Bug 1230932: Providing a condition as an ID to the webservice results in a taint...

r=dkl

diff --git a/Bugzilla/API/1_0/Constants.pm b/Bugzilla/API/1_0/Constants.pm
index d372d410d8a2688afd6cae7fde60fbc51dc2c567..ea5183bc3b4f2bc6162b5e4085b69781dc9f6221 100644 (file)
--- a/Bugzilla/API/1_0/Constants.pm
+++ b/Bugzilla/API/1_0/Constants.pm
@@ -68,6 +68,8 @@ use constant WS_ERROR_CODE => {
     number_too_large            => 54,
     number_too_small            => 55,
     illegal_date                => 56,
+    param_integer_required      => 57,
+    param_scalar_array_required => 58,
     # Bug errors usually occupy the 100-200 range.
     improper_bug_id_field_value => 100,
     bug_id_does_not_exist       => 101,

diff --git a/Bugzilla/API/1_0/Resource/Bug.pm b/Bugzilla/API/1_0/Resource/Bug.pm
index dcc73086f3f53215feb6cdaa33226774d93d3cfa..5dc61e8d1ba3b9e7dcc3d0b22a0c776fa5cdbca6 100644 (file)
--- a/Bugzilla/API/1_0/Resource/Bug.pm
+++ b/Bugzilla/API/1_0/Resource/Bug.pm
@@ -1337,6 +1337,10 @@ sub update_comment_tags {
                           { function => 'Bug.update_comment_tags',
                             param    => 'comment_id' });
 
+    ThrowCodeError('param_integer_required', { function => 'Bug.update_comment_tags',
+                                               param => 'comment_id' })
+      unless $comment_id =~ /^\d+$/a;
+
     my $comment = Bugzilla::Comment->new($comment_id)
         || return [];
     $comment->bug->check_is_visible();

diff --git a/Bugzilla/API/1_0/Util.pm b/Bugzilla/API/1_0/Util.pm
index e2c7b1f1ff875034d0284a360c01e7fd15b1a9b7..ce4487c1fc59964dec3767cf4acf19b69433cd04 100644 (file)
--- a/Bugzilla/API/1_0/Util.pm
+++ b/Bugzilla/API/1_0/Util.pm
@@ -22,6 +22,7 @@ use MIME::Base64 qw(decode_base64 encode_base64);
 use Storable qw(dclone);
 use Test::Taint ();
 use URI::Escape qw(uri_unescape);
+use List::MoreUtils qw(any none);
 
 use parent qw(Exporter);
 
@@ -248,14 +249,19 @@ sub validate  {
     # $params should be.
     return ($self, undef) if (defined $params and !ref $params);
 
+    my @id_params = qw(ids comment_ids);
     # If @keys is not empty then we convert any named
     # parameters that have scalar values to arrayrefs
     # that match.
     foreach my $key (@keys) {
         if (exists $params->{$key}) {
-            $params->{$key} = ref $params->{$key}
-                              ? $params->{$key}
-                              : [ $params->{$key} ];
+            $params->{$key} = [ $params->{$key} ] unless ref $params->{$key};
+
+            if (any { $key eq $_ } @id_params) {
+                my $ids = $params->{$key};
+                ThrowCodeError('param_scalar_array_required', { param => $key })
+                  unless ref($ids) eq 'ARRAY' && none { ref $_ } @$ids;
+            }
         }
     }
 

diff --git a/Bugzilla/WebService/Bug.pm b/Bugzilla/WebService/Bug.pm
index aaf0d10e01c71b58e35c2e79422852d5320ed86a..a1c6b7d998945d74b631ba60c415f6178528e85a 100644 (file)
--- a/Bugzilla/WebService/Bug.pm
+++ b/Bugzilla/WebService/Bug.pm
@@ -1214,6 +1214,10 @@ sub update_comment_tags {
                           { function => 'Bug.update_comment_tags',
                             param    => 'comment_id' });
 
+    ThrowCodeError('param_integer_required', { function => 'Bug.update_comment_tags',
+                                               param => 'comment_id' })
+      unless $comment_id =~ /^\d+$/a;
+
     my $comment = Bugzilla::Comment->new($comment_id)
         || return [];
     $comment->bug->check_is_visible();

diff --git a/Bugzilla/WebService/Constants.pm b/Bugzilla/WebService/Constants.pm
index e5311d9e52db4725684a9c13bf332a8a9e38e18c..33316699646432a777e632d3dd6fdbef538712f9 100644 (file)
--- a/Bugzilla/WebService/Constants.pm
+++ b/Bugzilla/WebService/Constants.pm
@@ -69,6 +69,8 @@ use constant WS_ERROR_CODE => {
     number_too_large            => 54,
     number_too_small            => 55,
     illegal_date                => 56,
+    param_integer_required      => 57,
+    param_scalar_array_required => 58,
     # Bug errors usually occupy the 100-200 range.
     improper_bug_id_field_value => 100,
     bug_id_does_not_exist       => 101,

diff --git a/Bugzilla/WebService/Util.pm b/Bugzilla/WebService/Util.pm
index 7521006495c339ccce26f4cc8ad3c3610040a78d..d4da2f5751ee3f8ec45440b78a9dc01861bcc623 100644 (file)
--- a/Bugzilla/WebService/Util.pm
+++ b/Bugzilla/WebService/Util.pm
@@ -18,6 +18,7 @@ use Bugzilla::WebService::Constants;
 
 use Storable qw(dclone);
 use URI::Escape qw(uri_unescape);
+use List::MoreUtils qw(any none);
 
 use parent qw(Exporter);
 
@@ -220,15 +221,20 @@ sub validate  {
     # sent any parameters at all, and we're getting @keys where
     # $params should be.
     return ($self, undef) if (defined $params and !ref $params);
-    
+
+    my @id_params = qw(ids comment_ids);
     # If @keys is not empty then we convert any named 
     # parameters that have scalar values to arrayrefs
     # that match.
     foreach my $key (@keys) {
         if (exists $params->{$key}) {
-            $params->{$key} = ref $params->{$key} 
-                              ? $params->{$key} 
-                              : [ $params->{$key} ];
+            $params->{$key} = [ $params->{$key} ] unless ref $params->{$key};
+
+            if (any { $key eq $_ } @id_params) {
+                my $ids = $params->{$key};
+                ThrowCodeError('param_scalar_array_required', { param => $key })
+                  unless ref($ids) eq 'ARRAY' && none { ref $_ } @$ids;
+            }
         }
     }
 

diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index 922ac0cbe29d2e0715effe901d0d337e9d95926f..40abfe5c13389447666ae8787f12b2d878f1daa2 100644 (file)
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -294,6 +294,14 @@
     a <code>[% param FILTER html %]</code> argument, and that
     argument was not set.
 
+  [% ELSIF error == "param_integer_required" %]
+    The function <code>[% function FILTER html %]</code> requires
+    that <code>[% param FILTER html %]</code> be an integer.
+
+  [% ELSIF error == "param_scalar_array_required" %]
+    The <code>[% param FILTER html %]</code> parameter must be an array of scalars
+    (integers and/or strings).
+
   [% ELSIF error == "params_required" %]
     [% title = "Missing Parameter" %]
     The function <code>[% function FILTER html %]</code> requires