From 5dc75560608d63c6ee8e4c918cace9882f8ddf3b Mon Sep 17 00:00:00 2001 From: "mkanat%bugzilla.org" <> Date: Mon, 9 Nov 2009 18:27:52 +0000 Subject: Bug 513593: Make the WebService taint incoming parameters Patch by Max Kanat-Alexander r=dkl, a=mkanat --- Bugzilla/WebService/Server/JSONRPC.pm | 3 +++ 1 file changed, 3 insertions(+) (limited to 'Bugzilla/WebService/Server/JSONRPC.pm') diff --git a/Bugzilla/WebService/Server/JSONRPC.pm b/Bugzilla/WebService/Server/JSONRPC.pm index b453c6196..e54387a6d 100644 --- a/Bugzilla/WebService/Server/JSONRPC.pm +++ b/Bugzilla/WebService/Server/JSONRPC.pm @@ -26,6 +26,7 @@ use base qw(JSON::RPC::Server::CGI Bugzilla::WebService::Server); use Bugzilla::Error; use Bugzilla::WebService::Constants; +use Bugzilla::WebService::Util qw(taint_data); use Date::Parse; use DateTime; @@ -123,6 +124,8 @@ sub _argument_type_check { $params = $params->[0]; } + taint_data($params); + # Now, convert dateTime fields on input. $self->_bz_method_name =~ /^(\S+)\.(\S+)$/; my ($class, $method) = ($1, $2); -- cgit v1.2.3-24-g4f1b