331310 - cvsmailfilter.pl sends email in an unreliable way

Status: RESOLVED FIXED

(Webtools Graveyard :: Despot, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

cvsmailfilter.pl has its email sending code copied from dolog.pl in bonsai, on which I just filed bug 331309.  Given how much this mechanism is used to monitor checkins, unreliababity that can be triggered by an outside attacker should be considered a security hole (although it's only against committers, who we at least sort of trust).

cvsmailfilter.pl should be patched on our cvs servers when bug 331309 is fixed.

Comment 1

[Reed Loden [:reed]]

Attachment: wrong file

Swap to using Mail::Mailer, but leave $use_sendmail as 0, as sendmail isn't in the jail.

Comment 2

[Dave Miller [:justdave]]

fwiw, the method used on bug 331309 never got implemented in production and won't work here either.  sendmail is not installed in the chroot jail, and wouldn't have any access to the system-level mail spool if it was.  Since we run chrooted, we have no choice but to use SMTP.

a) This isn't as big an issue as it used to be because 90% of the services on rheet have been moved elsewhere, and the primary cvs server doesn't run anything else but cvs, so we haven't run into any load issues on either of those machines in months.

b) We could presumably fix this by having both scripts smtp to smtp.mozilla.org instead of to localhost.

Comment 3

[Reed Loden [:reed]]

Attachment: patch - v1 (the actual patch)

Ugh, this is the patch.

Comment 4

[Dave Miller [:justdave]]

Comment on attachment 254777 [details] [diff] [review]
patch - v1 (the actual patch)

yeah, looks like the same thing we did to dolog.pl pretty much (which caused a lot of grief when it went live because we didn't have Mail::Mailer in the jail. :)

Comment 5

[Dave Miller [:justdave]]

Checking in cvsmailfilter.pl;
/cvsroot/CVSROOT/cvsmailfilter.pl,v  <--  cvsmailfilter.pl
new revision: 1.12; previous revision: 1.11
done