208647 - cygwin, IIS 5.0: Insecure dependency in parameter 1 of DBI::db=HASH(0x10611388)->prepare method call while running with -T switch at Bugzilla/DB.pm line 64.

Status: RESOLVED FIXED

(Bugzilla :: Administration, task)

Description

[Jason Pyeron]

User-Agent:       Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)
Build Identifier: 

When adding a new product after submit I get 


Insecure dependency in parameter 1 of DBI::db=HASH(0x10611388)->prepare method 
call while running with -T switch at Bugzilla/DB.pm line 64. 

Reproducible: Always

Steps to Reproduce:
1. install on cygwin, use IIS 5.0 (win2kpro)
2. perl -T %s %s
3. go to products page, choose add, then submit




Version 2.17.4 

Bugzilla/DB.pm:64:
    $_current_sth = Bugzilla->dbh->prepare($str);

Comment 1

[Jason Pyeron]

offending code from editproducts.cgi:


about line 329

    SendSQL("INSERT INTO products ( " .
            "name, description, milestoneurl, disallownew, votesperuser, " .
            "maxvotesperbug, votestoconfirm, defaultmilestone" .
            " ) VALUES ( " .
            SqlQuote($product) . "," .
            SqlQuote($description) . "," .
            SqlQuote($milestoneurl) . "," .
            $disallownew . "," .
            "$votesperuser, $maxvotesperbug, $votestoconfirm, " .
            SqlQuote($defaultmilestone) . ")");

Comment 2

[Jason Pyeron]

Attachment: detaint vars for add new product sql

fixed it by untainting:
 $disallownew $votesperuser $maxvotesperbug $votestoconfirm
with SqlQuote()

Comment 3

[Jason Pyeron]

Attachment: detaint vars for add new product sql

forgot to comment the code

Comment 4

[Jason Pyeron]

Attachment: detaint vars for add new product sql

Comment 5

[Bradley Baetz (:bbaetz)]

edit* does not run under taint mode. Yes, we know that this affects windows
(because windows can't run some scripts under -T and others not)

These shouldn't be SqlQuoted, but instead checked for numerics (via
detaint_natural).

Comment 6

[Kiyomi K]

Bug xxx has been added to the database
Content-type: text/html 

Software error:
Insecure dependency in exec while running with -T switch at /var/www/bugzilla-
2.16.3/post_bug.cgi line 303.

Comment 7

[Jason Pyeron]

re commet 6: thanks, unfortunatly it will be some time before this problem on 
the stable branch is attacked. If you would like to check the development 
(tip), and this problem is still there, a patch will be created ASAP by our 
company.

Comment 8

[Dave Miller [:justdave]]

Comment on attachment 125148 [details] [diff] [review]
detaint vars for add new product sql

I don't know where MattyT is these days...

Comment 9

[Bradley Baetz (:bbaetz)]

Comment on attachment 125148 [details] [diff] [review]
detaint vars for add new product sql

I'll be really surprised if tis makes editproducts taint-safe, but....

Its not strictly correct (we should detaint_natural) them first, but its edit*,
and not a security issue, so r=bbaetz

Comment 10

[Vlad Dascalu]

Assigning to patch writer.

Comment 11

[Dave Miller [:justdave]]

Checking in editproducts.cgi;
/cvsroot/mozilla/webtools/bugzilla/editproducts.cgi,v  <--  editproducts.cgi
new revision: 1.40; previous revision: 1.39
done

Comment 12

[Jason Pyeron]

for thos who have this problem in editgroups see Bug 223704