Item9069: MailerContrib::WebNotify fails with Taint issues. Subscriber names/addresses are tainted.

Priority: Normal
Current State: Closed
Released In: 1.0.10, 1.1.0
Target Release: patch
Applies To: Extension
Component: MailerContrib
Reported By: GeorgeClark
Waiting For:
Last Change By: KennethLavrsen
    MailerContribSuite::testSimple
*** Assertion failed!
 at /var/www/SVN/foswiki/core/lib/Assert.pm line 64
    Assert::ASSERT(undef) called at /var/www/SVN/foswiki/core/lib/Foswiki.pm line 3425
    Foswiki::topicExists('Foswiki=HASH(0x1e39e5a0)', 'TemporaryMailerContribTestsUsersWeb', 'TestGroup') called at /var/www/SVN/foswiki/core/lib/Foswiki/Users/TopicUserMapping.pm line 605
    Foswiki::Users::TopicUserMapping::eachGroupMember('Foswiki::Users::TopicUserMapping=HASH(0x1e383d98)', 'TestGroup') called at /var/www/SVN/foswiki/core/lib/Foswiki/Users.pm line 820
    Foswiki::Users::eachGroupMember('Foswiki::Users=HASH(0x1e3844d8)', 'TestGroup') called at /var/www/SVN/foswiki/core/lib/Foswiki/Func.pm line 960
    Foswiki::Func::eachGroupMember('TestGroup') called at /var/www/SVN/foswiki/core/lib/Foswiki/Contrib/MailerContrib/WebNotify.pm line 129
    Foswiki::Contrib::MailerContrib::WebNotify::subscribe('Foswiki::Contrib::MailerContrib::WebNotify=HASH(0x1e459398)', 'TestGroup', '*', 0, 0) called at /var/www/SVN/foswiki/core/lib/Foswiki/Contrib/Maile
    Foswiki::Contrib::MailerContrib::WebNotify::_load('Foswiki::Contrib::MailerContrib::WebNotify=HASH(0x1e459398)') called at /var/www/SVN/foswiki/core/lib/Foswiki/Contrib/MailerContrib/WebNotify.pm line 5
    Foswiki::Contrib::MailerContrib::WebNotify::new('Foswiki::Contrib::MailerContrib::WebNotify', 'TemporaryMailerContribTestsTestWebMailerContribTests', 'WebNotify') called at /var/www/SVN/foswiki/core/lib
    Foswiki::Contrib::MailerContrib::_processWeb('TemporaryMailerContribTestsTestWebMailerContribTests') called at /var/www/SVN/foswiki/core/lib/Foswiki/Contrib/MailerContrib.pm line 91
    Foswiki::Contrib::MailerContrib::mailNotify('ARRAY(0x1e21ce48)', 0, undef, 0, 0) called at /var/www/SVN/foswiki/core/test/unit/MailerContrib/MailerContribSuite.pm line 280
    MailerContribSuite::testSimple('MailerContribSuite=HASH(0x1dee34c8)') called at /var/www/SVN/foswiki/core/lib/Unit/TestRunner.pm line 311

Fixed with SMELL. I'm untainting the subscriber without validation. The subscriber has already passed through the Email validations and local email validations. I suspect this should be safe, but needs validation.

-- GeorgeClark - 27 May 2010

Reviewed, thanks George. Though I don't understand why the untaint is required there (it definitely is)

-- CrawfordCurrie - 27 May 2010

Reopening to apply the same patch to 1.0.10. Changing status to waiting for release,

 

ItemTemplate edit

Summary MailerContrib::WebNotify fails with Taint issues. Subscriber names/addresses are tainted.
ReportedBy GeorgeClark
Codebase 1.0.9, trunk
SVN Range
AppliesTo Extension
Component MailerContrib
Priority Normal
CurrentState Closed
WaitingFor
Checkins distro:0948f068f820 distro:d146244c7862 distro:23310c45d135
TargetRelease patch
ReleasedIn 1.0.10, 1.1.0
Topic revision: r9 - 08 Sep 2010, KennethLavrsen
 
The copyright of the content on this website is held by the contributing authors, except where stated elsewhere. see CopyrightStatement. Creative Commons License