221977 - Insecure dependency in require while running with -T switch at Bugzilla/Auth.pm

Status: RESOLVED FIXED

(Bugzilla :: Installation & Upgrading, defect, P1)

Description

[Dave Miller [:justdave]]

bugzilla-tip perl 5.6.0 is burning.

Error is:

Insecure dependency in require while running with -T switch at Bugzilla/Auth.pm
line 32.

Comment 1

[Dave Miller [:justdave]]

Attachment: Patch

This patch makes the error go away.  It resolves it by detainting the auth
module name.  The fact that it's tainted to begin with indicates we may have a
problem somewhere else, so this probably isn't the best way to fix it.

FWIW, this error ONLY ocurrs if you don't have a data/params file (which is the
case when running in Tinderbox conditions), so it may be a problem with how it
falls back on defaults under compile-only conditions.

Comment 2

[Gervase Markham [:gerv]]

Comment on attachment 133169 [details] [diff] [review]
Patch

r=gerv.

Gerv

Comment 3

[Dave Miller [:justdave]]

I still don't like this, but it'll do for now.

Comment 4

[Vlad Dascalu]

Checking in Auth.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Auth.pm,v  <--  Auth.pm
new revision: 1.2; previous revision: 1.1
done

Comment 5

[Bradley Baetz (:bbaetz)]

I really don't like the 'compile-only' stuff tinderbox does, but.....

Its 5.6.0 only, so its hard to debug, but may be related to the way we load in
defparams.

Comment 6

[Bradley Baetz (:bbaetz)]

Err, hang on. You can't include . in the list of valid characters. Since you
don't include / or \, I guess you could allow it as log as its not . or .., but
I don't think . is useful in a name for a module anyway.