1087400 - CGI 4.05 throws tons of "CGI::param called in list context" warnings

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Frédéric Buclin]

For security reasons, CGI 4.05 and newer throw "CGI::param called in list context" warnings if you write:

  @foo = $cgi->param('foo');

This is polluting web server logs (which can potentially alter performance). We should either set $LIST_CONTEXT_WARN = 0, or clone the upstream multi_param() subroutine into Bugzilla::CGI for installations which use CGI < 4.05 and use it instead of param() where appropriate.

For Bugzilla 5.0, maybe setting $LIST_CONTEXT_WARN = 0 is easier, but for Bugzilla 5.2, we should use multi_param() for security reasons (i.e. be explicit instead of hidding warnings).

Comment 1

[:glob ✱]

(In reply to Frédéric Buclin from comment #0)
> For Bugzilla 5.0, maybe setting $LIST_CONTEXT_WARN = 0 is easier, but for
> Bugzilla 5.2, we should use multi_param() for security reasons (i.e. be
> explicit instead of hidding warnings).

+1

Comment 2

[Frédéric Buclin]

Do we also want to fix that in Bugzilla 4.4?

Comment 3

[:glob ✱]

(In reply to Frédéric Buclin from comment #2)
> Do we also want to fix that in Bugzilla 4.4?

yes

Comment 4

[Frédéric Buclin]

Attachment: patch, v1

Comment 5

[:glob ✱]

Comment on attachment 8509941 [details] [diff] [review]
patch, v1

Review of attachment 8509941 [details] [diff] [review]:
-----------------------------------------------------------------

r=glob

Comment 6

[Frédéric Buclin]

To ssh://[e-mail]/bugzilla/bugzilla.git
   36e2c74..0410aa4  master -> master

To ssh://[e-mail]/bugzilla/bugzilla.git
   611bca7..1f49750  5.0 -> 5.0

To ssh://[e-mail]/bugzilla/bugzilla.git
   f689b0d..9155570  4.4 -> 4.4

Comment 7

[Dave Miller [:justdave]]

Approved for 4.2 as well on the grounds that we need passing tests to tell if it's safe to release if we need to release it again.

Comment 8

[Frédéric Buclin]

To ssh://[e-mail]/bugzilla/bugzilla.git
   9d068ba..6bf9634  4.2 -> 4.2