Bug 1090275: WebServices modules should maintain a whitelist of methods that are...

r=dylan,a=glob

diff --git a/Bugzilla/WebService.pm b/Bugzilla/WebService.pm
index 1bdeb49d1f6641463873dc48f04ed543b66568de..f8081374418a9f30334f94517973ff53896a91c5 100644 (file)
--- a/Bugzilla/WebService.pm
+++ b/Bugzilla/WebService.pm
@@ -27,6 +27,10 @@ use constant LOGIN_EXEMPT => { };
 # Methods that can modify data MUST not be listed here.
 use constant READ_ONLY => ();
 
+# Whitelist of methods that a client is allowed to access when making
+# an API call.
+use constant PUBLIC_METHODS => ();
+
 sub login_exempt {
     my ($class, $method) = @_;
     return $class->LOGIN_EXEMPT->{$method};

diff --git a/Bugzilla/WebService/Bug.pm b/Bugzilla/WebService/Bug.pm
index 3d7ff380455e34ac1d6fd898fd11eaf2e1e8257a..c6217eac1e05ca540016bba84eb48476e21fdd25 100644 (file)
--- a/Bugzilla/WebService/Bug.pm
+++ b/Bugzilla/WebService/Bug.pm
@@ -62,6 +62,27 @@ use constant READ_ONLY => qw(
     search
 );
 
+use constant PUBLIC_METHODS => qw(
+    add_attachment
+    add_comment
+    attachments
+    comments
+    create
+    fields
+    get
+    history
+    legal_values
+    possible_duplicates
+    render_comment
+    search
+    search_comment_tags
+    update
+    update_attachment
+    update_comment_tags
+    update_see_also
+    update_tags
+);
+
 use constant ATTACHMENT_MAPPED_SETTERS => {
     file_name => 'filename',
     summary   => 'description',

diff --git a/Bugzilla/WebService/BugUserLastVisit.pm b/Bugzilla/WebService/BugUserLastVisit.pm
index a29d2633b83beb17381a64bed97d00a1d61625bd..19a56ff46e7decdb405a29a61bf629bb53b0e893 100644 (file)
--- a/Bugzilla/WebService/BugUserLastVisit.pm
+++ b/Bugzilla/WebService/BugUserLastVisit.pm
@@ -18,6 +18,11 @@ use Bugzilla::Error;
 use Bugzilla::WebService::Util qw( validate filter );
 use Bugzilla::Constants;
 
+use constant PUBLIC_METHODS => qw(
+    get
+    update
+);
+
 sub update {
     my ($self, $params) = validate(@_, 'ids');
     my $user = Bugzilla->user;

diff --git a/Bugzilla/WebService/Bugzilla.pm b/Bugzilla/WebService/Bugzilla.pm
index b4ebd55ae443f635f8c72930156d9f560c2f3832..45ef326ac7243de63a8c389374b5f57f500d24ed 100644 (file)
--- a/Bugzilla/WebService/Bugzilla.pm
+++ b/Bugzilla/WebService/Bugzilla.pm
@@ -34,6 +34,15 @@ use constant READ_ONLY => qw(
     version
 );
 
+use constant PUBLIC_METHODS => qw(
+    extensions
+    last_audit_time
+    parameters
+    time
+    timezone
+    version
+);
+
 # Logged-out users do not need to know more than that.
 use constant PARAMETERS_LOGGED_OUT => qw(
     maintainer

diff --git a/Bugzilla/WebService/Classification.pm b/Bugzilla/WebService/Classification.pm
index 8e1b3ae8a6e4f416b6cb9b29e2112a60cb512edd..cee597b68148e5f10d57bef590e8e7b42b2107de 100644 (file)
--- a/Bugzilla/WebService/Classification.pm
+++ b/Bugzilla/WebService/Classification.pm
@@ -21,6 +21,10 @@ use constant READ_ONLY => qw(
     get
 );
 
+use constant PUBLIC_METHODS => qw(
+    get
+);
+
 sub get {
     my ($self, $params) = validate(@_, 'names', 'ids');
 

diff --git a/Bugzilla/WebService/Component.pm b/Bugzilla/WebService/Component.pm
index a050aef53e0c39e273bb4f77fada39f34a4d2fdb..9f3dfb4d4cde6f85a177c9843271efe6255314f1 100644 (file)
--- a/Bugzilla/WebService/Component.pm
+++ b/Bugzilla/WebService/Component.pm
@@ -19,6 +19,10 @@ use Bugzilla::Error;
 use Bugzilla::WebService::Constants;
 use Bugzilla::WebService::Util qw(translate params_to_objects validate);
 
+use constant PUBLIC_METHODS => qw(
+    create
+);
+
 use constant CREATE_MAPPED_FIELDS => {
     default_assignee   => 'initialowner',
     default_qa_contact => 'initialqacontact',

diff --git a/Bugzilla/WebService/FlagType.pm b/Bugzilla/WebService/FlagType.pm
index cf654e6592d3195b2c9e88abe52b9ed36b75d0cd..9723d47358d1fce861d526f0d82eed0f145c126d 100644 (file)
--- a/Bugzilla/WebService/FlagType.pm
+++ b/Bugzilla/WebService/FlagType.pm
@@ -21,6 +21,12 @@ use Bugzilla::Util qw(trim);
 
 use List::MoreUtils qw(uniq);
 
+use constant PUBLIC_METHODS => qw(
+    create
+    get
+    update
+);
+
 sub get {
     my ($self, $params) = @_;
     my $dbh  = Bugzilla->switch_to_shadow_db();

diff --git a/Bugzilla/WebService/Group.pm b/Bugzilla/WebService/Group.pm
index d0ee6fdbad9fd5f0ad5a5c07d5f6421b51d8d728..468575a351966a91884fb90b30c604aa5bc0a580 100644 (file)
--- a/Bugzilla/WebService/Group.pm
+++ b/Bugzilla/WebService/Group.pm
@@ -16,6 +16,12 @@ use Bugzilla::Constants;
 use Bugzilla::Error;
 use Bugzilla::WebService::Util qw(validate translate params_to_objects);
 
+use constant PUBLIC_METHODS => qw(
+    create
+    get
+    update
+);
+
 use constant MAPPED_RETURNS => {
     userregexp => 'user_regexp',
     isactive => 'is_active'

diff --git a/Bugzilla/WebService/Product.pm b/Bugzilla/WebService/Product.pm
index 6330b64025107ec7f65e006cc9099d871336046a..7a3b0fa3e3381aed09be80e0d472facf3cfb2f52 100644 (file)
--- a/Bugzilla/WebService/Product.pm
+++ b/Bugzilla/WebService/Product.pm
@@ -26,6 +26,15 @@ use constant READ_ONLY => qw(
     get_selectable_products
 );
 
+use constant PUBLIC_METHODS => qw(
+    create
+    get
+    get_accessible_products
+    get_enterable_products
+    get_selectable_products
+    update
+);
+
 use constant MAPPED_FIELDS => {
     has_unconfirmed => 'allows_unconfirmed',
     is_open => 'is_active',

diff --git a/Bugzilla/WebService/Server/JSONRPC.pm b/Bugzilla/WebService/Server/JSONRPC.pm
index 6cda47480551c34227e722c7dd3067116655f8cc..0b2995a668c4ad2c2baac421d64e48439c7a03ee 100644 (file)
--- a/Bugzilla/WebService/Server/JSONRPC.pm
+++ b/Bugzilla/WebService/Server/JSONRPC.pm
@@ -31,6 +31,7 @@ use Bugzilla::Util;
 
 use HTTP::Message;
 use MIME::Base64 qw(decode_base64 encode_base64);
+use List::MoreUtils qw(none);
 
 #####################################
 # Public JSON::RPC Method Overrides #
@@ -404,6 +405,11 @@ sub _argument_type_check {
         }
     }
 
+    # Only allowed methods to be used from our whitelist
+    if (none { $_ eq $method} $pkg->PUBLIC_METHODS) {
+        ThrowUserError('unknown_method', { method => $self->bz_method_name });
+    }
+
     # This is the best time to do login checks.
     $self->handle_login();
 

diff --git a/Bugzilla/WebService/Server/XMLRPC.pm b/Bugzilla/WebService/Server/XMLRPC.pm
index 56b31ffefe612552541a6d891f801c5c845375ca..a49ac2033945435e0870e419efd8f5199bd70489 100644 (file)
--- a/Bugzilla/WebService/Server/XMLRPC.pm
+++ b/Bugzilla/WebService/Server/XMLRPC.pm
@@ -20,8 +20,11 @@ if ($ENV{MOD_PERL}) {
 }
 
 use Bugzilla::WebService::Constants;
+use Bugzilla::Error;
 use Bugzilla::Util;
 
+use List::MoreUtils qw(none);
+
 BEGIN {
     # Allow WebService methods to call XMLRPC::Lite's type method directly
     *Bugzilla::WebService::type = sub {
@@ -96,6 +99,14 @@ sub handle_login {
     my ($self, $classes, $action, $uri, $method) = @_;
     my $class = $classes->{$uri};
     my $full_method = $uri . "." . $method;
+    # Only allowed methods to be used from the module's whitelist
+    my $file = $class;
+    $file =~ s{::}{/}g;
+    $file .= ".pm";
+    require $file;
+    if (none { $_ eq $method } $class->PUBLIC_METHODS) {
+        ThrowCodeError('unknown_method', { method => $full_method });
+    }
     $self->SUPER::handle_login($class, $method, $full_method);
     return;
 }

diff --git a/Bugzilla/WebService/User.pm b/Bugzilla/WebService/User.pm
index f3b8bf703d7d96212ff7145196bcb3273a480d95..06698668cb07f470825a76b19b45f5989256e057 100644 (file)
--- a/Bugzilla/WebService/User.pm
+++ b/Bugzilla/WebService/User.pm
@@ -32,6 +32,16 @@ use constant READ_ONLY => qw(
     get
 );
 
+use constant PUBLIC_METHODS => qw(
+    create
+    get
+    login
+    logout
+    offer_account_by_email
+    update
+    valid_login
+);
+
 use constant MAPPED_FIELDS => {
     email => 'login',
     full_name => 'name',

diff --git a/extensions/Example/lib/WebService.pm b/extensions/Example/lib/WebService.pm
index c8c120616680d9f3c6d890faafdae2981f20a644..d8a96b5f5d36b2f01483851830f1582e415b4d9f 100644 (file)
--- a/extensions/Example/lib/WebService.pm
+++ b/extensions/Example/lib/WebService.pm
@@ -13,6 +13,11 @@ use warnings;
 use parent qw(Bugzilla::WebService);
 use Bugzilla::Error;
 
+use constant PUBLIC_METHODS => qw(
+    hello
+    throw_an_error
+);
+
 # This can be called as Example.hello() from the WebService.
 sub hello { return 'Hello!'; }