125427 - Taint error in duplicates.cgi with perl < 5.6 ("Insecure dependency in glob")

Status: RESOLVED FIXED

(Bugzilla :: Reporting/Charting, defect, P1)

Description

[Andreas Franke (gone)]

When running duplicates.cgi with perl 5.005_02 I get the following software
error:

Insecure dependency in glob while running with -T switch at
/home/bugzilla/apache/htdocs/duplicates.cgi line 82. 

The line where the error occurs is:

	if (<data/duplicates/dupes$today*>)

This error does not occur with perl 5.6.0.

<Quotes from bbaetz on IRC>

bbaetz@landfill:~$ perl -wT 
if (<foo*>) { print "FOO\n"; }
bbaetz@landfill:~$ perl5.00503 -wT
if (<foo*>) { print "FOO\n"; }
Insecure dependency in glob while running with -T switch at - line 1.
bbaetz@landfill:~$ 

since dbmopen will create the file if it doesn't exist, we need to check for
existance but we can't...

perldelta says that they no longer spawn csh for globbing
thats probably it

I think that it needs to use tie rather than dbmopen
and then set the mode to not create

</Quotes>

Comment 1

[Bradley Baetz (:bbaetz)]

OK, we need to remove the glob and just check the return value from dbmopen.
I'll do this after the templatistaion - theres no point before that.

Comment 2

[Myk Melez [:myk] [@mykmelez]]

duplicates.cgi templatization is done.  Got a patch?

Comment 3

[Bradley Baetz (:bbaetz)]

Nope. I can hack one up on Fri, but I can't test it, since I don't have perl
5.005 installed, and this doesn't occur with 5.6. landfill is still down, and I
don't know if it will have 5.005 on it when it comes up.

I'll put up a patch, though, which should work, but not today.

Comment 4

[Bradley Baetz (:bbaetz)]

Attachment: v1

OK, here we go. dbm_open creates teh file if it doesn't exist, so checking the
return value is no good. I can't test for the existtance of $filename.db,
because I don't know if the .db extention is standard. I'm using tie instead,
now, and not passing in O_CREAT. I'm detecting file not found via Errno.

Is this safe on both windows, and per 5.005?

I only have 5.6.1, so I can't even test that this fixes the original problem.
Who wants to volunteer?

Comment 5

[David D. Kilzer (ddk)]

There is a third dbmopen statement for "dupes$whenever*" in
duplicates.cgi.  The patch will have to include that one as
well.

Comment 6

[Bradley Baetz (:bbaetz)]

Attachment: v2

oops. 3rd instance fixed

Comment 7

[Gervase Markham [:gerv]]

Comment on attachment 78856 [details] [diff] [review]
v2

r=gerv, if, for my general education, you can explain to me the differences (if
any) between dbmopen and tie in these circumstances :-)

Gerv

Comment 8

[Bradley Baetz (:bbaetz)]

gerv: tie lets me avoid the O_CREAT which dbmopen always uses. Its ok for the
file to be hissing, so we don't want it created....

Comment 9

[Bradley Baetz (:bbaetz)]

tested on landfill, without the patch |perl5.00503 -wT ./duplicates.cgi| gives
errors, with the patch its fine

Comment 10

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 78856 [details] [diff] [review]
v2

I can't test this patch on 5.0x, but it works on 5.6, and I'll trust bbaetz
that it fixes the problem in landfill. r=myk

Comment 11

[Bradley Baetz (:bbaetz)]

Checked in.