T3MP3ST public launch build

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/apply_user_defaults_test.go

@@ -0,0 +1,216 @@
+package settings
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// TestApplyUserDefaults_copiesUserDefaultsOntoUser guards against drift between
+// [UserDefaults] and [ApplyUserDefaults] (regression for #2278-style bugs).
+func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
+	saved := Config
+	defer func() { Config = saved }()
+
+	dark := false
+	dlFalse := false
+	Config = Settings{
+		Server: Server{},
+		UserDefaults: UserDefaults{
+			Sidebar: UserDefaultsSidebar{
+				DisableQuickToggles:  true,
+				HideFileActions:      true,
+				DisableHideOnPreview: true,
+				Sticky:               false,
+				HideFiles:            true,
+				ShowTools:            boolPtr(true),
+			},
+			Listing: UserDefaultsListing{
+				DeleteWithoutConfirming: true,
+				DateFormat:              true,
+				ShowHidden:              true,
+				QuickDownload:           true,
+				ShowSelectMultiple:      true,
+				SingleClick:             true,
+				HideFileExt:             "",
+				ShowCopyPath:            false,
+				DeleteAfterArchive:      false,
+				ViewMode:                "list",
+				GallerySize:             7,
+			},
+			Preview: UserDefaultsPreview{
+				Image:              boolPtr(false),
+				Video:              boolPtr(false),
+				Audio:              boolPtr(false),
+				MotionVideoPreview: boolPtr(false),
+				Office:             boolPtr(false),
+				PopUp:              boolPtr(false),
+				DisablePreviewExt:  ".exe",
+				HighQuality:        boolPtr(true),
+				Folder:             boolPtr(false),
+				Models:             boolPtr(false),
+			},
+			FileViewer: UserDefaultsFileViewer{
+				EditorQuickSave:         true,
+				AutoplayMedia:           boolPtr(false),
+				DisableViewingExt:       ".bat",
+				DisableOnlyOfficeExt:    ".x",
+				PreferEditorForMarkdown: true,
+				DebugOffice:             true,
+				DefaultMediaPlayer:      true,
+			},
+			Search: UserDefaultsSearch{
+				DisableOptions: true,
+			},
+			UI: UserDefaultsUI{
+				DarkMode:    &dark,
+				ThemeColor:  "var(--red)",
+				CustomTheme: "Night",
+				Locale:      "de",
+			},
+			FileLoading: users.FileLoading{
+				MaxConcurrent:     3,
+				UploadChunkSize:   5,
+				DownloadChunkSize: 2,
+			},
+			Account: UserDefaultsAccount{
+				Permissions: UserDefaultsAccountPermissions{
+					Api:      true,
+					Admin:    true,
+					Modify:   true,
+					Share:    true,
+					Realtime: true,
+					Delete:   true,
+					Create:   true,
+					Download: &dlFalse,
+				},
+				LockPassword:               true,
+				DisableSettings:            true,
+				LoginMethod:                "password",
+				DisableUpdateNotifications: true,
+			},
+		},
+	}
+
+	u := &users.User{Username: "alice"}
+	ApplyUserDefaults(u)
+
+	want := users.User{
+		DisableSettings: true,
+		LockPassword:    true,
+		LoginMethod:     users.LoginMethodPassword,
+		Permissions: users.Permissions{
+			Api:      true,
+			Admin:    true,
+			Modify:   true,
+			Share:    true,
+			Realtime: true,
+			Delete:   true,
+			Create:   true,
+			Download: false,
+		},
+		NonAdminEditable: users.NonAdminEditable{
+			EditorQuickSave:            true,
+			HideSidebarFileActions:     true,
+			DisableQuickToggles:        true,
+			DisableSearchOptions:       true,
+			StickySidebar:              false,
+			HideFilesInTree:            true,
+			DarkMode:                   false,
+			Locale:                     "de",
+			ViewMode:                   "list",
+			SingleClick:                true,
+			ShowHidden:                 true,
+			DateFormat:                 true,
+			GallerySize:                7,
+			ThemeColor:                 "var(--red)",
+			QuickDownload:              true,
+			DisablePreviewExt:          ".exe",
+			DisableViewingExt:          ".bat",
+			DisableUpdateNotifications: true,
+			DisableOfficePreviewExt:    ".x", // deprecated: mapped to DisableOnlyOfficeExt
+			DisableOnlyOfficeExt:       ".x",
+			CustomTheme:                "Night",
+			ShowSelectMultiple:         true,
+			DebugOffice:                true,
+			DeleteWithoutConfirming:    true,
+			DeleteAfterArchive:         false,
+			PreferEditorForMarkdown:    true,
+			ShowToolsInSidebar:         true,
+			FileLoading: users.FileLoading{
+				MaxConcurrent:     3,
+				UploadChunkSize:   5,
+				DownloadChunkSize: 2,
+			},
+			Preview: users.Preview{
+				DisableHideSidebar: true,
+				Image:              false,
+				Video:              false,
+				Audio:              false,
+				MotionVideoPreview: false,
+				Office:             false,
+				PopUp:              false,
+				AutoplayMedia:      false,
+				DefaultMediaPlayer: true,
+				Folder:             false,
+				Models:             false,
+			},
+		},
+	}
+
+	if diff := cmp.Diff(want.Permissions, u.Permissions); diff != "" {
+		t.Fatalf("Permissions mismatch (-want +got):\n%s", diff)
+	}
+	if diff := cmp.Diff(want.NonAdminEditable, u.NonAdminEditable); diff != "" {
+		t.Fatalf("NonAdminEditable mismatch (-want +got):\n%s", diff)
+	}
+	if u.DisableSettings != want.DisableSettings {
+		t.Fatalf("DisableSettings: got %v want %v", u.DisableSettings, want.DisableSettings)
+	}
+	if u.LockPassword != want.LockPassword {
+		t.Fatalf("LockPassword: got %v want %v", u.LockPassword, want.LockPassword)
+	}
+	if u.LoginMethod != want.LoginMethod {
+		t.Fatalf("LoginMethod: got %q want %q", u.LoginMethod, want.LoginMethod)
+	}
+}
+
+func TestApplyUserDefaults_setsLoginMethodWhenEmpty(t *testing.T) {
+	saved := Config
+	defer func() { Config = saved }()
+
+	Config = Settings{
+		Server: Server{},
+		UserDefaults: UserDefaults{
+			Account: UserDefaultsAccount{
+				LoginMethod: "jwt",
+			},
+		},
+	}
+	u := &users.User{Username: "x"}
+	ApplyUserDefaults(u)
+	if u.LoginMethod != users.LoginMethodJwt {
+		t.Fatalf("LoginMethod: got %q want jwt", u.LoginMethod)
+	}
+}
+
+func TestApplyUserDefaults_preservesLoginMethodWhenAlreadySet(t *testing.T) {
+	saved := Config
+	defer func() { Config = saved }()
+
+	Config = Settings{
+		Server: Server{},
+		UserDefaults: UserDefaults{
+			Account: UserDefaultsAccount{
+				LoginMethod: "password",
+			},
+		},
+	}
+	u := &users.User{Username: "x", LoginMethod: users.LoginMethodProxy}
+	ApplyUserDefaults(u)
+	if u.LoginMethod != users.LoginMethodProxy {
+		t.Fatalf("LoginMethod: got %q want proxy", u.LoginMethod)
+	}
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/auth.go

@@ -0,0 +1,308 @@
+package settings
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	ldap "github.com/go-ldap/ldap/v3"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// userAgentTransport wraps an http.RoundTripper to add a User-Agent header
+type userAgentTransport struct {
+	base      http.RoundTripper
+	userAgent string
+}
+
+// RoundTrip implements the http.RoundTripper interface
+func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Clone the request to avoid modifying the original
+	reqCopy := req.Clone(req.Context())
+	// Set User-Agent header if not already set
+	if reqCopy.Header.Get("User-Agent") == "" {
+		reqCopy.Header.Set("User-Agent", t.userAgent)
+	}
+	return t.base.RoundTrip(reqCopy)
+}
+
+// AuthCommon contains fields shared across multiple authentication methods
+type AuthCommon struct {
+	Enabled           bool     `json:"enabled"`           // whether to enable this authentication method.
+	AdminGroup        string   `json:"adminGroup"`        // if set, users in this group will be granted admin privileges
+	UserGroups        []string `json:"userGroups"`        // if set, only users in these groups are allowed to log in. Blocks all other users even with valid credentials.
+	GroupsClaim       string   `json:"groupsClaim"`       // the JSON field name to read groups from. Default is "groups"
+	UserIdentifier    string   `json:"userIdentifier"`    // the field value to use as the username. Default is "preferred_username" in oidc, "sub" in jwt. Other common values are "email" or "username", or "phone"
+	DisableVerifyTLS  bool     `json:"disableVerifyTLS"`  // disable TLS verification (insecure, for testing only)
+	LogoutRedirectUrl string   `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
+	CreateUser        bool     `json:"createUser"`        // deprecated: always true for supported authentication methods
+}
+
+type Auth struct {
+	TokenExpirationHours int          `json:"tokenExpirationHours"` // time in hours each web UI session token is valid for. Default is 2 hours.
+	Methods              LoginMethods `json:"methods"`
+	Key                  string       `json:"key"`           // secret: the key used to sign the JWT tokens. If not set, a random key will be generated.
+	AdminUsername        string       `json:"adminUsername"` // secret: the username of the admin user. If not set, the default is "admin".
+	AdminPassword        string       `json:"adminPassword"` // secret: the password of the admin user. If not set, the default is "admin".
+	TotpSecret           string       `json:"totpSecret"`    // secret: secret used to encrypt TOTP secrets
+	AuthMethods          []string     `json:"-"`
+}
+
+type LoginMethods struct {
+	ProxyAuth    ProxyAuthConfig    `json:"proxy" validate:"omitempty"`
+	NoAuth       bool               `json:"noauth"` // if set to true, overrides all other auth methods and disables authentication
+	PasswordAuth PasswordAuthConfig `json:"password" validate:"omitempty"`
+	OidcAuth     OidcConfig         `json:"oidc" validate:"omitempty"`
+	LdapAuth     LdapConfig         `json:"ldap" validate:"omitempty"`
+	JwtAuth      JwtAuthConfig      `json:"jwt" validate:"omitempty"`
+	PasskeyAuth  PasskeyAuthConfig  `json:"passkey" validate:"omitempty"`
+}
+
+type PasswordAuthConfig struct {
+	Enabled     bool      `json:"enabled"`
+	MinLength   int       `json:"minLength" validate:"omitempty"` // minimum pasword length required, default is 5.
+	Signup      bool      `json:"signup" validate:"omitempty"`    // allow signups on login page if enabled -- not secure.
+	Recaptcha   Recaptcha `json:"recaptcha" validate:"omitempty"` // recaptcha config, only used if signup is enabled
+	EnforcedOtp bool      `json:"enforcedOtp"`                    // if set to true, TOTP is enforced for all password users users. Otherwise, users can choose to enable TOTP.
+}
+
+type ProxyAuthConfig struct {
+	AuthCommon `json:",inline"`
+	Header     string `json:"header"` // required header to use for authentication. Security Warning: FileBrowser blindly accepts the header value as username.
+}
+
+type Recaptcha struct {
+	Host   string `json:"host" validate:"required"`
+	Key    string `json:"key" validate:"required"`
+	Secret string `json:"secret" validate:"required"`
+}
+
+// OpenID OAuth2.0
+type OidcConfig struct {
+	AuthCommon   `json:",inline"`
+	ClientID     string                `json:"clientId"`     // secret: client id of the OIDC application
+	ClientSecret string                `json:"clientSecret"` // secret: client secret of the OIDC application
+	IssuerUrl    string                `json:"issuerUrl"`    // authorization URL of the OIDC provider
+	Scopes       string                `json:"scopes"`       // scopes to request from the OIDC provider
+	Provider     *oidc.Provider        `json:"-"`            // OIDC provider
+	Verifier     *oidc.IDTokenVerifier `json:"-"`            // OIDC verifier
+}
+
+type LdapConfig struct {
+	AuthCommon   `json:",inline"`
+	Server       string `json:"server"`       // scheme://host:port of the LDAP server (e.g. ldap://localhost:389)
+	BaseDN       string `json:"baseDN"`       // LDAP search base DN (e.g. dc=ldap,dc=goauthentik,dc=io)
+	UserDN       string `json:"userDN"`       // Bind DN for service account (e.g. cn=admin,ou=users,dc=ldap,dc=goauthentik,dc=io)
+	UserPassword string `json:"userPassword"` // Bind password for service account
+	UserFilter   string `json:"userFilter"`   // Search filter for finding user by username. Default (&(cn=%s)(objectClass=user)); override e.g. (email=%s) or (sAMAccountName=%s) for other directories.
+	Port         int    `json:"-"`            // derived from server
+	Scheme       string `json:"-"`            // derived from server
+	Host         string `json:"-"`            // derived from server
+}
+
+// JwtAuthConfig configures external JWT token authentication
+// Similar to Grafana's JWT auth: verifies HS* tokens with a shared secret, or RS*/ES* with a PEM public key (or certificate)
+// The query parameter is hardcoded to "jwt" (e.g. ?jwt=<token>)
+type JwtAuthConfig struct {
+	AuthCommon `json:",inline"`
+	Header     string `json:"header"`    // HTTP header to look for JWT token (e.g. X-JWT-Assertion). Default is "X-JWT-Assertion"
+	Secret     string `json:"secret"`    // secret: Shared secret key/bytes for verifying JWT token signatures (required, eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)
+	Algorithm  string `json:"algorithm"` // JWT signing algorithm (HS256, HS384, HS512, RS256, ES256). Default is "HS256"
+}
+
+// PasskeyAuthConfig configures WebAuthn / Passkey authentication as a second factor.
+type PasskeyAuthConfig struct {
+	Enabled         bool   `json:"enabled"`         // whether to enable passkey MFA
+	RPDisplayName   string `json:"rpDisplayName"`   // the Relying Party display name (defaults to frontend name)
+	RPID            string `json:"rpId"`            // the Relying Party ID; if empty, auto-derived from base URL host
+	RPOrigins       []string `json:"rpOrigins"`     // allowed origins; if empty, auto-derived from base URL
+	LoginButtonText string   `json:"loginButtonText"` // custom text for the passkey login button
+}
+
+// ValidateLdapAuth checks LDAP config and sets defaults. Call when LDAP is enabled.
+func ValidateLdapAuth() error {
+	ldapCfg := &Config.Auth.Methods.LdapAuth
+	if ldapCfg.Server == "" {
+		return fmt.Errorf("LDAP server is required when LDAP is enabled")
+	}
+	scheme, host, port, err := parseLdapServer(ldapCfg.Server)
+	if err != nil {
+		return fmt.Errorf("LDAP server is invalid: %w", err)
+	}
+	ldapCfg.Server = fmt.Sprintf("%s://%s:%d", scheme, host, port)
+	ldapCfg.Scheme = scheme
+	ldapCfg.Host = host
+	ldapCfg.Port = port
+
+	if ldapCfg.BaseDN == "" {
+		return fmt.Errorf("LDAP baseDN is required when LDAP is enabled")
+	}
+	if ldapCfg.UserDN == "" {
+		return fmt.Errorf("LDAP userDN (bind DN) is required when LDAP is enabled")
+	}
+	if ldapCfg.UserFilter == "" {
+		ldapCfg.UserFilter = "(&(cn=%s)(objectClass=user))"
+	}
+	if err := verifyLdapConnection(); err != nil {
+		logger.Fatalf("LDAP connection check failed: %v", err)
+	}
+	return nil
+}
+
+// ValidateOidcAuth processes the OIDC callback and retrieves user identity
+func validateOidcAuth() error {
+	oidcCfg := &Config.Auth.Methods.OidcAuth // Use a pointer to modify the original config
+	if oidcCfg.GroupsClaim == "" {
+		oidcCfg.GroupsClaim = "groups"
+	}
+	if oidcCfg.UserIdentifier == "" {
+		oidcCfg.UserIdentifier = "preferred_username"
+	}
+	if oidcCfg.Scopes == "" {
+		oidcCfg.Scopes = "openid email profile"
+	}
+
+	if !oidcCfg.Enabled {
+		return errors.New("OIDC is not enabled")
+	}
+	ctx := context.Background()
+
+	// Create a custom HTTP client with proper User-Agent to avoid being blocked by bot protection
+	transport := &http.Transport{
+		Proxy: http.ProxyFromEnvironment, // Respect HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables
+	}
+
+	// If disableVerifyTLS is true, disable TLS verification
+	if oidcCfg.DisableVerifyTLS {
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+		logger.Warning("OIDC TLS verification is disabled.")
+	}
+
+	// Create custom client with User-Agent header to bypass bot protection (like Cloudflare Bot Fight Mode)
+	customClient := &http.Client{
+		Transport: &userAgentTransport{
+			base:      transport,
+			userAgent: fmt.Sprintf("FileBrowser Quantum - %s (OIDC Client)", version.Version),
+		},
+	}
+
+	// Use oidc.ClientContext to pass the custom client to the OIDC library
+	ctx = oidc.ClientContext(ctx, customClient)
+
+	provider, err := oidc.NewProvider(ctx, oidcCfg.IssuerUrl)
+	if err != nil {
+		return fmt.Errorf("url '%v' failed to create OIDC provider: %w", oidcCfg.IssuerUrl, err)
+	}
+	oidcCfg.Provider = provider
+	oidcCfg.Verifier = provider.Verifier(&oidc.Config{ClientID: oidcCfg.ClientID})
+
+	return nil
+}
+
+func parseLdapServer(server string) (scheme, host string, port int, err error) {
+	parts := strings.Split(server, "://")
+	if len(parts) != 2 {
+		return "", "", 0, fmt.Errorf("invalid LDAP server: %s", server)
+	}
+	scheme = strings.ToLower(parts[0])
+	if scheme != "ldap" && scheme != "ldaps" {
+		return "", "", 0, fmt.Errorf("invalid LDAP scheme: %s", scheme)
+	}
+	hostParts := strings.Split(parts[1], ":")
+	host = strings.TrimSuffix(hostParts[0], "/")
+	if len(hostParts) > 1 && hostParts[1] != "" {
+		port, err = strconv.Atoi(strings.TrimSuffix(hostParts[1], "/"))
+		if err != nil || port == 0 {
+			return "", "", 0, fmt.Errorf("invalid LDAP port: %s", hostParts[1])
+		}
+	} else {
+		if scheme == "ldaps" {
+			port = 636
+		} else {
+			port = 389
+		}
+	}
+	return scheme, host, port, nil
+}
+
+// VerifyLdapConnection tests that the LDAP server is reachable, can bind (if credentials set), and responds to a search.
+func verifyLdapConnection() error {
+	if Config.Auth.Methods.LdapAuth.Server == "" {
+		return fmt.Errorf("LDAP server is required when LDAP is enabled")
+	}
+	if Config.Auth.Methods.LdapAuth.BaseDN == "" {
+		return fmt.Errorf("LDAP baseDN is required for connection verification")
+	}
+	var opts []ldap.DialOpt
+	scheme := Config.Auth.Methods.LdapAuth.Scheme
+	host := Config.Auth.Methods.LdapAuth.Host
+	port := Config.Auth.Methods.LdapAuth.Port
+	if Config.Auth.Methods.LdapAuth.DisableVerifyTLS && scheme == "ldaps" {
+		opts = append(opts, ldap.DialWithTLSConfig(&tls.Config{InsecureSkipVerify: true}))
+	}
+	fullURL := fmt.Sprintf("%s://%s:%d", scheme, host, port)
+	conn, err := ldap.DialURL(fullURL, opts...)
+	if err != nil {
+		return fmt.Errorf("LDAP connection failed (is the LDAP outpost running at %s? use port 389 for LDAP, 636 for LDAPS; this is not the HTTP port): %w", fullURL, err)
+	}
+	defer conn.Close()
+	if Config.Auth.Methods.LdapAuth.UserDN != "" && Config.Auth.Methods.LdapAuth.UserPassword != "" {
+		if err = conn.Bind(Config.Auth.Methods.LdapAuth.UserDN, Config.Auth.Methods.LdapAuth.UserPassword); err != nil {
+			return fmt.Errorf("LDAP bind failed (check userDN and userPassword): %w", err)
+		}
+		defer func() { _ = conn.Unbind() }()
+	}
+	// Dummy search to verify the server responds to LDAP search (same path that fails at login if misconfigured).
+	searchRequest := ldap.NewSearchRequest(
+		Config.Auth.Methods.LdapAuth.BaseDN,
+		ldap.ScopeBaseObject,
+		ldap.NeverDerefAliases,
+		0,
+		0,
+		false,
+		"(objectClass=*)",
+		[]string{"1.1"}, // no attributes
+		nil,
+	)
+	_, err = conn.Search(searchRequest)
+	if err != nil {
+		return fmt.Errorf("LDAP search test failed (server may require StartTLS or bind before search): %w", err)
+	}
+	return nil
+}
+
+// ValidateJwtAuth checks JWT config and sets defaults. Call when JWT auth is enabled.
+func ValidateJwtAuth() error {
+	jwtCfg := &Config.Auth.Methods.JwtAuth
+	if jwtCfg.Secret == "" {
+		return fmt.Errorf("JWT secret is required when JWT auth is enabled")
+	}
+	if jwtCfg.Header == "" {
+		jwtCfg.Header = "X-JWT-Assertion"
+	}
+	if jwtCfg.Algorithm == "" {
+		jwtCfg.Algorithm = "HS256"
+	}
+	if jwtCfg.GroupsClaim == "" {
+		jwtCfg.GroupsClaim = "groups"
+	}
+	if jwtCfg.UserIdentifier == "" {
+		jwtCfg.UserIdentifier = "sub"
+	}
+	// Validate algorithm
+	validAlgos := map[string]bool{
+		"HS256": true, "HS384": true, "HS512": true,
+		"RS256": true, "RS384": true, "RS512": true,
+		"ES256": true, "ES384": true, "ES512": true,
+	}
+	if !validAlgos[jwtCfg.Algorithm] {
+		return fmt.Errorf("unsupported JWT algorithm: %s. Supported: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512", jwtCfg.Algorithm)
+	}
+	return nil
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/auth_ldap_test.go

@@ -0,0 +1,221 @@
+package settings
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestParseLdapServer(t *testing.T) {
+	tests := []struct {
+		name       string
+		server     string
+		wantScheme string
+		wantHost   string
+		wantPort   int
+		wantErr    bool
+	}{
+		{
+			name:       "ldap with host and port",
+			server:     "ldap://localhost:389",
+			wantScheme: "ldap",
+			wantHost:   "localhost",
+			wantPort:   389,
+			wantErr:    false,
+		},
+		{
+			name:       "ldaps with host and port",
+			server:     "ldaps://ldap.example.com:636",
+			wantScheme: "ldaps",
+			wantHost:   "ldap.example.com",
+			wantPort:   636,
+			wantErr:    false,
+		},
+		{
+			name:       "ldap with trailing slash",
+			server:     "ldap://host:389/",
+			wantScheme: "ldap",
+			wantHost:   "host",
+			wantPort:   389,
+			wantErr:    false,
+		},
+		{
+			name:       "ldap port not provided defaults to 389",
+			server:     "ldap://localhost",
+			wantScheme: "ldap",
+			wantHost:   "localhost",
+			wantPort:   389,
+			wantErr:    false,
+		},
+		{
+			name:       "ldaps port not provided defaults to 636",
+			server:     "ldaps://ldap.example.com",
+			wantScheme: "ldaps",
+			wantHost:   "ldap.example.com",
+			wantPort:   636,
+			wantErr:    false,
+		},
+		{
+			name:    "port provided but invalid returns error",
+			server:  "ldap://host:bad",
+			wantErr: true,
+		},
+		{
+			name:    "port provided but invalid (ldaps) returns error",
+			server:  "ldaps://host:xyz",
+			wantErr: true,
+		},
+		{
+			name:    "port zero returns error",
+			server:  "ldap://host:0",
+			wantErr: true,
+		},
+		{
+			name:    "empty server",
+			server:  "",
+			wantErr: true,
+		},
+		{
+			name:    "no scheme",
+			server:  "localhost:389",
+			wantErr: true,
+		},
+		{
+			name:    "invalid scheme",
+			server:  "http://localhost:389",
+			wantErr: true,
+		},
+		{
+			name:    "invalid scheme ftp",
+			server:  "ftp://localhost:389",
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotScheme, gotHost, gotPort, err := parseLdapServer(tt.server)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("parseLdapServer() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !tt.wantErr {
+				if gotScheme != tt.wantScheme {
+					t.Errorf("parseLdapServer() scheme = %v, want %v", gotScheme, tt.wantScheme)
+				}
+				if gotHost != tt.wantHost {
+					t.Errorf("parseLdapServer() host = %v, want %v", gotHost, tt.wantHost)
+				}
+				if gotPort != tt.wantPort {
+					t.Errorf("parseLdapServer() port = %v, want %v", gotPort, tt.wantPort)
+				}
+			}
+		})
+	}
+}
+
+func TestVerifyLdapConnection_ValidationOnly(t *testing.T) {
+	// Save and restore global config so we don't affect other tests
+	saved := Config.Auth.Methods.LdapAuth
+	defer func() { Config.Auth.Methods.LdapAuth = saved }()
+
+	t.Run("empty server returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "",
+			BaseDN:     "dc=test,dc=local",
+		}
+		err := verifyLdapConnection()
+		if err == nil {
+			t.Fatal("verifyLdapConnection() expected error for empty server")
+		}
+		if !strings.Contains(err.Error(), "LDAP server is required") {
+			t.Errorf("verifyLdapConnection() error = %v, want message containing 'LDAP server is required'", err)
+		}
+	})
+
+	t.Run("empty baseDN returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "ldap://localhost:389",
+			Scheme:     "ldap",
+			Host:       "localhost",
+			Port:       389,
+			BaseDN:     "",
+		}
+		err := verifyLdapConnection()
+		if err == nil {
+			t.Fatal("verifyLdapConnection() expected error for empty baseDN")
+		}
+		if !strings.Contains(err.Error(), "baseDN is required") {
+			t.Errorf("verifyLdapConnection() error = %v, want message containing 'baseDN is required'", err)
+		}
+	})
+}
+
+func TestValidateLdapAuth_ConfigValidation(t *testing.T) {
+	saved := Config.Auth.Methods.LdapAuth
+	defer func() { Config.Auth.Methods.LdapAuth = saved }()
+
+	t.Run("empty server returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "",
+			BaseDN:     "dc=test,dc=local",
+			UserDN:     "cn=admin,dc=test,dc=local",
+		}
+		err := ValidateLdapAuth()
+		if err == nil {
+			t.Fatal("ValidateLdapAuth() expected error for empty server")
+		}
+		if !strings.Contains(err.Error(), "server is required") {
+			t.Errorf("ValidateLdapAuth() error = %v", err)
+		}
+	})
+
+	t.Run("invalid server URL returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "not-a-valid-ldap-url",
+			BaseDN:     "dc=test,dc=local",
+			UserDN:     "cn=admin,dc=test,dc=local",
+		}
+		err := ValidateLdapAuth()
+		if err == nil {
+			t.Fatal("ValidateLdapAuth() expected error for invalid server URL")
+		}
+		if !strings.Contains(err.Error(), "invalid") {
+			t.Errorf("ValidateLdapAuth() error = %v", err)
+		}
+	})
+
+	t.Run("empty baseDN returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "ldap://localhost:389",
+			BaseDN:     "",
+			UserDN:     "cn=admin,dc=test,dc=local",
+		}
+		err := ValidateLdapAuth()
+		if err == nil {
+			t.Fatal("ValidateLdapAuth() expected error for empty baseDN")
+		}
+		if !strings.Contains(err.Error(), "baseDN is required") {
+			t.Errorf("ValidateLdapAuth() error = %v", err)
+		}
+	})
+
+	t.Run("empty userDN returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "ldap://localhost:389",
+			BaseDN:     "dc=test,dc=local",
+			UserDN:     "",
+		}
+		err := ValidateLdapAuth()
+		if err == nil {
+			t.Fatal("ValidateLdapAuth() expected error for empty userDN")
+		}
+		if !strings.Contains(err.Error(), "userDN") {
+			t.Errorf("ValidateLdapAuth() error = %v", err)
+		}
+	})
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/configFunctions.go

@@ -0,0 +1,27 @@
+package settings
+
+func CanConvertImage(ext string) bool {
+	if !MediaEnabled() {
+		return false
+	}
+	val := Config.Integrations.Media.Convert.ImagePreview[ImagePreviewType(ext)]
+	if val == nil {
+		return false // Extension not in the configured list
+	}
+	return *val
+}
+
+func CanConvertVideo(ext string) bool {
+	if !MediaEnabled() {
+		return false
+	}
+	val := Config.Integrations.Media.Convert.VideoPreview[VideoPreviewType(ext)]
+	if val == nil {
+		return false // Extension not in the configured list
+	}
+	return *val
+}
+
+func MediaEnabled() bool {
+	return Env.FFmpegPath != "" && Env.FFprobePath != ""
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/config_test.go

@@ -0,0 +1,149 @@
+package settings
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestInitialize(t *testing.T) {
+	type args struct {
+		configFile string
+	}
+	tests := []struct {
+		name string
+		args args
+	}{
+		// TODO: Add test cases.
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			Initialize(tt.args.configFile)
+		})
+	}
+}
+
+func Test_setDefaults(t *testing.T) {
+	tests := []struct {
+		name string
+		want Settings
+	}{
+		// TODO: Add test cases.
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := SetDefaults(true); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("setDefaults() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestConfigLoadChanged(t *testing.T) {
+	// Create isolated test directory
+	testDir := t.TempDir()
+	validContent, err := os.ReadFile("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("failed to read validConfig.yaml: %v", err)
+	}
+	configFile := filepath.Join(testDir, "config.yaml")
+	if err = os.WriteFile(configFile, validContent, 0644); err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
+	defaultConfig := SetDefaults(true)
+	err = loadConfigWithDefaults(configFile, true)
+	if err != nil {
+		t.Fatalf("error loading config file: %v", err)
+	}
+	// Use go-cmp to compare the two structs
+	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
+		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
+	}
+}
+
+func TestConfigLoadEnvVars(t *testing.T) {
+	// Create isolated test directory
+	testDir := t.TempDir()
+	validContent, err := os.ReadFile("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("failed to read validConfig.yaml: %v", err)
+	}
+	configFile := filepath.Join(testDir, "config.yaml")
+	if err = os.WriteFile(configFile, validContent, 0644); err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
+	defaultConfig := SetDefaults(true)
+	expectedKey := "MYKEY"
+	// mock environment variables
+	os.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
+	err = loadConfigWithDefaults(configFile, true)
+	if err != nil {
+		t.Fatalf("error loading config file: %v", err)
+	}
+	if Config.Integrations.OnlyOffice.Secret != expectedKey {
+		t.Errorf("Expected OnlyOffice.Secret to be '%v', got '%s'", expectedKey, Config.Integrations.OnlyOffice.Secret)
+	}
+	// Use go-cmp to compare the two structs
+	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
+		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
+	}
+}
+
+func TestConfigLoadSpecificValues(t *testing.T) {
+	// Create isolated test directory
+	testDir := t.TempDir()
+	validContent, err := os.ReadFile("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("failed to read validConfig.yaml: %v", err)
+	}
+	configFile := filepath.Join(testDir, "config.yaml")
+	if err = os.WriteFile(configFile, validContent, 0644); err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
+	defaultConfig := SetDefaults(true)
+	err = loadConfigWithDefaults(configFile, true)
+	if err != nil {
+		t.Fatalf("error loading config file: %v", err)
+	}
+	testCases := []struct {
+		fieldName string
+		globalVal interface{}
+		newVal    interface{}
+	}{
+		{"Server.Database", Config.Server.Database, defaultConfig.Server.Database},
+	}
+
+	for _, tc := range testCases {
+		if tc.globalVal == tc.newVal {
+			t.Errorf("Differences should have been found:\nConfig.%s: %v \nSetConfig: %v \n", tc.fieldName, tc.globalVal, tc.newVal)
+		}
+	}
+}
+
+func TestInvalidConfig(t *testing.T) {
+	// Create isolated test directory
+	testDir := t.TempDir()
+	invalidContent, err := os.ReadFile("./invalidConfig.yaml")
+	if err != nil {
+		t.Fatalf("failed to read invalidConfig.yaml: %v", err)
+	}
+	configFile := filepath.Join(testDir, "config.yaml")
+	if err = os.WriteFile(configFile, invalidContent, 0644); err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
+	err = loadConfigWithDefaults(configFile, true)
+	// Config loads successfully but validation should catch missing sources
+	if err == nil {
+		err = ValidateConfig(Config)
+		if err == nil {
+			t.Fatal("expected validation error for config with missing required sources, got nil")
+		}
+	}
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/functions.go

@@ -0,0 +1,60 @@
+package settings
+
+import (
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// InitializeUserResolvers sets up the global resolvers and config providers in the users package
+// This should be called once during application initialization
+func InitializeUserResolvers() {
+	// Set up the source name resolver
+	users.SetSourceNameResolver(func(sourceName string) (string, error) {
+		source, ok := Config.Server.NameToSource[sourceName]
+		if !ok {
+			logger.Debug("Could not get scope from source name: ", sourceName)
+			return "", nil
+		}
+		return source.Path, nil
+	})
+
+	// Set up the source config provider
+	users.SetSourceConfig(&users.SourceConfigProvider{
+		GetSourceByPath: func(path string) (users.SourceInfo, bool) {
+			source, ok := Config.Server.SourceMap[path]
+			if !ok {
+				return users.SourceInfo{}, false
+			}
+			return users.SourceInfo{
+				Path:             source.Path,
+				Name:             source.Name,
+				DefaultUserScope: source.Config.DefaultUserScope,
+			}, true
+		},
+		GetSourceByName: func(name string) (users.SourceInfo, bool) {
+			source, ok := Config.Server.NameToSource[name]
+			if !ok {
+				return users.SourceInfo{}, false
+			}
+			return users.SourceInfo{
+				Path:             source.Path,
+				Name:             source.Name,
+				DefaultUserScope: source.Config.DefaultUserScope,
+			}, true
+		},
+		GetAllSources: func() []users.SourceInfo {
+			sources := make([]users.SourceInfo, 0, len(Config.Server.Sources))
+			for _, source := range Config.Server.Sources {
+				sources = append(sources, users.SourceInfo{
+					Path:             source.Path,
+					Name:             source.Name,
+					DefaultUserScope: source.Config.DefaultUserScope,
+				})
+			}
+			return sources
+		},
+		GetDefaultScopes: func() []users.SourceScope {
+			return Config.UserDefaults.DefaultScopes
+		},
+	})
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/generator_simple_test.go

@@ -0,0 +1,236 @@
+package settings
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func TestGenerateConfigYaml_Basic(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Test using the actual source directory structure
+	trueVal := true
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "es",          // Non-default value
+			DarkMode:                &trueVal,      // Default value
+			DisableOfficePreviewExt: ".docx .xlsx", // This field is deprecated
+		},
+		Auth: Auth{
+			Key:           "secret123",    // This is a secret field
+			AdminUsername: "testadmin",    // This is a secret field
+			AdminPassword: "testpassword", // This is a secret field
+		},
+	}
+
+	// Test different combinations
+	testCases := []struct {
+		name             string
+		showComments     bool
+		showFull         bool
+		filterDeprecated bool
+		expectSecrets    bool
+		expectDeprecated bool
+	}{
+		{
+			name:             "API_mode_all_fields",
+			showComments:     false,
+			showFull:         true,
+			filterDeprecated: false,
+			expectSecrets:    true, // Secrets should be hidden
+			expectDeprecated: true, // Deprecated should be shown
+		},
+		{
+			name:             "Static_config_filter_deprecated",
+			showComments:     true,
+			showFull:         true,
+			filterDeprecated: true,
+			expectSecrets:    true,  // Secrets should be hidden
+			expectDeprecated: false, // Deprecated should be filtered
+		},
+		{
+			name:             "Filtered_non_defaults",
+			showComments:     false,
+			showFull:         false,
+			filterDeprecated: false,
+			expectSecrets:    true,  // Secrets should be hidden
+			expectDeprecated: false, // Might not appear if matches default
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Use the current directory structure for real testing
+			yamlOutput, err := GenerateConfigYaml(config, tc.showComments, tc.showFull, tc.filterDeprecated)
+			if err != nil {
+				t.Fatalf("GenerateConfigYaml failed: %v", err)
+			}
+
+			// Basic validation - should produce some output
+			if len(yamlOutput) == 0 {
+				t.Fatal("Generated empty YAML")
+			}
+
+			// Test string quoting - string values should be quoted, numbers and booleans should not
+			lines := strings.Split(yamlOutput, "\n")
+			for _, line := range lines {
+				if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+					// This is a key-value line, skip comment portion
+					parts := strings.SplitN(line, ":", 2)
+					if len(parts) == 2 {
+						value := strings.TrimSpace(parts[1])
+						// Remove comments
+						if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+							value = strings.TrimSpace(value[:commentIdx])
+						}
+
+						// Skip empty values, arrays, and objects
+						if value == "" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
+							continue
+						}
+
+						// Check if it's a number (should NOT be quoted)
+						if reNumber.MatchString(value) {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Numeric value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's a boolean (should NOT be quoted)
+						if value == "true" || value == "false" {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Boolean value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's null (should NOT be quoted - it's a YAML literal for nil)
+						if value == "null" {
+							continue
+						}
+
+						// Everything else should be a quoted string
+						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+							// Add debug info to see what's wrong
+							t.Logf("DEBUG: Checking value '%s' from line '%s'", value, strings.TrimSpace(line))
+							t.Errorf("String value should be quoted in line: %s (value: %s)", strings.TrimSpace(line), value)
+						}
+					}
+				}
+			}
+
+			// Test secret hiding
+			if tc.expectSecrets {
+				if !strings.Contains(yamlOutput, "**hidden**") {
+					t.Error("Expected secrets to be hidden with **hidden**")
+				}
+				if strings.Contains(yamlOutput, "secret123") || strings.Contains(yamlOutput, "testadmin") || strings.Contains(yamlOutput, "testpassword") {
+					t.Error("Secret values should not appear in output")
+				}
+			}
+
+			// Test deprecated field filtering
+			hasDeprecated := strings.Contains(yamlOutput, "disableOfficePreviewExt")
+			if tc.expectDeprecated && !hasDeprecated {
+				t.Error("Expected deprecated field to be present")
+			}
+			if !tc.expectDeprecated && hasDeprecated && tc.filterDeprecated {
+				t.Error("Expected deprecated field to be filtered out when filterDeprecated=true")
+			}
+
+			// Test comments
+			hasComments := strings.Contains(yamlOutput, "#")
+			if tc.showComments && !hasComments {
+				t.Error("Expected comments to be present when showComments=true")
+			}
+
+			t.Logf("Test case: %s\nGenerated YAML:\n%s\n", tc.name, yamlOutput)
+		})
+	}
+}
+
+func TestCollectCommentsAndSecrets_Basic(t *testing.T) {
+	// Test the comment and secret collection directly
+	comments, secrets, deprecated, err := CollectCommentsAndSecrets(".")
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Should find some secrets in the actual source files
+	foundSecrets := false
+	for typeName, typeSecrets := range secrets {
+		for fieldName := range typeSecrets {
+			t.Logf("Found secret: %s.%s", typeName, fieldName)
+			foundSecrets = true
+		}
+	}
+	if !foundSecrets {
+		t.Error("Expected to find some secret fields in the actual source code")
+	}
+
+	// Should find some deprecated fields
+	foundDeprecated := false
+	for typeName, typeDeprecated := range deprecated {
+		for fieldName := range typeDeprecated {
+			t.Logf("Found deprecated: %s.%s", typeName, fieldName)
+			foundDeprecated = true
+		}
+	}
+	if !foundDeprecated {
+		t.Error("Expected to find some deprecated fields in the actual source code")
+	}
+
+	t.Logf("Comments: %d types", len(comments))
+	t.Logf("Secrets: %d types", len(secrets))
+	t.Logf("Deprecated: %d types", len(deprecated))
+}
+
+func TestGenerateYaml_StaticGeneration(t *testing.T) {
+	// Test the static generation function that's used by FILEBROWSER_GENERATE_CONFIG=true
+
+	// Create a temporary config for testing
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "en",
+			DisableOfficePreviewExt: ".docx .xlsx", // This should be filtered out
+		},
+		Auth: Auth{
+			Key: "test-secret", // This should be redacted
+		},
+	}
+
+	// Test static generation with comments and deprecated filtering
+	yamlOutput, err := GenerateConfigYamlWithSource(config, true, true, true, ".")
+	if err != nil {
+		t.Fatalf("Static generation failed: %v", err)
+	}
+
+	// Verify comments are included
+	if !strings.Contains(yamlOutput, "#") {
+		t.Error("Static generation should include comments")
+	}
+
+	// Verify deprecated field is filtered out
+	if strings.Contains(yamlOutput, "disableOfficePreviewExt") {
+		t.Error("Static generation should filter out deprecated field disableOfficePreviewExt")
+	}
+
+	// Verify secrets are redacted
+	if !strings.Contains(yamlOutput, "**hidden**") {
+		t.Error("Static generation should redact secrets")
+	}
+	if strings.Contains(yamlOutput, "test-secret") {
+		t.Error("Static generation should not contain actual secret values")
+	}
+
+	// Verify it has proper structure
+	if !strings.Contains(yamlOutput, "userDefaults:") {
+		t.Error("Static generation should contain userDefaults section")
+	}
+	if !strings.Contains(yamlOutput, "auth:") {
+		t.Error("Static generation should contain auth section")
+	}
+
+	t.Logf("Static generation successful with comments and proper filtering")
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/generator_test.go

@@ -0,0 +1,477 @@
+package settings
+
+import (
+	"os"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// Test structs for comprehensive testing
+type TestConfig struct {
+	PublicField     string     `json:"publicField"`     // A regular public field
+	SecretField     string     `json:"secretField"`     // secret: this should be hidden
+	DeprecatedField string     `json:"deprecatedField"` // deprecated: this field is old
+	EmptyField      string     `json:"emptyField"`      // An empty string field
+	DefaultField    string     `json:"defaultField"`    // A field that matches default
+	NonDefaultField string     `json:"nonDefaultField"` // A field that differs from default
+	NestedStruct    TestNested `json:"nestedStruct"`
+}
+
+type TestNested struct {
+	NestedPublic     string `json:"nestedPublic"`     // A nested public field
+	NestedSecret     string `json:"nestedSecret"`     // secret: nested secret field
+	NestedDeprecated string `json:"nestedDeprecated"` // deprecated: nested deprecated field
+}
+
+// Helper to create test source files for comment parsing
+func createTestSourceFile(t *testing.T, content string) (string, func()) {
+	tmpFile, err := os.CreateTemp("", "test_*.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := tmpFile.WriteString(content); err != nil {
+		t.Fatal(err)
+	}
+	tmpFile.Close()
+
+	cleanup := func() {
+		os.Remove(tmpFile.Name())
+	}
+
+	return tmpFile.Name(), cleanup
+}
+
+func TestGenerateConfigYaml_StringQuoting(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Create a simple test source file for this test
+	sourceContent := `package settings
+
+type Settings struct {
+	UserDefaults UserDefaults ` + "`json:\"userDefaults\"`" + `
+	Auth Auth ` + "`json:\"auth\"`" + `
+}
+
+type UserDefaults struct {
+	Locale string ` + "`json:\"locale\"`" + `
+}
+
+type Auth struct {
+	AdminUsername string ` + "`json:\"adminUsername\"`" + `
+}
+`
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+	sourcePath := tmpFile[:strings.LastIndex(tmpFile, "/")]
+
+	// Create real Settings with string values to test quoting
+	settings := &Settings{
+		UserDefaults: UserDefaults{
+			Locale: "en-US",
+		},
+		Auth: Auth{
+			AdminUsername: "admin",
+		},
+	}
+
+	// Test with no filtering - should quote all strings
+	yamlOutput, err := GenerateConfigYamlWithSource(settings, false, true, false, sourcePath)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml failed: %v", err)
+	}
+
+	// All string values should be quoted
+	lines := strings.Split(yamlOutput, "\n")
+	for _, line := range lines {
+		if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+			// This is a key-value line
+			parts := strings.SplitN(line, ":", 2)
+			if len(parts) == 2 {
+				value := strings.TrimSpace(parts[1])
+
+				// Remove comments
+				if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+					value = strings.TrimSpace(value[:commentIdx])
+				}
+
+				// Skip empty values, arrays, objects, booleans
+				if value == "" || value == "false" || value == "true" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
+					continue
+				}
+
+				// Check if it's a number (should NOT be quoted)
+				if reNumber.MatchString(value) {
+					if strings.HasPrefix(value, "\"") {
+						t.Errorf("Numeric value should not be quoted: %s (value: '%s')", line, value)
+					}
+					continue
+				}
+
+				// Check if it's null (should NOT be quoted - it's a YAML literal for nil)
+				if value == "null" {
+					continue
+				}
+
+				// Everything else should be a quoted string
+				if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+					t.Errorf("String value should be quoted: %s (value: '%s')", line, value)
+				}
+			}
+		}
+	}
+}
+
+func TestGenerateConfigYaml_SecretHiding(t *testing.T) {
+	// Create temporary source file with our test structs
+	sourceContent := `package settings
+
+type TestConfig struct {
+	PublicField string ` + "`json:\"publicField\"`" + ` // A regular public field
+	SecretField string ` + "`json:\"secretField\"`" + ` // secret: this should be hidden
+}
+
+type TestNested struct {
+	NestedPublic string ` + "`json:\"nestedPublic\"`" + ` // A nested public field
+	NestedSecret string ` + "`json:\"nestedSecret\"`" + ` // secret: nested secret field
+}
+`
+
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+
+	// Test secret detection
+	_, secrets, _, err := CollectCommentsAndSecrets(tmpFile)
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Verify secret fields are detected
+	if !secrets["TestConfig"]["SecretField"] {
+		t.Error("SecretField should be marked as secret")
+	}
+	if !secrets["TestNested"]["NestedSecret"] {
+		t.Error("NestedSecret should be marked as secret")
+	}
+	if secrets["TestConfig"]["PublicField"] {
+		t.Error("PublicField should not be marked as secret")
+	}
+
+	// Test that secrets are properly collected
+	if len(secrets["TestConfig"]) != 1 {
+		t.Errorf("Expected 1 secret field in TestConfig, got %d", len(secrets["TestConfig"]))
+	}
+}
+
+func TestGenerateConfigYaml_DeprecatedFiltering(t *testing.T) {
+	// Create temporary source file with deprecated fields
+	sourceContent := `package settings
+
+type TestConfig struct {
+	PublicField     string ` + "`json:\"publicField\"`" + ` // A regular public field
+	DeprecatedField string ` + "`json:\"deprecatedField\"`" + ` // deprecated: this field is old
+}
+`
+
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+
+	// Test deprecated detection
+	_, _, deprecated, err := CollectCommentsAndSecrets(tmpFile)
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Verify deprecated fields are detected
+	if !deprecated["TestConfig"]["DeprecatedField"] {
+		t.Error("DeprecatedField should be marked as deprecated")
+	}
+	if deprecated["TestConfig"]["PublicField"] {
+		t.Error("PublicField should not be marked as deprecated")
+	}
+}
+
+func TestGenerateConfigYaml_FullVsFiltered(t *testing.T) {
+	// Create minimal test source
+	sourceContent := `package settings
+
+type Settings struct {
+	UserDefaults UserDefaults ` + "`json:\"userDefaults\"`" + `
+}
+
+type UserDefaults struct {
+	DarkMode bool ` + "`json:\"darkMode\"`" + `
+	Locale string ` + "`json:\"locale\"`" + `
+}
+`
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+	sourcePath := tmpFile[:strings.LastIndex(tmpFile, "/")]
+
+	// Create a config with both default and non-default values
+	trueVal := true
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			DarkMode: &trueVal, // This matches default
+			Locale:   "es",     // This differs from default ("en")
+		},
+	}
+
+	// Test full=true - should show all fields
+	fullYaml, err := GenerateConfigYamlWithSource(config, false, true, false, sourcePath)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with full=true failed: %v", err)
+	}
+
+	// Test full=false - should only show non-default fields
+	filteredYaml, err := GenerateConfigYamlWithSource(config, false, false, false, sourcePath)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with full=false failed: %v", err)
+	}
+
+	// Full output should be longer than filtered
+	if len(fullYaml) <= len(filteredYaml) {
+		t.Error("Full YAML should be longer than filtered YAML")
+	}
+
+	// Filtered output should contain the non-default field
+	if !strings.Contains(filteredYaml, "locale") {
+		t.Error("Filtered YAML should contain non-default locale field")
+	}
+
+	// Full output should contain default fields
+	if !strings.Contains(fullYaml, "darkMode") {
+		t.Error("Full YAML should contain darkMode field")
+	}
+}
+
+func TestGenerateConfigYaml_CommentsOnOff(t *testing.T) {
+	// Use the actual settings source directory since comments work there
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale: "en",
+		},
+	}
+
+	// Test with comments=true using the real source
+	withComments, err := GenerateConfigYaml(config, true, true, false)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with comments=true failed: %v", err)
+	}
+
+	// Test with comments=false using the real source
+	withoutComments, err := GenerateConfigYaml(config, false, true, false)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with comments=false failed: %v", err)
+	}
+
+	// Output with comments should be longer
+	if len(withComments) <= len(withoutComments) {
+		t.Errorf("YAML with comments (%d chars) should be longer than without comments (%d chars)", len(withComments), len(withoutComments))
+	}
+
+	// With comments should contain '#' characters
+	if !strings.Contains(withComments, "#") {
+		t.Error("YAML with comments should contain '#' characters")
+	}
+
+	// Without comments should not contain '#' characters
+	if strings.Contains(withoutComments, "#") {
+		t.Error("YAML without comments should not contain '#' characters")
+	}
+}
+
+func TestGenerateConfigYaml_IntegrationTest(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Comprehensive test with all features
+	trueVal := true
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "es",          // Non-default
+			DarkMode:                &trueVal,      // Default
+			DisableOfficePreviewExt: ".docx .xlsx", // This is deprecated
+		},
+		Auth: Auth{
+			Key:           "secret123", // This is secret
+			AdminUsername: "admin",     // This is secret
+			AdminPassword: "password",  // This is secret
+		},
+	}
+
+	tests := []struct {
+		name             string
+		showComments     bool
+		showFull         bool
+		filterDeprecated bool
+		expectSecret     bool
+		expectDeprecated bool
+		expectFull       bool
+		expectComments   bool
+	}{
+		{
+			name:             "API mode: show all including deprecated",
+			showComments:     false,
+			showFull:         true,
+			filterDeprecated: false,
+			expectSecret:     true,  // secrets should be hidden
+			expectDeprecated: true,  // deprecated should be shown
+			expectFull:       true,  // all fields shown
+			expectComments:   false, // no comments
+		},
+		{
+			name:             "Static config mode: filter deprecated",
+			showComments:     true,
+			showFull:         true,
+			filterDeprecated: true,
+			expectSecret:     true,  // secrets should be hidden
+			expectDeprecated: false, // deprecated should be filtered
+			expectFull:       true,  // all non-deprecated fields shown
+			expectComments:   true,  // comments included
+		},
+		{
+			name:             "Filtered output: only changes",
+			showComments:     false,
+			showFull:         false,
+			filterDeprecated: false,
+			expectSecret:     true,  // secrets should be hidden
+			expectDeprecated: false, // might not appear if matches default
+			expectFull:       false, // only non-default fields
+			expectComments:   false, // no comments
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			yamlOutput, err := GenerateConfigYaml(config, tt.showComments, tt.showFull, tt.filterDeprecated)
+			if err != nil {
+				t.Fatalf("GenerateConfigYaml failed: %v", err)
+			}
+
+			// Check secret hiding
+			if tt.expectSecret {
+				if !strings.Contains(yamlOutput, "**hidden**") {
+					t.Error("Expected secrets to be hidden with **hidden**")
+				}
+				if strings.Contains(yamlOutput, "secret123") {
+					t.Error("Secret values should not appear in output")
+				}
+			}
+
+			// Check deprecated field filtering
+			hasDeprecated := strings.Contains(yamlOutput, "disableOfficePreviewExt")
+			if tt.expectDeprecated && !hasDeprecated {
+				t.Error("Expected deprecated field to be present")
+			}
+			if !tt.expectDeprecated && hasDeprecated && tt.filterDeprecated {
+				t.Error("Expected deprecated field to be filtered out")
+			}
+
+			// Check comments
+			hasComments := strings.Contains(yamlOutput, "#")
+			if tt.expectComments && !hasComments {
+				t.Error("Expected comments to be present")
+			}
+			if !tt.expectComments && hasComments {
+				t.Error("Expected no comments")
+			}
+
+			// Check string quoting - all string values should be quoted
+			lines := strings.Split(yamlOutput, "\n")
+			for _, line := range lines {
+				if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+					// This is a key-value line
+					parts := strings.SplitN(line, ":", 2)
+					if len(parts) == 2 {
+						value := strings.TrimSpace(parts[1])
+						// Skip comments and empty values
+						if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+							// If comment starts at the beginning, there's no value, just a comment
+							if commentIdx == 0 {
+								continue
+							}
+							value = strings.TrimSpace(value[:commentIdx])
+						}
+						// Check if it's a number (should NOT be quoted)
+						if reNumber.MatchString(value) {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Numeric value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's a boolean (should NOT be quoted)
+						if value == "true" || value == "false" {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Boolean value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Skip arrays, objects, empty values, and null
+						if value == "" || value == "null" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") || strings.Contains(value, ":") {
+							continue
+						}
+
+						// Everything else should be a quoted string
+						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+							t.Errorf("String value should be quoted in line: %s (value: '%s')", line, value)
+						}
+					}
+				}
+			}
+
+			t.Logf("Generated YAML for %s:\n%s", tt.name, yamlOutput)
+		})
+	}
+}
+
+func TestGenerateConfigYaml_EdgeCases(t *testing.T) {
+	tests := []struct {
+		name   string
+		config *Settings
+		desc   string
+	}{
+		{
+			name:   "empty_config",
+			config: &Settings{},
+			desc:   "Empty config should generate valid YAML",
+		},
+		{
+			name: "only_defaults",
+			config: &Settings{
+				UserDefaults: UserDefaults{
+					DarkMode: boolPtr(true), // default value
+					Locale:   "en",          // default value
+				},
+			},
+			desc: "Config with only default values",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test all combinations
+			for _, showComments := range []bool{false, true} {
+				for _, showFull := range []bool{false, true} {
+					for _, filterDeprecated := range []bool{false, true} {
+						yamlOutput, err := GenerateConfigYaml(tt.config, showComments, showFull, filterDeprecated)
+						if err != nil {
+							t.Fatalf("GenerateConfigYaml failed for %s (comments=%v, full=%v, filterDeprecated=%v): %v",
+								tt.desc, showComments, showFull, filterDeprecated, err)
+						}
+
+						// Basic validation - should produce valid YAML structure
+						if yamlOutput == "" {
+							t.Errorf("Generated empty YAML for %s", tt.desc)
+						}
+
+						// Should not contain obvious error messages (but allow "error" in log levels etc)
+						if strings.Contains(yamlOutput, "Error:") || strings.Contains(yamlOutput, "ERROR:") {
+							t.Errorf("YAML contains error for %s", tt.desc)
+						}
+					}
+				}
+			}
+		})
+	}
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/invalidConfig.yaml

@@ -0,0 +1,47 @@
+server:
+  indexingInterval: 5
+  numImageProcessors: 4
+  socket: ""
+  tlsKey: ""
+  tlsCert: ""
+  enableThumbnails: false
+  resizePreview: true
+  port: 80
+  baseURL: "/"
+  database: "mydb.db"
+  root: "."
+auth:
+  recaptcha:
+    host: ""
+    key: ""
+    secret: ""
+  header: ""
+  command: ""
+  signup: false
+  shell: ""
+frontend:
+  name: ""
+  disableExternal: true
+  disableUsedPercentage: true
+  files: ""
+  color: ""
+userDefaults:
+  scope: ""
+  locale: ""
+  viewMode: ""
+  darkMode: true
+  disableSettings: false
+  singleClick: true
+  sorting:
+    by: ""
+    asc: true
+  permissions:
+    admin: true
+    execute: true
+    create: true
+    rename: true
+    modify: true
+    delete: true
+    share: true
+    download: true
+  dateFormat: false

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/migration_test.go

@@ -0,0 +1,221 @@
+package settings
+
+import (
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// TestMigrateUserDefaults_OldToNew verifies that deprecated fields are correctly migrated to new fields
+func TestMigrateUserDefaults_OldToNew(t *testing.T) {
+	// Setup: Create UserDefaults with old fields set
+	Config.UserDefaults = UserDefaults{
+		// Old deprecated fields
+		DarkMode:                   boolPtr(true),
+		DisableQuickToggles:        true,
+		HideSidebarFileActions:     true,
+		StickySidebar:              true,
+		SingleClick:                true,
+		HideFilesInTree:            true,
+		ShowToolsInSidebar:         boolPtr(false),
+		DeleteWithoutConfirming:    true,
+		DateFormat:                 true,
+		ShowHidden:                 true,
+		QuickDownload:              true,
+		ShowSelectMultiple:         true,
+		HideFileExt:                ".tmp",
+		ShowCopyPath:               true,
+		DeleteAfterArchive:         true,
+		DisablePreviewExt:          ".exe",
+		EditorQuickSave:            true,
+		DisableViewingExt:          ".bin",
+		DisableOnlyOfficeExt:       ".md",
+		PreferEditorForMarkdown:    true,
+		DebugOffice:                true,
+		DisableSearchOptions:       true,
+		ThemeColor:                 "var(--red)",
+		CustomTheme:                "dark",
+		Locale:                     "de",
+		LockPassword:               true,
+		DisableSettings:            true,
+		LoginMethod:                "oidc",
+		DisableUpdateNotifications: true,
+		Permissions: UserDefaultsPermissions{
+			Api:      true,
+			Admin:    true,
+			Modify:   true,
+			Share:    true,
+			Realtime: true,
+			Delete:   true,
+			Create:   true,
+			Download: boolPtr(false),
+		},
+		Preview: UserDefaultsPreview{
+			Image:              boolPtr(true),
+			Video:              boolPtr(true),
+			Audio:              boolPtr(true),
+			MotionVideoPreview: boolPtr(true),
+			Office:             boolPtr(true),
+			PopUp:              boolPtr(true),
+			HighQuality:        boolPtr(true),
+			Folder:             boolPtr(true),
+			Models:             boolPtr(true),
+			// Deprecated fields that should be migrated
+			DisableHideSidebar: true,
+			AutoplayMedia:      true,
+			DefaultMediaPlayer: true,
+		},
+		FileLoading: users.FileLoading{
+			MaxConcurrent:   5,
+			UploadChunkSize: 20,
+		},
+	}
+
+	// Execute: Run migration
+	migrateUserDefaults()
+
+	// Verify: Check that new fields are populated from old fields
+	ud := &Config.UserDefaults
+
+	// Sidebar fields
+	if !ud.Sidebar.DisableQuickToggles {
+		t.Error("sidebar.disableQuickToggles should be true")
+	}
+	if !ud.Sidebar.HideFileActions {
+		t.Error("sidebar.hideFileActions should be true")
+	}
+	if !ud.Sidebar.Sticky {
+		t.Error("sidebar.sticky should be true")
+	}
+	if !ud.Sidebar.HideFiles {
+		t.Error("sidebar.hideFiles should be true")
+	}
+	if ud.Sidebar.ShowTools == nil || *ud.Sidebar.ShowTools != false {
+		t.Error("sidebar.showTools should be false")
+	}
+	if !ud.Sidebar.DisableHideOnPreview {
+		t.Error("sidebar.disableHideOnPreview should be true")
+	}
+
+	// Listing fields
+	if !ud.Listing.DeleteWithoutConfirming {
+		t.Error("listing.deleteWithoutConfirming should be true")
+	}
+	if !ud.Listing.DateFormat {
+		t.Error("listing.dateFormat should be true")
+	}
+	if !ud.Listing.ShowHidden {
+		t.Error("listing.showHidden should be true")
+	}
+	if !ud.Listing.QuickDownload {
+		t.Error("listing.quickDownload should be true")
+	}
+	if !ud.Listing.ShowSelectMultiple {
+		t.Error("listing.showSelectMultiple should be true")
+	}
+	if !ud.Listing.SingleClick {
+		t.Error("listing.singleClick should be true")
+	}
+	if ud.Listing.HideFileExt != ".tmp" {
+		t.Errorf("listing.hideFileExt should be '.tmp', got '%s'", ud.Listing.HideFileExt)
+	}
+	if !ud.Listing.ShowCopyPath {
+		t.Error("listing.showCopyPath should be true")
+	}
+	if !ud.Listing.DeleteAfterArchive {
+		t.Error("listing.deleteAfterArchive should be true")
+	}
+
+	// Preview fields
+	if ud.Preview.Image == nil || *ud.Preview.Image != true {
+		t.Error("preview.image should be true")
+	}
+	if ud.Preview.Video == nil || *ud.Preview.Video != true {
+		t.Error("preview.video should be true")
+	}
+	if ud.Preview.Audio == nil || *ud.Preview.Audio != true {
+		t.Error("preview.audio should be true")
+	}
+	if ud.Preview.DisablePreviewExt != ".exe" {
+		t.Errorf("preview.disablePreviewExt should be '.exe', got '%s'", ud.Preview.DisablePreviewExt)
+	}
+
+	// FileViewer fields
+	if !ud.FileViewer.EditorQuickSave {
+		t.Error("fileViewer.editorQuickSave should be true")
+	}
+	if ud.FileViewer.AutoplayMedia == nil || *ud.FileViewer.AutoplayMedia != true {
+		t.Error("fileViewer.autoplayMedia should be true")
+	}
+	if ud.FileViewer.DisableViewingExt != ".bin" {
+		t.Errorf("fileViewer.disableViewingExt should be '.bin', got '%s'", ud.FileViewer.DisableViewingExt)
+	}
+	if ud.FileViewer.DisableOnlyOfficeExt != ".md" {
+		t.Errorf("fileViewer.disableOnlyOfficeExt should be '.md', got '%s'", ud.FileViewer.DisableOnlyOfficeExt)
+	}
+	if !ud.FileViewer.PreferEditorForMarkdown {
+		t.Error("fileViewer.preferEditorForMarkdown should be true")
+	}
+	if !ud.FileViewer.DebugOffice {
+		t.Error("fileViewer.debugOffice should be true")
+	}
+
+	// Search fields
+	if !ud.Search.DisableOptions {
+		t.Error("search.disableOptions should be true")
+	}
+
+	// UI fields
+	if ud.UI.DarkMode == nil || *ud.UI.DarkMode != true {
+		t.Error("ui.darkMode should be true")
+	}
+	if ud.UI.ThemeColor != "var(--red)" {
+		t.Errorf("ui.themeColor should be 'var(--red)', got '%s'", ud.UI.ThemeColor)
+	}
+	if ud.UI.CustomTheme != "dark" {
+		t.Errorf("ui.customTheme should be 'dark', got '%s'", ud.UI.CustomTheme)
+	}
+	if ud.UI.Locale != "de" {
+		t.Errorf("ui.locale should be 'de', got '%s'", ud.UI.Locale)
+	}
+
+	// Account fields
+	if !ud.Account.LockPassword {
+		t.Error("account.lockPassword should be true")
+	}
+	if !ud.Account.DisableSettings {
+		t.Error("account.disableSettings should be true")
+	}
+	if ud.Account.LoginMethod != "oidc" {
+		t.Errorf("account.loginMethod should be 'oidc', got '%s'", ud.Account.LoginMethod)
+	}
+	if !ud.Account.DisableUpdateNotifications {
+		t.Error("account.disableUpdateNotifications should be true")
+	}
+
+	// Account Permissions
+	if !ud.Account.Permissions.Api {
+		t.Error("account.permissions.api should be true")
+	}
+	if !ud.Account.Permissions.Admin {
+		t.Error("account.permissions.admin should be true")
+	}
+	if !ud.Account.Permissions.Modify {
+		t.Error("account.permissions.modify should be true")
+	}
+	if !ud.Account.Permissions.Share {
+		t.Error("account.permissions.share should be true")
+	}
+	if !ud.Account.Permissions.Realtime {
+		t.Error("account.permissions.realtime should be true")
+	}
+	if !ud.Account.Permissions.Delete {
+		t.Error("account.permissions.delete should be true")
+	}
+	if !ud.Account.Permissions.Create {
+		t.Error("account.permissions.create should be true")
+	}
+	if ud.Account.Permissions.Download == nil || *ud.Account.Permissions.Download != false {
+		t.Error("account.permissions.download should be false")
+	}
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/multiconfig_test.go

@@ -0,0 +1,233 @@
+package settings
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestMultiConfigLoad(t *testing.T) {
+	// Setup test directory
+	testDir := t.TempDir()
+
+	// Create anchors file that will be referenced
+	anchorsConfig := `
+# Simple anchors for testing
+simple_sources: &simple_sources
+  - path: "/srv/files"
+    name: "Files"
+  - path: "/srv/media"  
+    name: "Media"
+
+simple_logging: &simple_logging
+  - levels: "info|warning|error"
+    output: "stdout"
+
+simple_auth: &simple_auth
+  methods:
+    password:
+      enabled: true
+      minLength: 8
+`
+	// Use pattern-based naming: main config is "config.yaml", so anchors must be "*-config.yaml"
+	anchorsPath := filepath.Join(testDir, "definitions-config.yaml")
+	if err := os.WriteFile(anchorsPath, []byte(anchorsConfig), 0644); err != nil {
+		t.Fatalf("Failed to write anchors config: %v", err)
+	}
+
+	// Create main config file that references the anchors
+	mainConfig := `
+server:
+  port: 9000
+  baseURL: "/test/"
+  minSearchLength: 2
+  sources: *simple_sources
+  logging: *simple_logging
+
+auth:
+  tokenExpirationHours: 3
+  <<: *simple_auth
+
+frontend:
+  name: "Test FileBrowser"
+
+userDefaults:
+  darkMode: true
+  viewMode: "grid"
+  locale: "en"
+`
+	mainPath := filepath.Join(testDir, "config.yaml")
+	if err := os.WriteFile(mainPath, []byte(mainConfig), 0644); err != nil {
+		t.Fatalf("Failed to write main config: %v", err)
+	}
+
+	// Test loading the multi-config setup
+	// Use generate=true to skip filesystem validation of fake paths
+	err := loadConfigWithDefaults(mainPath, true)
+	if err != nil {
+		t.Fatalf("Failed to load multi-config: %v", err)
+	}
+
+	// Verify that values from different files were loaded correctly
+	if Config.Server.Port != 9000 {
+		t.Errorf("Expected server port 9000, got %d", Config.Server.Port)
+	}
+
+	if Config.Server.BaseURL != "/test/" {
+		t.Errorf("Expected baseURL '/test/', got '%s'", Config.Server.BaseURL)
+	}
+
+	if Config.Server.MinSearchLength != 2 {
+		t.Errorf("Expected minSearchLength 2, got %d", Config.Server.MinSearchLength)
+	}
+
+	if Config.Auth.TokenExpirationHours != 3 {
+		t.Errorf("Expected token expiration 3 hours, got %d", Config.Auth.TokenExpirationHours)
+	}
+
+	if !Config.Auth.Methods.PasswordAuth.Enabled {
+		t.Error("Expected password auth to be enabled")
+	}
+
+	if Config.Auth.Methods.PasswordAuth.MinLength != 8 {
+		t.Errorf("Expected password min length 8, got %d", Config.Auth.Methods.PasswordAuth.MinLength)
+	}
+
+	if len(Config.Server.Sources) != 2 {
+		t.Errorf("Expected 2 sources, got %d", len(Config.Server.Sources))
+	}
+
+	if Config.Frontend.Name != "Test FileBrowser" {
+		t.Errorf("Expected frontend name 'Test FileBrowser', got '%s'", Config.Frontend.Name)
+	}
+
+	if Config.UserDefaults.ViewMode != "grid" {
+		t.Errorf("Expected view mode 'grid', got '%s'", Config.UserDefaults.ViewMode)
+	}
+}
+
+func TestMultiConfigFallback(t *testing.T) {
+	// Setup test directory
+	testDir := t.TempDir()
+
+	// Create a simple config file (no anchors)
+	simpleConfig := `
+server:
+  port: 8080
+  baseURL: "/"
+  sources:
+    - path: "/srv"
+
+auth:
+  tokenExpirationHours: 2
+
+frontend:
+  name: "Simple FileBrowser"
+`
+	configPath := filepath.Join(testDir, "simple-config.yaml")
+	if err := os.WriteFile(configPath, []byte(simpleConfig), 0644); err != nil {
+		t.Fatalf("Failed to write simple config: %v", err)
+	}
+
+	// Test that fallback works for simple configs
+	// Use generate=true to skip filesystem validation
+	err := loadConfigWithDefaults(configPath, true)
+	if err != nil {
+		t.Fatalf("Failed to load simple config: %v", err)
+	}
+
+	// Verify values were loaded correctly
+	if Config.Server.Port != 8080 {
+		t.Errorf("Expected server port 8080, got %d", Config.Server.Port)
+	}
+
+	if Config.Frontend.Name != "Simple FileBrowser" {
+		t.Errorf("Expected frontend name 'Simple FileBrowser', got '%s'", Config.Frontend.Name)
+	}
+}
+
+func TestMultiConfigWithNestedReferences(t *testing.T) {
+	// Note: Logger output may appear during tests - this is normal
+
+	// Setup test directory
+	testDir := t.TempDir()
+
+	// Create anchors file with nested structure
+	anchorsConfig := `
+# Base logging configuration
+base_logging: &base_logging
+  - levels: "info|warning|error"
+    output: "stdout"
+
+# Base permissions  
+base_permissions: &base_permissions
+  modify: false
+  share: false
+  admin: false
+  api: false
+`
+	// Use pattern-based naming: main config is "config.yaml", so anchors must be "*-config.yaml"
+	anchorsPath := filepath.Join(testDir, "definitions-config.yaml")
+	if err := os.WriteFile(anchorsPath, []byte(anchorsConfig), 0644); err != nil {
+		t.Fatalf("Failed to write anchors config: %v", err)
+	}
+
+	// Create main config that uses references
+	mainConfig := `
+server:
+  port: 8080
+  sources:
+    - path: "/srv"
+  logging: *base_logging
+
+auth:
+  tokenExpirationHours: 2
+
+userDefaults:
+  darkMode: true
+  locale: "en"
+  viewMode: "normal"
+  permissions: *base_permissions
+
+frontend:
+  name: "Nested Reference Test"
+`
+	mainPath := filepath.Join(testDir, "config.yaml")
+	if err := os.WriteFile(mainPath, []byte(mainConfig), 0644); err != nil {
+		t.Fatalf("Failed to write main config: %v", err)
+	}
+
+	// Test loading the nested reference setup
+	// Use generate=true to skip filesystem validation
+	err := loadConfigWithDefaults(mainPath, true)
+	if err != nil {
+		t.Fatalf("Failed to load nested config: %v", err)
+	}
+
+	// Verify nested references work
+	if len(Config.Server.Logging) == 0 {
+		t.Error("Expected logging configuration to be loaded")
+	}
+
+	if Config.Server.Logging[0].Output != "stdout" {
+		t.Errorf("Expected logging output 'stdout', got '%s'", Config.Server.Logging[0].Output)
+	}
+
+	// Verify user defaults
+	if Config.UserDefaults.DarkMode == nil || !*Config.UserDefaults.DarkMode {
+		t.Errorf("Expected dark mode true, got %v", Config.UserDefaults.DarkMode)
+	}
+
+	if Config.UserDefaults.Locale != "en" {
+		t.Errorf("Expected locale 'en', got '%s'", Config.UserDefaults.Locale)
+	}
+
+	// Verify permissions were loaded from anchor
+	if Config.UserDefaults.Permissions.Modify != false {
+		t.Errorf("Expected modify permission false (from base), got %v", Config.UserDefaults.Permissions.Modify)
+	}
+
+	if Config.UserDefaults.Permissions.Share != false {
+		t.Errorf("Expected share permission false (from base), got %v", Config.UserDefaults.Permissions.Share)
+	}
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/settings.go

@@ -0,0 +1,169 @@
+//go:generate go run ./tools/yaml.go -input=common/settings/settings.go -output=config.generated.yaml
+package settings
+
+import (
+	"crypto/rand"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// boolPtr returns a pointer to a bool value
+func boolPtr(b bool) *bool {
+	return &b
+}
+
+// boolValueOrDefault returns the value of a bool pointer, or the default if nil
+func boolValueOrDefault(ptr *bool, defaultValue bool) bool {
+	if ptr != nil {
+		return *ptr
+	}
+	return defaultValue
+}
+
+// ConvertPermissionsToUsers converts UserDefaultsPermissions to users.Permissions
+func ConvertPermissionsToUsers(p UserDefaultsAccountPermissions) users.Permissions {
+	return users.Permissions{
+		Api:      p.Api,
+		Admin:    p.Admin,
+		Modify:   p.Modify,
+		Share:    p.Share,
+		Realtime: p.Realtime,
+		Delete:   p.Delete,
+		Create:   p.Create,
+		Download: boolValueOrDefault(p.Download, true),
+	}
+}
+
+const DefaultUsersHomeBasePath = "/users"
+
+// AuthMethod describes an authentication method.
+type AuthMethod string
+
+// GenerateKey generates a key of 512 bits.
+func GenerateKey() ([]byte, error) {
+	b := make([]byte, 64)
+	_, err := rand.Read(b)
+	// Note that err == nil only if we read len(b) bytes.
+	if err != nil {
+		return nil, err
+	}
+
+	return b, nil
+}
+
+func GetSettingsConfig(nameType string, Value string) string {
+	return nameType + Value
+}
+
+func AdminPerms() users.Permissions {
+	return users.Permissions{
+		Modify:   true,
+		Share:    true,
+		Admin:    true,
+		Api:      true,
+		Download: true,
+		Delete:   true,
+		Create:   true,
+		Realtime: false,
+	}
+}
+
+// Apply applies the default options to a user.
+// Keep this in sync with [UserDefaults]: every user-facing field there should be copied
+// here (except DefaultScopes, which is wired through source config rather than this helper).
+func ApplyUserDefaults(u *users.User) {
+	d := Config.UserDefaults
+
+	// Account settings
+	u.DisableSettings = d.Account.DisableSettings
+	u.LockPassword = d.Account.LockPassword
+	u.DisableUpdateNotifications = d.Account.DisableUpdateNotifications
+
+	// Sidebar settings
+	u.DisableQuickToggles = d.Sidebar.DisableQuickToggles
+	u.HideSidebarFileActions = d.Sidebar.HideFileActions
+	u.StickySidebar = d.Sidebar.Sticky
+	u.HideFilesInTree = d.Sidebar.HideFiles
+	u.ShowToolsInSidebar = boolValueOrDefault(d.Sidebar.ShowTools, true)
+
+	// Listing settings
+	u.DeleteWithoutConfirming = d.Listing.DeleteWithoutConfirming
+	u.DateFormat = d.Listing.DateFormat
+	u.ShowHidden = d.Listing.ShowHidden
+	u.QuickDownload = d.Listing.QuickDownload
+	u.ShowSelectMultiple = d.Listing.ShowSelectMultiple
+	u.SingleClick = d.Listing.SingleClick
+	u.HideFileExt = d.Listing.HideFileExt
+	u.ShowCopyPath = d.Listing.ShowCopyPath
+	u.DeleteAfterArchive = d.Listing.DeleteAfterArchive
+	u.ViewMode = d.Listing.ViewMode
+	u.GallerySize = d.Listing.GallerySize
+
+	// Preview settings
+	u.Preview.DisableHideSidebar = d.Sidebar.DisableHideOnPreview
+	u.Preview.Image = boolValueOrDefault(d.Preview.Image, true)
+	u.Preview.Video = boolValueOrDefault(d.Preview.Video, true)
+	u.Preview.Audio = boolValueOrDefault(d.Preview.Audio, true)
+	u.Preview.MotionVideoPreview = boolValueOrDefault(d.Preview.MotionVideoPreview, true)
+	u.Preview.Office = boolValueOrDefault(d.Preview.Office, true)
+	u.Preview.PopUp = boolValueOrDefault(d.Preview.PopUp, true)
+	u.Preview.Folder = boolValueOrDefault(d.Preview.Folder, true)
+	u.Preview.Models = boolValueOrDefault(d.Preview.Models, true)
+	u.DisablePreviewExt = d.Preview.DisablePreviewExt
+
+	// FileViewer settings
+	u.EditorQuickSave = d.FileViewer.EditorQuickSave
+	u.Preview.AutoplayMedia = boolValueOrDefault(d.FileViewer.AutoplayMedia, true)
+	u.Preview.DefaultMediaPlayer = d.FileViewer.DefaultMediaPlayer
+	u.DisableViewingExt = d.FileViewer.DisableViewingExt
+	u.DisableOnlyOfficeExt = d.FileViewer.DisableOnlyOfficeExt
+	u.DisableOfficePreviewExt = d.FileViewer.DisableOnlyOfficeExt // deprecated field, map to same source
+	u.PreferEditorForMarkdown = d.FileViewer.PreferEditorForMarkdown
+	u.DebugOffice = d.FileViewer.DebugOffice
+
+	// Search settings
+	u.DisableSearchOptions = d.Search.DisableOptions
+
+	// UI settings
+	u.DarkMode = boolValueOrDefault(d.UI.DarkMode, true)
+	u.ThemeColor = d.UI.ThemeColor
+	u.CustomTheme = d.UI.CustomTheme
+	u.Locale = d.UI.Locale
+
+	// FileLoading settings
+	u.FileLoading = d.FileLoading
+
+	// Permissions
+	u.Permissions.Api = d.Account.Permissions.Api
+	u.Permissions.Admin = d.Account.Permissions.Admin
+	u.Permissions.Modify = d.Account.Permissions.Modify
+	u.Permissions.Share = d.Account.Permissions.Share
+	u.Permissions.Realtime = d.Account.Permissions.Realtime
+	u.Permissions.Delete = d.Account.Permissions.Delete
+	u.Permissions.Create = d.Account.Permissions.Create
+	u.Permissions.Download = boolValueOrDefault(d.Account.Permissions.Download, true)
+
+	if u.LoginMethod == "" && d.Account.LoginMethod != "" {
+		u.LoginMethod = users.LoginMethod(d.Account.LoginMethod)
+	}
+
+	if len(u.Scopes) == 0 && u.Username != "anonymous" {
+		for _, source := range Config.Server.Sources {
+			if source.Config.DefaultEnabled {
+				u.Scopes = append(u.Scopes, users.SourceScope{
+					Name:  source.Path, // backend name is path
+					Scope: source.Config.DefaultUserScope,
+				})
+				u.SidebarLinks = append(u.SidebarLinks, users.SidebarLink{
+					Name:       source.Name,
+					Category:   "source",
+					Target:     "/",
+					Icon:       "",
+					SourceName: source.Path,
+				})
+			}
+		}
+	}
+
+	u.Version = users.CurrentUserMigrationVersion
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/storage.go

@@ -0,0 +1,64 @@
+package settings
+
+import (
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+)
+
+// StorageBackend is a settings storage backend.
+type StorageBackend interface {
+	Get() (*Settings, error)
+	Save(*Settings) error
+	GetServer() (*Server, error)
+	SaveServer(*Server) error
+}
+
+// Storage is a settings storage.
+type Storage struct {
+	back StorageBackend
+}
+
+// NewStorage creates a settings storage from a backend.
+func NewStorage(back StorageBackend) *Storage {
+	return &Storage{back: back}
+}
+
+// Get returns the settings for the current instance.
+func (s *Storage) Get() (*Settings, error) {
+	set, err := s.back.Get()
+	if err != nil {
+		return nil, err
+	}
+	return set, nil
+}
+
+// Save saves the settings for the current instance.
+func (s *Storage) Save(set *Settings) error {
+	if len(set.Auth.Key) == 0 {
+		return errors.ErrEmptyKey
+	}
+
+	if set.UserDefaults.UI.Locale == "" {
+		set.UserDefaults.UI.Locale = "en"
+	}
+
+	if set.UserDefaults.Listing.ViewMode == "" {
+		set.UserDefaults.Listing.ViewMode = "normal"
+	}
+
+	err := s.back.Save(set)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// GetServer wraps StorageBackend.GetServer.
+func (s *Storage) GetServer() (*Server, error) {
+	return s.back.GetServer()
+}
+
+// SaveServer wraps StorageBackend.SaveServer and adds some verification.
+func (s *Storage) SaveServer(ser *Server) error {
+	return s.back.SaveServer(ser)
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/structs.go

@@ -0,0 +1,460 @@
+package settings
+
+import (
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+type AllowedMethods string
+
+var Env Environment
+
+const (
+	ProxyAuth    AllowedMethods = "proxyAuth"
+	NoAuth       AllowedMethods = "noAuth"
+	PasswordAuth AllowedMethods = "passwordAuth"
+)
+
+type Settings struct {
+	Server       Server       `json:"server"`
+	Auth         Auth         `json:"auth"`
+	Frontend     Frontend     `json:"frontend"`
+	UserDefaults UserDefaults `json:"userDefaults"`
+	Integrations Integrations `json:"integrations"`
+}
+
+type Environment struct {
+	IsPlaywright          bool   `json:"-"`
+	IsDevMode             bool   `json:"-"`
+	IsFirstLoad           bool   `json:"-"` // used internally to track if this is the first load of the application
+	MuPdfAvailable        bool   `json:"-"` // used internally if compiled with mupdf support
+	EmbeddedFs            bool   `json:"-"` // used internally if compiled with embedded fs support
+	FFmpegPath            string `json:"-"`
+	FFprobePath           string `json:"-"`
+	LoginIconPath         string `json:"-"` // resolved login icon path (filesystem or embedded)
+	LoginIconIsCustom     bool   `json:"-"` // true if login icon is from custom filesystem path
+	LoginIconEmbeddedPath string `json:"-"` // embedded asset path for default icon
+	FaviconPath           string `json:"-"` // resolved favicon path (filesystem or embedded)
+	FaviconIsCustom       bool   `json:"-"` // true if favicon is from custom filesystem path
+	FaviconEmbeddedPath   string `json:"-"` // embedded asset path for default favicon
+}
+
+type Server struct {
+	MinSearchLength              int            `json:"minSearchLength" yaml:"minSearchLength"` // minimum length of search query to begin searching (default: 3)
+	DisableUpdateCheck           bool           `json:"disableUpdateCheck"`                     // disables backend update check service
+	NumImageProcessors           int            `json:"numImageProcessors"`                     // number of concurrent image processing jobs used to create previews, default is number of cpu cores available.
+	Socket                       string         `json:"socket"`                                 // socket to listen on
+	TLSKey                       string         `json:"tlsKey"`                                 // path to TLS key
+	TLSCert                      string         `json:"tlsCert"`                                // path to TLS cert
+	DisablePreviews              bool           `json:"disablePreviews"`                        // disable all previews thumbnails, simple icons will be used
+	DisableResize                bool           `json:"disablePreviewResize"`                   // disable resizing of previews for faster loading over slow connections
+	DisableTypeDetectionByHeader bool           `json:"disableTypeDetectionByHeader"`           // disable type detection by header, useful if filesystem is slow.
+	Port                         int            `json:"port"`                                   // port to listen on
+	ListenAddress                string         `json:"listen"`                                 // address to listen on (default: 0.0.0.0)
+	BaseURL                      string         `json:"baseURL"`                                // base URL for the server, the subpath that the server is running on.
+	Logging                      []LogConfig    `json:"logging" yaml:"logging"`
+	Database                     string         `json:"database"` // path to the database file
+	Sources                      []*Source      `json:"sources" validate:"required,dive"`
+	ExternalUrl                  string         `json:"externalUrl"`     // used by share links if set (eg. http://mydomain.com)
+	InternalUrl                  string         `json:"internalUrl"`     // used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
+	CacheDir                     string         `json:"cacheDir"`        // path to the cache directory, used for thumbnails and other cached files
+	CacheDirCleanup              bool           `json:"cacheDirCleanup"` // whether to automatically cleanup the cache directory. Note: docker must also mount a persistent volume to persist the cache (default: false)
+	MaxArchiveSizeGB             int64          `json:"maxArchiveSize"`  // maximum archive/unarchive size in GB. 0 means no limit. (default: 20)
+	Filesystem                   Filesystem     `json:"filesystem"`      // filesystem settings
+	IndexSqlConfig               IndexSqlConfig `json:"indexSqlConfig"`  // Index database SQL configuration
+	DisableWebDAV                bool           `json:"disableWebDAV"`   // disable webdav support (default: false)
+	// not exposed to config
+	SourceMap    map[string]*Source `json:"-" validate:"omitempty"` // uses realpath as key
+	NameToSource map[string]*Source `json:"-" validate:"omitempty"` // uses name as key
+}
+
+type Filesystem struct {
+	CreateFilePermission      string `json:"createFilePermission" validate:"required,file_permission"`      // Unix permissions like 644, 755, 2755 (default: 644)
+	CreateDirectoryPermission string `json:"createDirectoryPermission" validate:"required,file_permission"` // Unix permissions like 755, 2755, 1777 (default: 755)
+}
+
+// Index SQL startup integrity modes (IndexSqlConfig.StartupIntegrityCheck).
+const (
+	// IndexStartupIntegrityQuickCheck runs PRAGMA quick_check (default). Slower on very large DBs but thorough.
+	IndexStartupIntegrityQuickCheck = "quickCheck"
+	// IndexStartupIntegrityProbe verifies sqlite_master and optionally one row read only; fast for large indexes.
+	IndexStartupIntegrityProbe = "probe"
+	// IndexStartupIntegrityOff skips startup checks beyond sql.Open Ping; least safe, fastest boot.
+	IndexStartupIntegrityOff = "off"
+)
+
+type IndexSqlConfig struct {
+	BatchSize             int    `json:"batchSize"`                                                                       // number of items to batch in a single transaction, typically 500-5000. higher = faster but could use more memory.
+	CacheSizeMB           int    `json:"cacheSizeMB"`                                                                     // size of the SQLite cache in MB
+	WalMode               bool   `json:"walMode"`                                                                         // enable the more complex WAL journaling mode. Slower, more memory usage, but better for deployments with constant user activity.
+	DisableReuse          bool   `json:"disableReuse"`                                                                    // enable to always create a new indexing database on startup.
+	StartupIntegrityCheck string `json:"startupIntegrityCheck,omitempty" validate:"omitempty,oneof=quickCheck probe off"` // the method used to check the integrity of the index database on startup (default: quickCheck)
+}
+
+type Integrations struct {
+	OnlyOffice OnlyOffice `json:"office" validate:"omitempty"`
+	Media      Media      `json:"media" validate:"omitempty"`
+}
+
+// onlyoffice secret is stored in the local.json file
+// docker exec <containerID> /var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/local.json 'services.CoAuthoring.secret.session.string'
+type OnlyOffice struct {
+	Url         string `json:"url" validate:"required"`    // The URL to the OnlyOffice Document Server, needs to be accessible to the user.
+	InternalUrl string `json:"internalUrl"`                // An optional internal address that the filebrowser server can use to communicate with the OnlyOffice Document Server, could be useful to bypass proxy.
+	Secret      string `json:"secret" validate:"required"` // secret: authentication key for OnlyOffice integration
+	ViewOnly    bool   `json:"viewOnly"`                   // view only mode for OnlyOffice
+}
+
+type Media struct {
+	FfmpegPath               string        `json:"ffmpegPath"`               // path to ffmpeg directory with ffmpeg and ffprobe (eg. /usr/local/bin)
+	Convert                  FfmpegConvert `json:"convert"`                  // config for ffmpeg conversion settings
+	Debug                    bool          `json:"debug"`                    // output ffmpeg stdout for media integration -- careful can produces lots of output!
+	ExtractEmbeddedSubtitles bool          `json:"extractEmbeddedSubtitles"` // extract embedded subtitles from media files
+	ExiftoolPath             string        `json:"exiftoolPath"`             // path to exiftool executable
+}
+
+type FfmpegConvert struct {
+	ImagePreview map[ImagePreviewType]*bool `json:"imagePreview"` // supported image preview formats. defaults vary by type (see individual type docs)
+	VideoPreview map[VideoPreviewType]*bool `json:"videoPreview"` // supported video preview formats. defaults to true for all types unless explicitly disabled.
+}
+
+type ImagePreviewType string
+
+const (
+	HEICImagePreview ImagePreviewType = "heic"
+	JPEGImagePreview ImagePreviewType = "jpeg" // only used as fallback for JPEG formats that can't otherwise be decoded
+	//RAWImagePreview  ImagePreviewType = "raw"
+)
+
+func (i ImagePreviewType) String() string {
+	return string(i)
+}
+
+// AllImagePreviewTypes contains all supported image preview types.
+var AllImagePreviewTypes = []ImagePreviewType{
+	HEICImagePreview,
+	JPEGImagePreview,
+	//RAWImagePreview,
+}
+
+type VideoPreviewType string
+
+const (
+	MP4VideoPreview      VideoPreviewType = "mp4"
+	WebMVideoPreview     VideoPreviewType = "webm"
+	MOVVideoPreview      VideoPreviewType = "mov"
+	AVIVideoPreview      VideoPreviewType = "avi"
+	MKVVideoPreview      VideoPreviewType = "mkv"
+	FLVVideoPreview      VideoPreviewType = "flv"
+	WMVVideoPreview      VideoPreviewType = "wmv"
+	M4VVideoPreview      VideoPreviewType = "m4v"
+	ThreeGPVideoPreview  VideoPreviewType = "3gp"
+	ThreeGP2VideoPreview VideoPreviewType = "3g2"
+	TSVideoPreview       VideoPreviewType = "ts"
+	M2TSVideoPreview     VideoPreviewType = "m2ts"
+	VOBVideoPreview      VideoPreviewType = "vob"
+	ASFVideoPreview      VideoPreviewType = "asf"
+	MPGVideoPreview      VideoPreviewType = "mpg"
+	MPEGVideoPreview     VideoPreviewType = "mpeg"
+	F4VVideoPreview      VideoPreviewType = "f4v"
+	OGVVideoPreview      VideoPreviewType = "ogv"
+)
+
+func (v VideoPreviewType) String() string {
+	return string(v)
+}
+
+// AllVideoPreviewTypes contains all supported video preview types.
+var AllVideoPreviewTypes = []VideoPreviewType{
+	MP4VideoPreview,
+	WebMVideoPreview,
+	MOVVideoPreview,
+	AVIVideoPreview,
+	MKVVideoPreview,
+	FLVVideoPreview,
+	WMVVideoPreview,
+	M4VVideoPreview,
+	ThreeGPVideoPreview,
+	ThreeGP2VideoPreview,
+	TSVideoPreview,
+	M2TSVideoPreview,
+	VOBVideoPreview,
+	ASFVideoPreview,
+	MPGVideoPreview,
+	MPEGVideoPreview,
+	F4VVideoPreview,
+	OGVVideoPreview,
+}
+
+type LogConfig struct {
+	Levels    string `json:"levels" yaml:"levels"`       // separated list of log levels to enable. (eg. "info|warning|error|debug")
+	ApiLevels string `json:"apiLevels" yaml:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
+	Output    string `json:"output" yaml:"output"`       // output location. (eg. "stdout" or "path/to/file.log")
+	NoColors  bool   `json:"noColors" yaml:"noColors"`   // disable colors in the output
+	Json      bool   `json:"json" yaml:"json"`           // output in json format
+	Utc       bool   `json:"utc" yaml:"utc"`             // use UTC time in the output instead of local time.
+	ApiFilter string `json:"apiFilter" yaml:"apiFilter"` // regex filter that excludes matching full api paths from being logged. (eg. '/user\?id\=self') Defaults to '^/health|^/favicon.ico|^/static|^/public/static'
+}
+type Source struct {
+	Path   string       `json:"path" validate:"required"` // file system path. (Can be relative)
+	Name   string       `json:"name"`                     // display name
+	Config SourceConfig `json:"config,omitempty"`
+}
+
+type SourceConfig struct {
+	DenyByDefault    bool              `json:"denyByDefault,omitempty"`           // deny access unless an "allow" access rule was specifically created.
+	Private          bool              `json:"private"`                           // designate as source as private -- currently just means no sharing permitted.
+	Disabled         bool              `json:"disabled,omitempty"`                // disable the source, this is useful so you don't need to remove it from the config file
+	IndexingInterval uint32            `json:"indexingIntervalMinutes,omitempty"` // deprecated: create a rule with indexingIntervalMinutes to set the indexing interval for this source
+	Conditionals     ConditionalFilter `json:"conditionals"`                      // deprecated: use source.rules instead
+	Rules            []ConditionalRule `json:"rules"`                             // list of item rules to apply to specific paths
+	DefaultUserScope string            `json:"defaultUserScope"`                  // defaults to root of index "/" should match folders under path
+	DefaultEnabled   bool              `json:"defaultEnabled"`                    // should be added as a default source for new users?
+	CreateUserDir    bool              `json:"createUserDir"`                     // create a user directory for each user under defaultUserScope + username
+	UseLogicalSize   bool              `json:"useLogicalSize"`                    // calculate sizes based on logical size instead of disk utilization (du -sh), folders will be 0 bytes when empty.
+	// hidden but used internally - optimized map lookups for conditional rules
+	ResolvedRules ResolvedRulesConfig `json:"-"`
+}
+
+type ConditionalFilter struct {
+	Hidden          bool              `json:"hidden"`                // deprecated: use ignoreHidden instead. eg, FolderPath: "/" and ignoreHidden: true will exclude hidden files and folders under the root folder.
+	IgnoreHidden    bool              `json:"ignoreHidden"`          // deprecated: use ignoreHidden instead. eg, FolderPath: "/" and ignoreHidden: true will exclude hidden files and folders under the root folder.
+	ZeroSizeFolders bool              `json:"ignoreZeroSizeFolders"` // deprecated: use ignoreZeroSizeFolders instead. eg, FolderPath: "/" and ignoreZeroSizeFolders: true will ignore folders with 0 size under the root folder.
+	ItemRules       []ConditionalRule `json:"rules"`                 // list of item rules to apply to specific paths
+}
+
+type ConditionalRule struct {
+	NeverWatchPath   string `json:"neverWatchPath"`   // index the folder in the first pass to get included in search, but never re-indexed.
+	IncludeRootItem  string `json:"includeRootItem"`  // include only these items at root folder level
+	FileStartsWith   string `json:"fileStartsWith"`   // (global) exclude files that start with these prefixes. Eg. "archive-" or "backup-"
+	FolderStartsWith string `json:"folderStartsWith"` // (global) exclude folders that start with these prefixes. Eg. "archive-" or "backup-"
+	FileEndsWith     string `json:"fileEndsWith"`     // (global) exclude files that end with these suffixes. Eg. ".jpg" or ".txt"
+	FolderEndsWith   string `json:"folderEndsWith"`   // (global) exclude folders that end with these suffixes. Eg. ".thumbnails" or ".git"
+	FolderPath       string `json:"folderPath"`       // (global) exclude folders that match this path. Eg. "/path/to/folder" or "/path/to/folder/subfolder"
+	FilePath         string `json:"filePath"`         // (global) exclude files that match this path. Eg. "/path/to/file.txt" or "/path/to/file.txt/subfile.txt"
+	FileNames        string `json:"fileNames"`        // deprecated: exclude files that match these names. Eg. "file.txt" or "test.csv"
+	FolderNames      string `json:"folderNames"`      // deprecated: exclude folders that match these names. Eg. "folder" or "subfolder"
+	FileName         string `json:"fileName"`         // (global) exclude files that match these names. Eg. "file.txt" or "test.csv"
+	FolderName       string `json:"folderName"`       // (global) exclude folders that match these names. Eg. "folder" or "subfolder"
+
+	Viewable              bool `json:"viewable"`              // Enable viewing in UI but exclude from indexing
+	IgnoreHidden          bool `json:"ignoreHidden"`          // Excludes only hidden files and folders
+	IgnoreZeroSizeFolders bool `json:"ignoreZeroSizeFolders"` // Excludes only folders with 0 size
+	IgnoreSymlinks        bool `json:"ignoreSymlinks"`        // Excludes symbolic links
+}
+
+// ConditionalMaps provides O(1) lookup performance for conditional rules
+// Maps are built from ConditionalFilter during initialization
+type ResolvedRulesConfig struct {
+	// Exact match maps - O(1) lookup (only for names, not StartsWith/EndsWith)
+	FileNames   map[string]ConditionalRule // key: file name
+	FolderNames map[string]ConditionalRule // key: folder name
+
+	// exact match for paths
+	FilePaths   map[string]ConditionalRule // key: file path
+	FolderPaths map[string]ConditionalRule // key: folder path
+
+	FileEndsWith     []ConditionalRule // list of item rules that have been resolved for specific paths
+	FolderEndsWith   []ConditionalRule // list of item rules that have been resolved for specific paths
+	FileStartsWith   []ConditionalRule // list of item rules that have been resolved for specific paths
+	FolderStartsWith []ConditionalRule // list of item rules that have been resolved for specific paths
+
+	// NeverWatch paths map - O(1) lookup for all paths with neverWatch: true
+	// This replaces the old NeverWatchPaths slice
+	NeverWatchPaths  map[string]struct{} // key: full folder path
+	IncludeRootItems map[string]struct{} // key: inclusive root item
+
+	IgnoreAllHidden          bool // Excludes all hidden files and folders
+	IgnoreAllZeroSizeFolders bool // Excludes all folders with 0 size
+	IgnoreAllSymlinks        bool // Excludes all symbolic links
+	IndexingDisabled         bool // Excludes all files and folders from indexing
+	NoRules                  bool // No rules are configured
+}
+
+type Frontend struct {
+	Name                  string         `json:"name"`                  // display name
+	DisableDefaultLinks   bool           `json:"disableDefaultLinks"`   // disable default links in the sidebar
+	DisableUsedPercentage bool           `json:"disableUsedPercentage"` // disable used percentage for the sources in the sidebar
+	ExternalLinks         []ExternalLink `json:"externalLinks"`
+	DisableNavButtons     bool           `json:"disableNavButtons"` // disable the nav buttons in the sidebar
+	Styling               StylingConfig  `json:"styling"`
+	Favicon               string         `json:"favicon"`             // path to a favicon to use for the frontend
+	Description           string         `json:"description"`         // description that shows up in html head meta description
+	LoginIcon             string         `json:"loginIcon"`           // path to an image file for the login page icon
+	LoginButtonText       string         `json:"loginButtonText"`     // text to display on the login button
+	OIDCLoginButtonText   string         `json:"oidcLoginButtonText"` // text to display on the OIDC login button
+}
+
+type StylingConfig struct {
+	DisableEventBasedThemes bool                   `json:"disableEventThemes"` // disable the event based themes,
+	CustomCSS               string                 `json:"customCSS"`          // if a valid path to a css file is provided, it will be applied for all users. (eg. "reduce-rounded-corners.css")
+	CustomCSSRaw            string                 `json:"-"`                  // The css raw content to use for the custom css.
+	LightBackground         string                 `json:"lightBackground"`    // specify a valid CSS color property value to use as the background color in light mode
+	DarkBackground          string                 `json:"darkBackground"`     // Specify a valid CSS color property value to use as the background color in dark mode
+	CustomThemes            map[string]CustomTheme `json:"customThemes"`       // A list of custom css files that each user can select to override the default styling. if "default" is key name then it will be the default option.
+	// In-memory (not exposed to config)
+	CustomThemeOptions map[string]CustomTheme `json:"-"` // not exposed
+}
+
+type CustomTheme struct {
+	Description string `json:"description"`   // The description of the theme to display in the UI.
+	CSS         string `json:"css,omitempty"` // The css file path and filename to use for the theme.
+	CssRaw      string `json:"-"`             // The css raw content to use for the theme.
+}
+
+type ExternalLink struct {
+	Text  string `json:"text" validate:"required"` // the text to display on the link
+	Title string `json:"title"`                    // the title to display on hover
+	Url   string `json:"url" validate:"required"`  // the url to link to
+}
+
+// UserDefaultsPermissions holds permission settings with pointer types for defaults
+type UserDefaultsPermissions struct {
+	Api      bool  `json:"api"`      // deprecated: use account.permissions.api instead. allow api access
+	Admin    bool  `json:"admin"`    // deprecated: use account.permissions.admin instead. allow admin access
+	Modify   bool  `json:"modify"`   // deprecated: use account.permissions.modify instead. allow modifying files
+	Share    bool  `json:"share"`    // deprecated: use account.permissions.share instead. allow sharing files
+	Realtime bool  `json:"realtime"` // deprecated: use account.permissions.realtime instead. allow realtime updates
+	Delete   bool  `json:"delete"`   // deprecated: use account.permissions.delete instead. allow deleting files
+	Create   bool  `json:"create"`   // deprecated: use account.permissions.create instead. allow creating or uploading files
+	Download *bool `json:"download"` // deprecated: use account.permissions.download instead. allow downloading files
+}
+
+// New organized structures for UserDefaults
+
+// UserDefaultsSidebar holds sidebar-related settings
+type UserDefaultsSidebar struct {
+	DisableQuickToggles  bool  `json:"disableQuickToggles"`  // disable the quick toggles in the sidebar
+	HideFileActions      bool  `json:"hideFileActions"`      // hide the file actions in the sidebar
+	DisableHideOnPreview bool  `json:"disableHideOnPreview"` // keep sidebar open when previewing files (was preview.disableHideSidebar)
+	Sticky               bool  `json:"sticky"`               // keep sidebar open when navigating
+	HideFiles            bool  `json:"hideFiles"`            // hide files in the sidebar tree navigation, when true, will show only directories
+	ShowTools            *bool `json:"showTools"`            // show sidebar links with category "tool"; default is true
+}
+
+// UserDefaultsListing holds file listing display settings
+type UserDefaultsListing struct {
+	DeleteWithoutConfirming bool   `json:"deleteWithoutConfirming"` // delete files without confirmation
+	DateFormat              bool   `json:"dateFormat"`              // when false, the date is relative, when true, the date is an exact timestamp
+	ShowHidden              bool   `json:"showHidden"`              // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+	QuickDownload           bool   `json:"quickDownload"`           // show icon to download in one click
+	ShowSelectMultiple      bool   `json:"showSelectMultiple"`      // show select multiple files on desktop
+	SingleClick             bool   `json:"singleClick"`             // open directory on single click, also enables middle click to open in new tab
+	HideFileExt             string `json:"hideFileExt"`             // space separated list of file extensions to hide in UI
+	ShowCopyPath            bool   `json:"showCopyPath"`            // show copy path button in the context menu
+	DeleteAfterArchive      bool   `json:"deleteAfterArchive"`      // delete source files after successful creation/extraction of archives
+	ViewMode                string `json:"viewMode"`                // view mode to use: eg. normal, list, grid, or compact
+	GallerySize             int    `json:"gallerySize"`             // 0-9 - the size of the gallery thumbnails
+}
+
+// UserDefaultsPreview holds preview-related settings
+type UserDefaultsPreview struct {
+	Image              *bool  `json:"image"`              // show thumbnails for image files
+	Video              *bool  `json:"video"`              // show thumbnails for video files
+	Audio              *bool  `json:"audio"`              // show thumbnails for audio files
+	MotionVideoPreview *bool  `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
+	Office             *bool  `json:"office"`             // show thumbnails for office files
+	PopUp              *bool  `json:"popup"`              // show larger popup preview when hovering over thumbnail
+	DisablePreviewExt  string `json:"disablePreviewExt"`  // comma separated list of file extensions to disable preview for
+	HighQuality        *bool  `json:"highQuality"`        // high quality preview thumbnails
+	Folder             *bool  `json:"folder"`             // show thumbnails for folders that have previewable contents
+	Models             *bool  `json:"models"`             // show live thumbnails for 3D models files
+	// deprecated fields
+	DisableHideSidebar bool `json:"disableHideSidebar"` // deprecated: use sidebar.disableHideOnPreview instead. disable the hide sidebar preview for previews and editors
+	DefaultMediaPlayer bool `json:"defaultMediaPlayer"` // deprecated: use fileViewer.defaultMediaPlayer instead. disable the styled feature-rich media player for browser default
+	AutoplayMedia      bool `json:"autoplayMedia"`      // deprecated: use fileViewer.autoplayMedia instead. autoplay media files in preview
+}
+
+// UserDefaultsFileViewer holds file viewer/editor settings
+type UserDefaultsFileViewer struct {
+	EditorQuickSave         bool   `json:"editorQuickSave"`         // show quick save button in editor
+	AutoplayMedia           *bool  `json:"autoplayMedia"`           // autoplay media files in preview
+	DisableViewingExt       string `json:"disableViewingExt"`       // comma separated list of file extensions to disable viewing for
+	DisableOnlyOfficeExt    string `json:"disableOnlyOfficeExt"`    // list of file extensions to disable onlyoffice editor for
+	PreferEditorForMarkdown bool   `json:"preferEditorForMarkdown"` // prefer editor first for markdown files instead of the Markdown Viewer
+	DebugOffice             bool   `json:"debugOffice"`             // debug onlyoffice editor
+	DefaultMediaPlayer      bool   `json:"defaultMediaPlayer"`      // disable the styled feature-rich media player for browser default
+}
+
+// UserDefaultsSearch holds search-related settings
+type UserDefaultsSearch struct {
+	DisableOptions bool `json:"disableOptions"` // disable the search options in the search bar
+}
+
+// UserDefaultsUI holds UI/appearance settings
+type UserDefaultsUI struct {
+	DarkMode    *bool  `json:"darkMode"`    // should dark mode be enabled
+	ThemeColor  string `json:"themeColor"`  // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+	CustomTheme string `json:"customTheme"` // Name of theme to use chosen from custom themes config
+	Locale      string `json:"locale"`      // language to use: eg. de, en, or fr
+
+}
+
+// UserDefaultsAccount holds account/security settings
+type UserDefaultsAccount struct {
+	Permissions                UserDefaultsAccountPermissions `json:"permissions"`
+	LockPassword               bool                           `json:"lockPassword"`               // disable the user from changing their password
+	DisableSettings            bool                           `json:"disableSettings"`            // disable the user from viewing the settings page
+	LoginMethod                string                         `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
+	DisableUpdateNotifications bool                           `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
+}
+
+// UserDefaultsAccountPermissions holds permission settings
+type UserDefaultsAccountPermissions struct {
+	Api      bool  `json:"api"`      // allow api access
+	Admin    bool  `json:"admin"`    // allow admin access
+	Modify   bool  `json:"modify"`   // allow modifying files
+	Share    bool  `json:"share"`    // allow sharing files
+	Realtime bool  `json:"realtime"` // allow realtime updates
+	Delete   bool  `json:"delete"`   // allow deleting files
+	Create   bool  `json:"create"`   // allow creating or uploading files
+	Download *bool `json:"download"` // allow downloading files
+}
+
+// UserDefaults is a type that holds the default values for some fields on User.
+type UserDefaults struct {
+	// New organized structure
+	Sidebar     UserDefaultsSidebar    `json:"sidebar,omitempty"`
+	Listing     UserDefaultsListing    `json:"listing,omitempty"`
+	Preview     UserDefaultsPreview    `json:"preview,omitempty"`
+	FileViewer  UserDefaultsFileViewer `json:"fileViewer,omitempty"`
+	Search      UserDefaultsSearch     `json:"search,omitempty"`
+	UI          UserDefaultsUI         `json:"ui,omitempty"`
+	FileLoading users.FileLoading      `json:"fileLoading,omitempty"`
+	Account     UserDefaultsAccount    `json:"account,omitempty"`
+
+	// Deprecated fields - kept for backwards compatibility
+	EditorQuickSave            bool                    `json:"editorQuickSave,omitempty"`        // deprecated: use fileViewer.editorQuickSave instead
+	HideSidebarFileActions     bool                    `json:"hideSidebarFileActions,omitempty"` // deprecated: use sidebar.hideSidebarFileActions instead
+	DisableQuickToggles        bool                    `json:"disableQuickToggles,omitempty"`    // deprecated: use sidebar.disableQuickToggles instead
+	DisableSearchOptions       bool                    `json:"disableSearchOptions,omitempty"`   // deprecated: use search.disableOptions instead
+	StickySidebar              bool                    `json:"stickySidebar,omitempty"`          // deprecated: use sidebar.stickySidebar instead
+	HideFilesInTree            bool                    `json:"hideFilesInTree,omitempty"`        // deprecated: use sidebar.hideFilesInTree instead
+	DarkMode                   *bool                   `json:"darkMode,omitempty"`               // deprecated: use sidebar.darkMode instead
+	Locale                     string                  `json:"locale,omitempty"`                 // deprecated: use ui.locale instead
+	ViewMode                   string                  `json:"viewMode,omitempty"`               // deprecated: use sidebar.viewMode instead
+	SingleClick                bool                    `json:"singleClick,omitempty"`            // deprecated: use sidebar.singleClick instead
+	ShowHidden                 bool                    `json:"showHidden,omitempty"`             // deprecated: use listing.showHidden instead
+	HideFileExt                string                  `json:"hideFileExt,omitempty"`            // deprecated: use listing.hideFileExt instead
+	DateFormat                 bool                    `json:"dateFormat,omitempty"`             // deprecated: use listing.dateFormat instead
+	GallerySize                int                     `json:"gallerySize,omitempty"`            // deprecated: use sidebar.gallerySize instead
+	ThemeColor                 string                  `json:"themeColor,omitempty"`             // deprecated: use ui.themeColor instead
+	QuickDownload              bool                    `json:"quickDownload,omitempty"`          // deprecated: use listing.quickDownload instead
+	DisablePreviewExt          string                  `json:"disablePreviewExt,omitempty"`      // deprecated: use preview.disablePreviewExt instead
+	DisableViewingExt          string                  `json:"disableViewingExt,omitempty"`      // deprecated: use fileViewer.disableViewingExt instead
+	LockPassword               bool                    `json:"lockPassword,omitempty"`           // deprecated: use account.lockPassword instead
+	DisableSettings            bool                    `json:"disableSettings,omitempty"`        // deprecated: use account.disableSettings instead
+	DefaultScopes              []users.SourceScope     `json:"-"`
+	Permissions                UserDefaultsPermissions `json:"permissions,omitempty"`                // deprecated: use account.permissions instead
+	LoginMethod                string                  `json:"loginMethod,omitempty"`                // deprecated: use account.loginMethod instead
+	DisableUpdateNotifications bool                    `json:"disableUpdateNotifications,omitempty"` // deprecated: use account.disableUpdateNotifications instead
+	DeleteWithoutConfirming    bool                    `json:"deleteWithoutConfirming,omitempty"`    // deprecated: use listing.deleteWithoutConfirming instead
+	DeleteAfterArchive         bool                    `json:"deleteAfterArchive,omitempty"`         // deprecated: use listing.deleteAfterArchive instead
+	DisableOfficePreviewExt    string                  `json:"disableOfficePreviewExt,omitempty"`    // deprecated: use disablePreviewExt instead
+	DisableOnlyOfficeExt       string                  `json:"disableOnlyOfficeExt,omitempty"`       // deprecated: use fileViewer.disableOnlyOfficeExt instead
+	CustomTheme                string                  `json:"customTheme,omitempty"`                // deprecated: use ui.customTheme instead
+	ShowSelectMultiple         bool                    `json:"showSelectMultiple,omitempty"`         // deprecated: use listing.showSelectMultiple instead
+	ShowToolsInSidebar         *bool                   `json:"showToolsInSidebar,omitempty"`         // deprecated: use sidebar.showToolsInSidebar instead
+	DebugOffice                bool                    `json:"debugOffice,omitempty"`                // deprecated: use fileViewer.debugOffice instead
+	PreferEditorForMarkdown    bool                    `json:"preferEditorForMarkdown,omitempty"`    // deprecated: use fileViewer.preferEditorForMarkdown instead
+	ShowCopyPath               bool                    `json:"showCopyPath,omitempty"`               // deprecated: use listing.showCopyPath instead
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/styling.go

@@ -0,0 +1,120 @@
+package settings
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// Strict hex color regex: #RGB, #RGBA, #RRGGBB, #RRGGBBAA
+var hexColorRE = regexp.MustCompile(`^#([0-9a-fA-F]{3}|[0-9a-fA-F]{4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$`)
+
+// All valid CSS named colors (W3C spec, lower-case)
+var cssNamedColors = map[string]struct{}{
+	"aliceblue": {}, "antiquewhite": {}, "aqua": {}, "aquamarine": {}, "azure": {},
+	"beige": {}, "bisque": {}, "black": {}, "blanchedalmond": {}, "blue": {}, "blueviolet": {},
+	"brown": {}, "burlywood": {}, "cadetblue": {}, "chartreuse": {}, "chocolate": {},
+	"coral": {}, "cornflowerblue": {}, "cornsilk": {}, "crimson": {}, "cyan": {},
+	"darkblue": {}, "darkcyan": {}, "darkgoldenrod": {}, "darkgray": {}, "darkgreen": {},
+	"darkgrey": {}, "darkkhaki": {}, "darkmagenta": {}, "darkolivegreen": {}, "darkorange": {},
+	"darkorchid": {}, "darkred": {}, "darksalmon": {}, "darkseagreen": {}, "darkslateblue": {},
+	"darkslategray": {}, "darkslategrey": {}, "darkturquoise": {}, "darkviolet": {}, "deeppink": {},
+	"deepskyblue": {}, "dimgray": {}, "dimgrey": {}, "dodgerblue": {}, "firebrick": {},
+	"floralwhite": {}, "forestgreen": {}, "fuchsia": {}, "gainsboro": {}, "ghostwhite": {},
+	"gold": {}, "goldenrod": {}, "gray": {}, "green": {}, "greenyellow": {}, "grey": {},
+	"honeydew": {}, "hotpink": {}, "indianred": {}, "indigo": {}, "ivory": {},
+	"khaki": {}, "lavender": {}, "lavenderblush": {}, "lawngreen": {}, "lemonchiffon": {},
+	"lightblue": {}, "lightcoral": {}, "lightcyan": {}, "lightgoldenrodyellow": {}, "lightgray": {},
+	"lightgreen": {}, "lightgrey": {}, "lightpink": {}, "lightsalmon": {}, "lightseagreen": {},
+	"lightskyblue": {}, "lightslategray": {}, "lightslategrey": {}, "lightsteelblue": {}, "lightyellow": {},
+	"lime": {}, "limegreen": {}, "linen": {}, "magenta": {}, "maroon": {}, "mediumaquamarine": {},
+	"mediumblue": {}, "mediumorchid": {}, "mediumpurple": {}, "mediumseagreen": {}, "mediumslateblue": {},
+	"mediumspringgreen": {}, "mediumturquoise": {}, "mediumvioletred": {}, "midnightblue": {}, "mintcream": {},
+	"mistyrose": {}, "moccasin": {}, "navajowhite": {}, "navy": {}, "oldlace": {},
+	"olive": {}, "olivedrab": {}, "orange": {}, "orangered": {}, "orchid": {},
+	"palegoldenrod": {}, "palegreen": {}, "paleturquoise": {}, "palevioletred": {}, "papayawhip": {},
+	"peachpuff": {}, "peru": {}, "pink": {}, "plum": {}, "powderblue": {},
+	"purple": {}, "rebeccapurple": {}, "red": {}, "rosybrown": {}, "royalblue": {},
+	"saddlebrown": {}, "salmon": {}, "sandybrown": {}, "seagreen": {}, "seashell": {},
+	"sienna": {}, "silver": {}, "skyblue": {}, "slateblue": {}, "slategray": {},
+	"slategrey": {}, "snow": {}, "springgreen": {}, "steelblue": {}, "tan": {},
+	"teal": {}, "thistle": {}, "tomato": {}, "turquoise": {}, "violet": {},
+	"wheat": {}, "white": {}, "whitesmoke": {}, "yellow": {}, "yellowgreen": {},
+	// And the special values:
+	"transparent": {}, "currentcolor": {},
+}
+
+func FallbackColor(val, defaultColor string) string {
+	val = strings.TrimSpace(val)
+	if val == "" {
+		return defaultColor
+	}
+	if hexColorRE.MatchString(val) {
+		return val
+	}
+	lc := strings.ToLower(val)
+	// CSS color functions
+	if strings.HasPrefix(lc, "rgb(") || strings.HasPrefix(lc, "rgba(") ||
+		strings.HasPrefix(lc, "hsl(") || strings.HasPrefix(lc, "hsla(") {
+		return val
+	}
+	// CSS variable
+	if strings.HasPrefix(lc, "var(") {
+		return val
+	}
+	// Named colors and special values
+	if _, ok := cssNamedColors[lc]; ok {
+		return val
+	}
+	// Log a warning if the color is invalid
+	logger.Warningf("Invalid CSS color value provided: '%s'. Falling back to default: '%s'", val, defaultColor)
+	return defaultColor
+}
+
+func addCustomTheme(name, description, cssFilePath string) {
+	// Store only file path in config (for YAML export)
+	Config.Frontend.Styling.CustomThemes[name] = CustomTheme{
+		Description: description,
+		CSS:         cssFilePath, // Store file path, not content
+	}
+
+	// Load CSS content for runtime use (frontend consumption)
+	cssContent := ""
+	if cssFilePath != "" {
+		var err error
+		cssContent, err = readCustomCSS(cssFilePath)
+		if err != nil {
+			logger.Warning(err.Error())
+			return
+		}
+
+	}
+	Config.Frontend.Styling.CustomThemeOptions[name] = CustomTheme{
+		Description: description,
+		CSS:         cssFilePath,
+		CssRaw:      cssContent, // Store loaded content
+	}
+	logger.Debugf("Added custom theme: %s", name)
+}
+
+func readCustomCSS(path string) (string, error) {
+	if path == "" {
+		return "", errors.New("path is empty")
+	}
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("could not read custom CSS file: %v", err)
+	}
+	if len(content) > 128*1024 {
+		return "", fmt.Errorf("custom CSS file is too large (%d bytes)", len(content))
+	}
+	if len(content) == 0 {
+		return "", fmt.Errorf("custom CSS file is empty: %s", path)
+	}
+	logger.Debugf("Loaded custom CSS from: %s (%d bytes)", path, len(content))
+	return string(content), nil
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/validConfig.yaml

@@ -0,0 +1,35 @@
+server:
+  numImageProcessors: 4
+  socket: ""
+  tlsKey: ""
+  tlsCert: ""
+  disablePreviews: false
+  disablePreviewResize: false
+  port: 80
+  baseURL: "/"
+  database: "mydb.db"
+  sources:
+    - path: "."
+integrations:
+  office:
+    url: "http://localhost:9052"
+    secret: 6H1H7GzUk2alRkNxAPav0W02g8JS5oUd
+auth:
+  methods:
+    password:
+      enabled: true
+frontend:
+  name: ""
+  disableUsedPercentage: true
+userDefaults:
+  locale: ""
+  viewMode: ""
+  darkMode: true
+  disableSettings: false
+  singleClick: true
+  permissions:
+    admin: true
+    modify: true
+    share: true
+    api: true
+  dateFormat: false

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/video_preview_test.go

@@ -0,0 +1,317 @@
+package settings
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestVideoPreviewDefaults(t *testing.T) {
+	// Test 1: No videoPreview config at all - should enable all
+	t.Run("NoVideoPreviewConfig", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      imagePreview:
+        heic: false
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// All video formats should be enabled by default
+			for _, format := range AllVideoPreviewTypes {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled by default, but it was disabled", format)
+				}
+			}
+		})
+	})
+
+	// Test 2: Empty videoPreview config - should enable all
+	t.Run("EmptyVideoPreviewConfig", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      imagePreview:
+        heic: false
+      videoPreview: {}
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// All video formats should be enabled by default
+			for _, format := range AllVideoPreviewTypes {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled by default, but it was disabled", format)
+				}
+			}
+		})
+	})
+
+	// Test 3: Partial videoPreview config - should enable all except explicitly disabled
+	t.Run("PartialVideoPreviewConfig", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      imagePreview:
+        heic: false
+      videoPreview:
+        mp4: true
+        webm: false
+        mkv: false
+        wmv: false
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// Check explicitly set formats
+			if !*config.Integrations.Media.Convert.VideoPreview[MP4VideoPreview] {
+				t.Error("Expected mp4 to be enabled")
+			}
+			if *config.Integrations.Media.Convert.VideoPreview[WebMVideoPreview] {
+				t.Error("Expected webm to be disabled")
+			}
+			if *config.Integrations.Media.Convert.VideoPreview[MKVVideoPreview] {
+				t.Error("Expected mkv to be disabled")
+			}
+			if *config.Integrations.Media.Convert.VideoPreview[WMVVideoPreview] {
+				t.Error("Expected wmv to be disabled")
+			}
+
+			// Check that unmentioned formats are still enabled
+			unmentionedFormats := []VideoPreviewType{
+				AVIVideoPreview, MOVVideoPreview, FLVVideoPreview,
+				M4VVideoPreview, ThreeGPVideoPreview, TSVideoPreview, VOBVideoPreview,
+			}
+			for _, format := range unmentionedFormats {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled (not mentioned in config), but it was disabled", format)
+				}
+			}
+		})
+	})
+
+	// Test 4: All videoPreview config - should respect all settings
+	t.Run("AllVideoPreviewConfig", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      imagePreview:
+        heic: false
+      videoPreview:
+        mp4: true
+        webm: true
+        mov: true
+        avi: false
+        mkv: true
+        flv: false
+        wmv: true
+        m4v: false
+        3gp: true
+        3g2: false
+        ts: true
+        m2ts: false
+        vob: true
+        asf: false
+        mpg: true
+        mpeg: false
+        f4v: true
+        ogv: false
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// Check all explicitly set formats
+			expectedEnabled := []VideoPreviewType{
+				MP4VideoPreview, WebMVideoPreview, MOVVideoPreview, MKVVideoPreview,
+				WMVVideoPreview, ThreeGPVideoPreview, TSVideoPreview, VOBVideoPreview,
+				MPGVideoPreview, F4VVideoPreview,
+			}
+			expectedDisabled := []VideoPreviewType{
+				AVIVideoPreview, FLVVideoPreview, M4VVideoPreview,
+				ThreeGP2VideoPreview, M2TSVideoPreview, ASFVideoPreview,
+				MPEGVideoPreview, OGVVideoPreview,
+			}
+
+			for _, format := range expectedEnabled {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled, but it was disabled", format)
+				}
+			}
+
+			for _, format := range expectedDisabled {
+				if *config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be disabled, but it was enabled", format)
+				}
+			}
+		})
+	})
+
+	// Test 5: No integrations section at all - should enable all
+	t.Run("NoIntegrationsSection", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// All video formats should be enabled by default
+			for _, format := range AllVideoPreviewTypes {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled by default, but it was disabled", format)
+				}
+			}
+		})
+	})
+}
+
+func TestVideoPreviewFormatCategories(t *testing.T) {
+	// Test that all video format categories are properly supported
+	t.Run("FormatCategories", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// Test format categories
+			categories := map[string][]VideoPreviewType{
+				"Common Web Formats":     {MP4VideoPreview, WebMVideoPreview, OGVVideoPreview},
+				"Apple Formats":          {MOVVideoPreview, M4VVideoPreview},
+				"Microsoft Formats":      {AVIVideoPreview, WMVVideoPreview, ASFVideoPreview},
+				"Open Source":            {MKVVideoPreview, FLVVideoPreview},
+				"Mobile Formats":         {ThreeGPVideoPreview, ThreeGP2VideoPreview},
+				"Broadcast/Professional": {TSVideoPreview, M2TSVideoPreview},
+				"Legacy Formats":         {VOBVideoPreview, MPGVideoPreview, MPEGVideoPreview, F4VVideoPreview},
+			}
+
+			for category, formats := range categories {
+				t.Run(category, func(t *testing.T) {
+					for _, format := range formats {
+						if !*config.Integrations.Media.Convert.VideoPreview[format] {
+							t.Errorf("Expected %s (%s) to be enabled by default, but it was disabled", format, category)
+						}
+					}
+				})
+			}
+		})
+	})
+}
+
+func TestVideoPreviewFormatCount(t *testing.T) {
+	// Test that we have the expected number of video formats
+	t.Run("FormatCount", func(t *testing.T) {
+		expectedCount := 18
+		actualCount := len(AllVideoPreviewTypes)
+		if actualCount != expectedCount {
+			t.Errorf("Expected %d video formats, but got %d", expectedCount, actualCount)
+		}
+
+		// Test that all formats are unique
+		formatMap := make(map[VideoPreviewType]bool)
+		for _, format := range AllVideoPreviewTypes {
+			if formatMap[format] {
+				t.Errorf("Duplicate video format found: %s", format)
+			}
+			formatMap[format] = true
+		}
+	})
+}
+
+func BenchmarkVideoPreviewSetup(b *testing.B) {
+	config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      videoPreview:
+        mp4: true
+        webm: false
+        mkv: true
+        wmv: false
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+
+	// Create temporary config file
+	tmpFile, err := os.CreateTemp("", "benchmark_video_preview_*.yaml")
+	if err != nil {
+		b.Fatalf("Error creating temp file: %v", err)
+	}
+	defer os.Remove(tmpFile.Name())
+
+	// Create a temporary directory for cache
+	tmpCacheDir, err := os.MkdirTemp("", "benchmark_cache_*")
+	if err != nil {
+		b.Fatalf("Error creating temp cache dir: %v", err)
+	}
+	defer os.RemoveAll(tmpCacheDir)
+
+	// Modify config to use absolute temp directory
+	modifiedConfig := strings.Replace(config, "server:", fmt.Sprintf("server:\n  cacheDir: %s", tmpCacheDir), 1)
+
+	_, err = tmpFile.WriteString(modifiedConfig)
+	if err != nil {
+		b.Fatalf("Error writing config: %v", err)
+	}
+	tmpFile.Close()
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		Initialize(tmpFile.Name())
+	}
+}
+
+// Helper function to test video preview configuration
+func testVideoPreviewConfig(t *testing.T, configContent string, testFunc func(t *testing.T, config *Settings)) {
+	// Create temporary config file
+	tmpFile, err := os.CreateTemp("", "test_video_preview_*.yaml")
+	if err != nil {
+		t.Fatalf("Error creating temp file: %v", err)
+	}
+	defer os.Remove(tmpFile.Name())
+
+	_, err = tmpFile.WriteString(configContent)
+	if err != nil {
+		t.Fatalf("Error writing config: %v", err)
+	}
+	tmpFile.Close()
+
+	// Initialize settings
+	Initialize(tmpFile.Name())
+
+	// Run the test function
+	testFunc(t, &Config)
+}

bench/cve-zero/samples/GHSA-3jmg-p96m-m328/source/backend/common/settings/yaml.go

@@ -0,0 +1,111 @@
+package settings
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// combineYAMLFiles combines multiple YAML files from a directory into a single YAML document
+// This allows YAML anchors defined in one file to be referenced in another
+//
+// Pattern matching: If main config is "config.yaml", only files matching "*-config.yaml" are merged
+// Examples:
+//   - config.yaml + server-config.yaml + auth-config.yaml
+//   - test.yaml + database-test.yaml + frontend-test.yaml
+//   - myapp.yml + server-myapp.yml
+func combineYAMLFiles(configFilePath string) ([]byte, error) {
+	// Get absolute path and expand tilde
+	expandedPath := configFilePath
+	if strings.HasPrefix(configFilePath, "~/") {
+		homeDir, err := os.UserHomeDir()
+		if err != nil {
+			return nil, fmt.Errorf("failed to expand home directory: %v", err)
+		}
+		expandedPath = filepath.Join(homeDir, configFilePath[2:])
+	}
+
+	absPath, err := filepath.Abs(expandedPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve config file path: %v", err)
+	}
+
+	configDir := filepath.Dir(absPath)
+	configFileName := filepath.Base(absPath)
+
+	// Extract base name pattern for matching related config files
+	// e.g., "config.yaml" -> match "*-config.yaml"
+	//       "test.yml" -> match "*-test.yml"
+	ext := filepath.Ext(configFileName)
+	baseName := strings.TrimSuffix(configFileName, ext)
+	pattern := "-" + baseName + ext
+
+	// Find all YAML files in the directory that match the pattern
+	entries, err := os.ReadDir(configDir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read config directory: %v", err)
+	}
+
+	var yamlFiles []string
+	var mainConfigContent []byte
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+
+		name := entry.Name()
+
+		// Skip hidden files (dotfiles like .goreleaser.yaml)
+		if strings.HasPrefix(name, ".") {
+			continue
+		}
+
+		fileExt := strings.ToLower(filepath.Ext(name))
+
+		// Only process .yaml and .yml files
+		if fileExt != ".yaml" && fileExt != ".yml" {
+			continue
+		}
+
+		fullPath := filepath.Join(configDir, name)
+
+		// Keep track of the main config file to process it last
+		if name == configFileName {
+			content, err := os.ReadFile(fullPath)
+			if err != nil {
+				return nil, fmt.Errorf("failed to read main config file: %v", err)
+			}
+			mainConfigContent = content
+		} else if strings.HasSuffix(name, pattern) {
+			// Only include files that match the pattern (e.g., *-config.yaml)
+			yamlFiles = append(yamlFiles, fullPath)
+		}
+	}
+
+	// Sort the auxiliary files for consistent ordering
+	sort.Strings(yamlFiles)
+
+	// Combine all YAML files as raw text into a single document
+	// We do NOT use `---` separators because anchors don't work across document boundaries
+	var combined strings.Builder
+
+	// First, add all auxiliary YAML files (these typically contain anchor definitions)
+	for _, file := range yamlFiles {
+		content, err := os.ReadFile(file)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read YAML file %s: %v", file, err)
+		}
+		combined.Write(content)
+		combined.WriteString("\n") // Add newline between files
+	}
+
+	// Finally, add the main config file (this typically contains the references)
+	if mainConfigContent != nil {
+		combined.Write(mainConfigContent)
+	}
+
+	return []byte(combined.String()), nil
+}