136506 - can't create new accounts cvs tip 4/8/02

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect, P1)

Description

[David Avery]

using:
http://n0cgi.distributed.net/bugs/createaccount.cgi?login=foo%40bar.com&realname=foo+bar

cvs tip bugzilla returns:

Content-type: text/html 

Software error:

Attempted to send tainted string 'SELECT eventdata FROM tokens WHERE tokentype =
'emailold' AND eventdata like
'%:[e-mail]' OR eventdata like '[e-mail]:%'' to the database at globals.pl
line 260.

Comment 1

[Bradley Baetz (:bbaetz)]

This is a 2.16 blocker, I'd guess. Without having actually tested this, does
validateNewUser need to do some escaping (and where does that code deal with
stopping someone from hijacking the new email address?)

John, this would be your stuff, I assume

Comment 2

[John Vandenberg]

I found it necessary in userprefs.cgi to add trick_taint($login) after
CheckEmailSyntax($login) to avoid a taint error in ValidateNewUser. 
ValidateNewUser does not currently check email syntax, as most invocations have
already done this (and CheckEmailSyntax is in CGI.pl).

Long term, ValidateNewUser should call CheckEmailSyntax and return useful error
messages to be displayed to the user.

The code to avoid new email addresses being hijacked is ValidateNewUser.  It
checks there are no tokens with the specified address (pending changes, or
addresses still able to be reverted) and uses DBname_to_id to check against
current users.

Comment 3

[david avery]

Attachment: quick fix

quick fix - add trick taint to createaccount.cgi

Comment 4

[Bradley Baetz (:bbaetz)]

Comment on attachment 78670 [details] [diff] [review]
quick fix

diff -u, please

Comment 5

[Myk Melez [:myk] [@mykmelez]]

I can't reproduce this; can anyone else?

Comment 6

[John Vandenberg]

I can reproduce this, which may indicate this is similar to bug 134562.

Comment 7

[Bradley Baetz (:bbaetz)]

I'll see if I can work out what is going on later tonight.

Comment 8

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 78670 [details] [diff] [review]
quick fix

Fixes the problem on perl 5.005, continues to work on perl 5.6, trivial fix/low
risk, 2x r=myk

Comment 9

[Myk Melez [:myk] [@mykmelez]]

Checking in createaccount.cgi;
/cvsroot/mozilla/webtools/bugzilla/createaccount.cgi,v  <--  createaccount.cgi
new revision: 1.19; previous revision: 1.18
done