From a748745d3eb9110b0c6bcd803d8d86db8951ad43 Mon Sep 17 00:00:00 2001 From: Byron Jones Date: Tue, 27 Jan 2015 11:47:42 +0800 Subject: Bug 1124437: Backport upstream bug 1090275 to bmo/4.2 to whitelist webservice api methods --- Bugzilla/WebService/Bug.pm | 20 ++++++++++++++++++++ Bugzilla/WebService/BugUserLastVisit.pm | 5 +++++ Bugzilla/WebService/Bugzilla.pm | 7 +++++++ Bugzilla/WebService/Classification.pm | 4 ++++ Bugzilla/WebService/Group.pm | 6 ++++++ Bugzilla/WebService/Product.pm | 8 ++++++++ Bugzilla/WebService/Server/JSONRPC.pm | 6 ++++++ Bugzilla/WebService/Server/XMLRPC.pm | 11 +++++++++++ Bugzilla/WebService/User.pm | 10 ++++++++++ 9 files changed, 77 insertions(+) (limited to 'Bugzilla/WebService') diff --git a/Bugzilla/WebService/Bug.pm b/Bugzilla/WebService/Bug.pm index 4f5b4c39c..9491a7938 100644 --- a/Bugzilla/WebService/Bug.pm +++ b/Bugzilla/WebService/Bug.pm @@ -88,6 +88,26 @@ use constant READ_ONLY => qw( search ); +use constant PUBLIC_METHODS => qw( + add_attachment + add_comment + attachments + comments + create + fields + get + history + legal_values + possible_duplicates + render_comment + search + search_comment_tags + update + update_attachment + update_comment_tags + update_see_also +); + use constant ATTACHMENT_MAPPED_SETTERS => { file_name => 'filename', summary => 'description', diff --git a/Bugzilla/WebService/BugUserLastVisit.pm b/Bugzilla/WebService/BugUserLastVisit.pm index 89a1aedd1..4bab9eb7b 100644 --- a/Bugzilla/WebService/BugUserLastVisit.pm +++ b/Bugzilla/WebService/BugUserLastVisit.pm @@ -17,6 +17,11 @@ use Bugzilla::Error; use Bugzilla::WebService::Util qw( validate filter ); use Bugzilla::Constants; +use constant PUBLIC_METHODS => qw( + get + update +); + sub update { my ($self, $params) = validate(@_, 'ids'); my $user = Bugzilla->user; diff --git a/Bugzilla/WebService/Bugzilla.pm b/Bugzilla/WebService/Bugzilla.pm index 1fc15c3c3..7d0b5473b 100644 --- a/Bugzilla/WebService/Bugzilla.pm +++ b/Bugzilla/WebService/Bugzilla.pm @@ -38,6 +38,13 @@ use constant READ_ONLY => qw( version ); +use constant PUBLIC_METHODS => qw( + extensions + time + timezone + version +); + sub version { my $self = shift; return { version => $self->type('string', BUGZILLA_VERSION) }; diff --git a/Bugzilla/WebService/Classification.pm b/Bugzilla/WebService/Classification.pm index 1c4226fd6..1b084eabb 100644 --- a/Bugzilla/WebService/Classification.pm +++ b/Bugzilla/WebService/Classification.pm @@ -20,6 +20,10 @@ use constant READ_ONLY => qw( get ); +use constant PUBLIC_METHODS => qw( + get +); + sub get { my ($self, $params) = validate(@_, 'names', 'ids'); diff --git a/Bugzilla/WebService/Group.pm b/Bugzilla/WebService/Group.pm index d6e5a7833..7518433af 100644 --- a/Bugzilla/WebService/Group.pm +++ b/Bugzilla/WebService/Group.pm @@ -16,6 +16,12 @@ use Bugzilla::Constants; use Bugzilla::Error; use Bugzilla::WebService::Util qw(validate translate params_to_objects); +use constant PUBLIC_METHODS => qw( + create + get + update +); + use constant MAPPED_RETURNS => { userregexp => 'user_regexp', isactive => 'is_active' diff --git a/Bugzilla/WebService/Product.pm b/Bugzilla/WebService/Product.pm index 3be46bd6d..be082c778 100644 --- a/Bugzilla/WebService/Product.pm +++ b/Bugzilla/WebService/Product.pm @@ -34,6 +34,14 @@ use constant READ_ONLY => qw( get_selectable_products ); +use constant PUBLIC_METHODS => qw( + create + get + get_accessible_products + get_enterable_products + get_selectable_products +); + use constant FIELD_MAP => { has_unconfirmed => 'allows_unconfirmed', is_open => 'isactive', diff --git a/Bugzilla/WebService/Server/JSONRPC.pm b/Bugzilla/WebService/Server/JSONRPC.pm index 0df4240e0..b0928960b 100644 --- a/Bugzilla/WebService/Server/JSONRPC.pm +++ b/Bugzilla/WebService/Server/JSONRPC.pm @@ -42,6 +42,7 @@ use Bugzilla::Util; use HTTP::Message; use MIME::Base64 qw(decode_base64 encode_base64); +use List::MoreUtils qw(none); ##################################### # Public JSON::RPC Method Overrides # @@ -415,6 +416,11 @@ sub _argument_type_check { } } + # Only allowed methods to be used from our whitelist + if (none { $_ eq $method} $pkg->PUBLIC_METHODS) { + ThrowCodeError('unknown_method', { method => $self->_bz_method_name }); + } + # This is the best time to do login checks. $self->handle_login(); diff --git a/Bugzilla/WebService/Server/XMLRPC.pm b/Bugzilla/WebService/Server/XMLRPC.pm index f56fa3439..94b751c9d 100644 --- a/Bugzilla/WebService/Server/XMLRPC.pm +++ b/Bugzilla/WebService/Server/XMLRPC.pm @@ -30,8 +30,11 @@ if ($ENV{MOD_PERL}) { } use Bugzilla::WebService::Constants; +use Bugzilla::Error; use Bugzilla::Util; +use List::MoreUtils qw(none); + BEGIN { # Allow WebService methods to call XMLRPC::Lite's type method directly *Bugzilla::WebService::type = sub { @@ -106,6 +109,14 @@ sub handle_login { my ($self, $classes, $action, $uri, $method) = @_; my $class = $classes->{$uri}; my $full_method = $uri . "." . $method; + # Only allowed methods to be used from the module's whitelist + my $file = $class; + $file =~ s{::}{/}g; + $file .= ".pm"; + require $file; + if (none { $_ eq $method } $class->PUBLIC_METHODS) { + ThrowCodeError('unknown_method', { method => $full_method }); + } $self->SUPER::handle_login($class, $method, $full_method); return; } diff --git a/Bugzilla/WebService/User.pm b/Bugzilla/WebService/User.pm index b6351635c..2f38446b8 100644 --- a/Bugzilla/WebService/User.pm +++ b/Bugzilla/WebService/User.pm @@ -44,6 +44,16 @@ use constant READ_ONLY => qw( get ); +use constant PUBLIC_METHODS => qw( + create + get + login + logout + offer_account_by_email + update + valid_login +); + use constant MAPPED_FIELDS => { email => 'login', full_name => 'name', -- cgit v1.2.3-24-g4f1b