1187897 - Taint Mode Error in Crypt::OpenPGP v1.10

Status: RESOLVED WORKSFORME

(bugzilla.mozilla.org :: Extensions, defect)

Description

[Dylan Hardison [:dylan] (he/him)]

Error below. This does not happen on production, thankfully...

Insecure dependency in eval while running with -T switch at /usr/local/share/perl5/Crypt/OpenPGP/Util.pm line 107.
 at /usr/local/share/perl5/Crypt/OpenPGP/Util.pm line 104.
	Crypt::OpenPGP::Util::get_random_bytes(490) called at /usr/local/share/perl5/Crypt/OpenPGP/SessionKey.pm line 96

Comment 1

[:glob ✱]

i suspect fixing bug 1186416 would address this issue.

Comment 2

[:Atoll]

https://github.com/btrott/Crypt-OpenPGP/blob/master/lib/Crypt/OpenPGP/Util.pm#L104

There's definitely string evals there, for the sole purpose of testing for random module alternatives.

Consider filing an upstream bug at their Github?

Comment 3

[Gervase Markham [:gerv]]

https://github.com/btrott/Crypt-OpenPGP/issues/28 filed. Feel free to improve it. :-)

Gerv

Comment 4

[Dylan Hardison [:dylan] (he/him)]

This doesn't seem to happen any more. I bet it was an error at a distance fixed by fixing nested template application. Maybe.

Comment 5

[Dylan Hardison [:dylan] (he/him)]

Aha, the real reason is jobqueue doesn't run under taint mode. That said, even if I pass a tainted 490 value into the get_random_bytes() it doesn't error.