113459 - Bad regexp in emailregexp causes system lockout

Status: RESOLVED FIXED

(Bugzilla :: Administration, task, P2)

Description

[Joel Peshkin]

If the preferences web interface is used to change emailregexp to 

$::param{'emailregexp'} = '^[^@]*@[^@]**$';

Subsequent login attempts result in....

Software error:

/^[^@]*@[^@]**$/: nested *?+ in regexp at CGI.pl line 707. 


And it is no longer possible to log in and fix it.   

Workaround - edit data/params to fix the erroneous pattern.

Suggested fix - add validation of regexps to forms that permit users to enter 
them

Comment 1

[Joel Peshkin]

Attachment: Patch to test email regexps

Ok... about time to fix this

Comment 2

[Bradley Baetz (:bbaetz)]

Comment on attachment 93380 [details] [diff] [review]
Patch to test email regexps

Put the \&checkregexp on a separate line to match prevailing style.

Also, eval qr/$value/ rather than doing a dummy match - its 'nicer'

Comment 3

[Joel Peshkin]

Attachment: cleaner version

Comment 4

[Joel Peshkin]

Attachment: this one....

Comment 5

[Bradley Baetz (:bbaetz)]

Comment on attachment 93382 [details] [diff] [review]
this one....

>+sub checkregexp {
>+    my ($value) = (@_);
>+    eval { qr/$value/ };
>+    return $@ ;
>+}

r=bbaetz x2 if you remove the space before the ;

Comment 6

[Joel Peshkin]

Checking in defparams.pl;
/cvsroot/mozilla/webtools/bugzilla/defparams.pl,v  <--  defparams.pl
new revision: 1.81; previous revision: 1.80
done