You are here: Foswiki>Tasks Web>Extension>PlainFileStoreContrib>Item12395 (28 Feb 2013, CrawfordCurrie)Edit Attach

Item12395: insecure dependency in a couple of file operations

Priority: Normal
Current State: Closed
Released In: n/a
Target Release:

Applies To: Extension
Component: PlainFileStoreContrib
Branches: trunk

Reported By: MichaelDaum
Waiting For:
Last Change By: CrawfordCurrie

The store tries to use tainted strings in file operations in a couple of places.

A simple save throws errors opening or unlinking files, e.g. here:

--- lib/Foswiki/Store/PlainFile.pm      (revision 16537)
+++ lib/Foswiki/Store/PlainFile.pm      (working copy)
@@ -467,6 +467,9 @@
     my $latest = _latestFile($meta);
     my $hf     = _historyFile( $meta, undef, $rn );
     my $t      = ( stat $latest )[9];                 # SMELL: use TOPICINFO?
+
+$hf = Foswiki::Sandbox::untaintUnchecked($hf);
+

-- MichaelDaum - 19 Feb 2013

Wasted a lot of time running the (previously working) VCStoreTests, only to find they have been recoded to be specific to the RCS store implementation

-- CrawfordCurrie - 28 Feb 2013

ItemTemplate edit

Summary	insecure dependency in a couple of file operations
ReportedBy	MichaelDaum
Codebase
SVN Range
AppliesTo	Extension
Component	PlainFileStoreContrib
Priority	Normal
CurrentState	Closed
WaitingFor
Checkins	distro:c5fea79a7e28
ReleasedIn	n/a
CheckinsOnBranches	trunk
trunkCheckins	distro:c5fea79a7e28
Release01x01Checkins