Item9069: MailerContrib::WebNotify fails with Taint issues. Subscriber names/addresses are tainted.

    MailerContribSuite::testSimple
*** Assertion failed!
 at /var/www/SVN/foswiki/core/lib/Assert.pm line 64
    Assert::ASSERT(undef) called at /var/www/SVN/foswiki/core/lib/Foswiki.pm line 3425
    Foswiki::topicExists('Foswiki=HASH(0x1e39e5a0)', 'TemporaryMailerContribTestsUsersWeb', 'TestGroup') called at /var/www/SVN/foswiki/core/lib/Foswiki/Users/TopicUserMapping.pm line 605
    Foswiki::Users::TopicUserMapping::eachGroupMember('Foswiki::Users::TopicUserMapping=HASH(0x1e383d98)', 'TestGroup') called at /var/www/SVN/foswiki/core/lib/Foswiki/Users.pm line 820
    Foswiki::Users::eachGroupMember('Foswiki::Users=HASH(0x1e3844d8)', 'TestGroup') called at /var/www/SVN/foswiki/core/lib/Foswiki/Func.pm line 960
    Foswiki::Func::eachGroupMember('TestGroup') called at /var/www/SVN/foswiki/core/lib/Foswiki/Contrib/MailerContrib/WebNotify.pm line 129
    Foswiki::Contrib::MailerContrib::WebNotify::subscribe('Foswiki::Contrib::MailerContrib::WebNotify=HASH(0x1e459398)', 'TestGroup', '*', 0, 0) called at /var/www/SVN/foswiki/core/lib/Foswiki/Contrib/Maile
    Foswiki::Contrib::MailerContrib::WebNotify::_load('Foswiki::Contrib::MailerContrib::WebNotify=HASH(0x1e459398)') called at /var/www/SVN/foswiki/core/lib/Foswiki/Contrib/MailerContrib/WebNotify.pm line 5
    Foswiki::Contrib::MailerContrib::WebNotify::new('Foswiki::Contrib::MailerContrib::WebNotify', 'TemporaryMailerContribTestsTestWebMailerContribTests', 'WebNotify') called at /var/www/SVN/foswiki/core/lib
    Foswiki::Contrib::MailerContrib::_processWeb('TemporaryMailerContribTestsTestWebMailerContribTests') called at /var/www/SVN/foswiki/core/lib/Foswiki/Contrib/MailerContrib.pm line 91
    Foswiki::Contrib::MailerContrib::mailNotify('ARRAY(0x1e21ce48)', 0, undef, 0, 0) called at /var/www/SVN/foswiki/core/test/unit/MailerContrib/MailerContribSuite.pm line 280
    MailerContribSuite::testSimple('MailerContribSuite=HASH(0x1dee34c8)') called at /var/www/SVN/foswiki/core/lib/Unit/TestRunner.pm line 311

Fixed with SMELL. I'm untainting the subscriber without validation. The subscriber has already passed through the Email validations and local email validations. I suspect this should be safe, but needs validation.

-- GeorgeClark - 27 May 2010

Reviewed, thanks George. Though I don't understand why the untaint is required there (it definitely is)

-- CrawfordCurrie - 27 May 2010

Reopening to apply the same patch to 1.0.10. Changing status to waiting for release,

Commenting is disabled while not logged in