177828 - Taint warning from post_bug with perl 5.8

Status: RESOLVED FIXED

(Bugzilla :: Creating/Changing Bugs, defect)

Description

[Bradley Baetz (:bbaetz)]

As reported on npm.webtools, when submitting a new bug using perl 5.8, we get a
taint warning because the multi-arg form for exec considers having tainted
arguments as deprecated.

We already check the values in the cc field + so on for validity, as does
processmail, so I don't think its a security issue. 

It is something which we should fix, though. For the old system, that would
havebeen a trick_taint in the loop. Not sure if we can use a similar solution
with match_email, but we probably can.

Comment 1

[rocketraman]

One other comment... it seems that Netscape web servers redirect CGI stderr to
the same location as stdout, therefore this warning causes the web server to
return a "Server Error" page (although all work done by the CGI completes
correctly).

I know that you're recommended web svr is Apache, so I'm not sure how much
differences this makes, but anyway...

Comment 2

[Bradley Baetz (:bbaetz)]

If that web bserver behaves that way, you're going to have _lots_ more problems
- Bugzilla code is not warning fre, although we do fix them as we notice them. I
suggest looking at your documentation and trying to fix that.

Comment 3

[Bradley Baetz (:bbaetz)]

Is this fixed? We don't run processmail any more...

I can't prop this, but I can't repro it on 2.16, and I know I did before I filed
this bug. Maybe I'm missing something...

Comment 4

[J. Paul Reed [:preed]]

If the problem was the exec/open() call to do the proessmail-ing, I don't see
why it wouldn't be...

Comment 5

[Bradley Baetz (:bbaetz)]

Yeah, I think that this got fixed when mail got redone.

Comment 6

[Bradley Baetz (:bbaetz)]

*** Bug 215772 has been marked as a duplicate of this bug. ***

Comment 7

[Jay Berkenbilt]

Is there a work-around for this problem for people running 2.16.3 with perl 5.8.0?

Comment 8

[Jay Berkenbilt]

For what it's worth, I'm running 2.16.3 on a RedHat 9 system with Perl 5.8.0. 
You can reproduce this problem under 2.16.3 by creating a new bug with at least
one person in the CC list.  If I create a bug and add myself to the CC list, I
get the taint message: 

Insecure dependency in exec while running with -T switch at
/var/www/intranet/bugzilla/post_bug.cgi line 303.

I made two quick (and unsafe) attempts at coming up with a workaround:

map { m/^(.*)$/s; $_ = $1 } @ARGLIST;

and putting the call to processmail in a block with local ${^TAINT} = 0. 
Neither of these worked.  (Even so, these taint-defeating workarounds would not
be appropriate if the perl message is legitimate....)

Comment 9

[Dave Miller [:justdave]]

*** Bug 217614 has been marked as a duplicate of this bug. ***

Comment 10

[Dave Miller [:justdave]]

I can reproduce this on landfill/bugzilla-2.16, following the steps to reproduce
given in comment #8.

Insecure dependency in exec while running with -T switch at
        /var/www/html/bugzilla-2.16/post_bug.cgi line 303 (#1)

Comment 11

[Dave Miller [:justdave]]

Given that this is a functionality loss, we should really fix this for 2.16.4.

Comment 12

[Dave Miller [:justdave]]

Attachment: Patch v1

This seems to do the trick...

Comment 13

[Dave Miller [:justdave]]

Checking in post_bug.cgi;
/cvsroot/mozilla/webtools/bugzilla/post_bug.cgi,v  <--  post_bug.cgi
new revision: 1.52.2.7; previous revision: 1.52.2.6
done

Comment 14

[Jay Berkenbilt]

I haven't verified this, but one of my users reports that, even with this patch,
the problem also occurs when you REMOVE people from CC.  I will investigate if I
have time.  If my findings agree, I'll reopen this bug.  Hopefully someone else
will beat me to it and fix the problem. :-)

Comment 15

[Dave Miller [:justdave]]

Jay: comment 14 is confirmed.  That's now bug 220332.

Comment 16

[Jay Berkenbilt]

Excellent.  Dave: I really appreciate your posting a comment letting me (and
anyone else watching this) know!

Comment 17

[Vlad Dascalu]

*** Bug 224761 has been marked as a duplicate of this bug. ***

Comment 18

[Dave Miller [:justdave]]

*** Bug 225722 has been marked as a duplicate of this bug. ***

Comment 19

[Dave Miller [:justdave]]

*** Bug 232230 has been marked as a duplicate of this bug. ***