583645 - [PostgreSQL] Many searches on Pg fail with a taint error

Status: RESOLVED FIXED

(Bugzilla :: Query/Bug List, defect)

Description

[Max Kanat-Alexander]

Right now on trunk, quicksearches and most other searches fail with a taint error.

The problem is that during the refactoring, I removed most of the extra "trick_taint" statements after $dbh->quote. Although on DBD::mysql this detaints stuff, on DBD::Pg it does not.

We have two options, really, for cross-database consistency in this area. They both involve overriding "quote" in Bugzilla::DB:

1) Check if the input is tainted, and re-taint any output if the input was tainted, no matter what.

2) Always detaint the output from "quote", no matter what.

I prefer #2--it's what DBD::mysql is doing now, and it means that we don't need a lot of extra "trick_taint" statements throughout the code after calling $dbh->quote.

Comment 1

[Max Kanat-Alexander]

Attachment: v1 (always detaint)

Here's solution #2.

Comment 2

[Frédéric Buclin]

Comment on attachment 461965 [details] [diff] [review]
v1 (always detaint)

I think this is safe. r=LpSolit

Comment 3

[Max Kanat-Alexander]

Committing to: bzr+ssh://bzr.mozilla.org/bugzilla/trunk/
modified Bugzilla/DB.pm
Committed revision 7413.