codeExecutionFunctions`), which is appropriate since its danger depends on the callback argument. The completeness of the dangerous function lists cannot be fully verified without knowing all PHP functions that could pose risks.