134562 - taint error in buglist.cgi

Status: RESOLVED FIXED

(Bugzilla :: Query/Bug List, defect, P2)

Description

[John Vandenberg]

Whilst generating a buglist for a query containing 'votes', Bugzilla returns a
software error "Attempted to send tainted string 'SELECT DISTINCT ...' to the
database at globals.pl line 235.

The taint error is introduced at buglist.cgi line 1193.

Comment 1

[John Vandenberg]

Attachment: patch

copies the 'votes' validation from GenerateSQL.

Comment 2

[Bradley Baetz (:bbaetz)]

Thats the wrong place, (you're doing it as a side effect there), but I can't
reproduce this. What is the query you are running?

Comment 3

[John Vandenberg]

I am able to reproduce this on any query that contains votes=1.

Comment 4

[John Vandenberg]

I am using perl v5.6.0 (from SuSE perl-5.6.0-81) if that is any help.

Comment 5

[Bradley Baetz (:bbaetz)]

OK, this works in 5.6.1. From investigation on IRC, whats happening is that perl
5.6.0 is considering the entire statement to be tainted if any part of the
statement is tatined.

The fix is just to use the block form of if.

The patch I'll attach also fixes a minor buglet I noticed, where if you enter
only whitespace in the votes box, the trim() in that code ignores teh field, but
the votes column is still pushed anyway.

Taking, for 2.16

Comment 6

[Bradley Baetz (:bbaetz)]

Attachment: v1

Comment 7

[Dave Miller [:justdave]]

Comment on attachment 77205 [details] [diff] [review]
v1

r= justdave

Comment 8

[Gervase Markham [:gerv]]

Comment on attachment 77205 [details] [diff] [review]
v1

r=gerv.

Gerv

Comment 9

[Bradley Baetz (:bbaetz)]

Checked in:

Checking in buglist.cgi;
/cvsroot/mozilla/webtools/bugzilla/buglist.cgi,v  <--  buglist.cgi
new revision: 1.164; previous revision: 1.163
done