399461 - Bugzilla::Hook::process() doesn't flush Bugzilla->hook_args() after executing an extension

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Frédéric Buclin]

Attachment: patch, v1

Assume you have two extensions in the same CGI. They would both be executed, but Bugzilla->hook_args() defined by the first extension is not flushed before the 2nd extension is called, and so the 2nd extension may access data unrelated to it (if no argument is passed when calling it, so that Bugzilla->hook_args is left unaltered). Not only there could be some security implications, but the 2nd extension may work incorrectly as it's getting unexpected data. So we should flush Bugzilla->hook_args in Bugzilla::Hook::process() before calling the next extension.

Comment 1

[Max Kanat-Alexander]

Comment on attachment 284487 [details] [diff] [review]
patch, v1

Yeah, this looks right.

I wonder if hook_args should be called outside the foreach loop, really. I guess not--scalar values should be reset between calls to different plugins.

Comment 2

[Frédéric Buclin]

tip:

Checking in Bugzilla/Hook.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Hook.pm,v  <--  Hook.pm
new revision: 1.11; previous revision: 1.10
done

3.0.2:

Checking in Bugzilla/Hook.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Hook.pm,v  <--  Hook.pm
new revision: 1.7.2.1; previous revision: 1.7
done