diff options
author | David Lawrence <dkl@mozilla.com> | 2015-12-21 23:27:52 +0100 |
---|---|---|
committer | David Lawrence <dkl@mozilla.com> | 2015-12-21 23:27:52 +0100 |
commit | 1e7b4002794930fad702718714b5d1c291bf816c (patch) | |
tree | 9a62f822dc148df80bbc3199ef0ef9f6bb1c222c /Bugzilla/WebService/Util.pm | |
parent | 4049782d5f01e12231c1d4c27006d5f56dd54294 (diff) | |
download | bugzilla-1e7b4002794930fad702718714b5d1c291bf816c.tar.gz bugzilla-1e7b4002794930fad702718714b5d1c291bf816c.tar.xz |
Bug 1234325 - Backport upstream bug 1230932 to bmo/4.2 to fix providing a condition as an ID to the webservice results in a taint error
Diffstat (limited to 'Bugzilla/WebService/Util.pm')
-rw-r--r-- | Bugzilla/WebService/Util.pm | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/Bugzilla/WebService/Util.pm b/Bugzilla/WebService/Util.pm index 4280f28e6..e4c3eda44 100644 --- a/Bugzilla/WebService/Util.pm +++ b/Bugzilla/WebService/Util.pm @@ -29,6 +29,7 @@ use Bugzilla::WebService::Constants; use Storable qw(dclone); use URI::Escape qw(uri_unescape); +use List::MoreUtils qw(all any); use base qw(Exporter); @@ -231,7 +232,8 @@ sub validate { # sent any parameters at all, and we're getting @keys where # $params should be. return ($self, undef) if (defined $params and !ref $params); - + + my @id_params = qw( ids comment_ids ); # If @keys is not empty then we convert any named # parameters that have scalar values to arrayrefs # that match. @@ -240,6 +242,12 @@ sub validate { $params->{$key} = ref $params->{$key} ? $params->{$key} : [ $params->{$key} ]; + + if (any { $key eq $_ } @id_params) { + my $ids = $params->{$key}; + ThrowCodeError('param_integer_array_required', { param => $key }) + unless ref($ids) eq 'ARRAY' && all { /^[0-9]+$/ } @$ids; + } } } |