177773 - target milestone creation shouldn't accept newline characters

Status: NEW

(Bugzilla :: Administration, task)

Description

[timeless]

mozilla somehow allowed me to create target milestones like milestone=5.11%0D%0A5.12
bugzilla shouldn't have accepted it without a fight.

Comment 1

[Dave Miller [:justdave]]

Reassigning bugs that I'm not actively working on to the default component owner
in order to try to make some sanity out of my personal buglist.  This doesn't
mean the bug isn't being dealt with, just that I'm not the one doing it.  If you
are dealing with this bug, please assign it to yourself.

Comment 2

[Paul]

Attachment: Patch for tip

Comment 3

[Paul]

Attachment: Patch for v2.20

Comment 4

[Dave Miller [:justdave]]

I don't think this is a blocker because it's not included in the headers of email, which doesn't make it a security issue.  That said, it's still not a nice thing to run into, and I'll certainly take it on the branch.

Comment 5

[Frédéric Buclin]

Comment on attachment 206400 [details] [diff] [review]
Patch for tip

With your patch applied, I cannot edit milestones having control characters in them anymore. The reason is that the DB and versioncache contain "foo\xXYbar" but editmilestones.cgi now converts it to "foo bar" and so complains that this milestone doesn't exist. I can neither edit it nor delete it.

Looks like we have to convert existing milestones from checksetup.pl. But are we going to do that for all fields in the DB? I guess this will be pretty slow for large installations. And the benefit is rather small. mkanat? justdave?

Comment 6

[Frédéric Buclin]

Comment on attachment 206401 [details] [diff] [review]
Patch for v2.20

r- per bug 101380 comment 49. And we won't fix it on branches, tip only.

Comment 7

[Frédéric Buclin]

Comment on attachment 206400 [details] [diff] [review]
Patch for tip

Validators must now be in create(), not in editmilestones.cgi.

Comment 8

[Frédéric Buclin]

Bugzilla 3.2 is restricted to security bugs only. Moreover, this bug is either assigned to nobody or got no traction for several months now. Rather than retargetting it at each new release, I'm clearing the target milestone and the bug will be retargetted to some sensible release when someone starts fixing this bug for real (Bugzilla 3.8 more likely).