355709 - [PostgreSQL] Crash when querying the DB

Status: RESOLVED FIXED

(Bugzilla :: Query/Bug List, defect)

Description

[Frédéric Buclin]

I tested on bugzilla-tip-pg and qa30pg on landfill, as well as on my local 2.23.3 installation running on PostgreSQL, and I can reproduce the bug in all 3 installations:

Insecure dependency in parameter 1 of DBI::db=HASH(0x931b930)->prepare method call while running with -T switch at /var/www/html/qa30pg/buglist.cgi line 996.

To reproduce, go to query.cgi, and select:

A Comment: "contains all of the words/strings" "foo"


I cannot reproduce the bug on MySQL using this testcase, nor can I reproduce on 2.22 using PostgreSQL. So this bug is specific to 3.0 running on PostgreSQL.

Comment 1

[Frédéric Buclin]

I have no idea what the problem is. joel, Max, can you help?

Comment 2

[Max Kanat-Alexander]

All right. I'm investigating this. This line shows up as tainted:

((bugs.bug_status IN ('NEW','ASSIGNED','REOPENED')) AND (POSITION('foo' IN LOWER(bugs.short_desc)) > 0))

Comment 3

[Max Kanat-Alexander]

Attachment: v1

Okay, here we go. Trivial and obvious patch. The code was obviously wrong before. I don't know why MySQL wasn't throwing this error--I suppose its quote() function also detaints, while Pg's doesn't.

Comment 4

[Frédéric Buclin]

For the record, this is a regression due to bug 300552, which landed on tip only.

Comment 5

[Frédéric Buclin]

Comment on attachment 241455 [details] [diff] [review]
v1

Tested. This fixes the problem. r=LpSolit

Land this asap.

Comment 6

[Max Kanat-Alexander]

Checking in Bugzilla/Search.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Search.pm,v  <--  Search.pm
new revision: 1.142; previous revision: 1.141
done