251484 - taint error on series create when creating a new product

Status: RESOLVED FIXED

(Bugzilla :: Administration, task)

Description

[Dave Miller [:justdave]]

Bugzilla  Version 2.18rc1

Adding new product

Software error:

Insecure dependency in parameter 1 of DBI::db=HASH(0x9280a9c)->do method call
while running with -T switch at Bugzilla/Series.pm line 183.

Comment 1

[Joel Peshkin]

Attachment: Detaint query and name

Comment 2

[Joel Peshkin]

Attachment: detaint at source

Comment 3

[Christian Reis]

Comment on attachment 153240 [details] [diff] [review]
detaint at source

Hmm. Weird. Why are we trick_tainting $product so late? Shouldn't it be done
right after we verify the product with TestProduct? 

Also, what ensures open_name is really safe?  It comes from a form variable,
and apparently, straight from it..

Comment 4

[Joel Peshkin]

Both of those go straight into strings that get dbh->quoted and written.

product is also coming froma  bug form,

Comment 5

[Gervase Markham [:gerv]]

There's actually a similar problem on normal series create; I've fixed it as
part of my patch for the series group controls.

Gerv

Comment 6

[Gervase Markham [:gerv]]

I've also seen the same error when trying to update a product with a new
votestoconfirm. Is that a different bug?

Gerv

Comment 7

[GavinS]

(In reply to comment #6)
> I've also seen the same error when trying to update a product with a new
> votestoconfirm. Is that a different bug?

I think that the vote field taint issues were fixed in bug#250265   

Comment 8

[Dave Miller [:justdave]]

Comment on attachment 153240 [details] [diff] [review]
detaint at source

We need a comment here explaining why trick_taint is okay to use here.

Comment 9

[Joel Peshkin]

Attachment: includes comment

Comment 10

[Dave Miller [:justdave]]

Comment on attachment 153474 [details] [diff] [review]
includes comment

looks good.  fix your spelling mistake on checkin :)

Comment 11

[Joel Peshkin]

checked in on both branches

Comment 12

[GavinS]

*** Bug 264083 has been marked as a duplicate of this bug. ***

Comment 13

[Frédéric Buclin]

*** Bug 273341 has been marked as a duplicate of this bug. ***