From 7b70d6c5950e2840db85b0207f715c58708e2e8d Mon Sep 17 00:00:00 2001 From: "mkanat%bugzilla.org" <> Date: Wed, 31 May 2006 04:19:09 +0000 Subject: Bug 338573: Auth could throw an insecure dependency error if username is tainted Patch By Max Kanat-Alexander r=LpSolit, a=justdave --- Bugzilla/Auth/Verify.pm | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'Bugzilla') diff --git a/Bugzilla/Auth/Verify.pm b/Bugzilla/Auth/Verify.pm index da277cefd..68a20f6df 100644 --- a/Bugzilla/Auth/Verify.pm +++ b/Bugzilla/Auth/Verify.pm @@ -106,10 +106,16 @@ sub create_or_update_user { validate_email_syntax($username) || return { failure => AUTH_ERROR, error => 'auth_invalid_email', details => {addr => $username} }; + # Username is more than likely tainted, but we only use it in a + # placeholder, and we've already validated it, so it's safe. + trick_taint($username); $dbh->do('UPDATE profiles SET login_name = ? WHERE userid = ?', $username, $user->id); } if ($real_name && $user->name ne $real_name) { + # $real_name is more than likely tainted, but we only use it + # in a placeholder and we never use it after this. + trick_taint($real_name); $dbh->do('UPDATE profiles SET realname = ? WHERE userid = ?', undef, $real_name, $user->id); } -- cgit v1.2.3-24-g4f1b