Bug 990252 - Using the webservices API, passing in certain keys as parameters contain...

r=glob,a=justdave

diff --git a/Bugzilla/WebService/Util.pm b/Bugzilla/WebService/Util.pm
index 7f6d14b597ca36b8915ebf420f4c1061a1391e6b..bb27a0a3317a05f4dcb684850f9d3fd821f9e55a 100644 (file)
--- a/Bugzilla/WebService/Util.pm
+++ b/Bugzilla/WebService/Util.pm
@@ -171,8 +171,9 @@ sub _delete_bad_keys {
             # Making something a hash key always untaints it, in Perl.
             # However, we need to validate our argument names in some way.
             # We know that all hash keys passed in to the WebService will 
-            # match \w+, so we delete any key that doesn't match that.
-            if ($key !~ /^\w+$/) {
+            # match \w+, contain '.' or '-', so we delete any key that
+            # doesn't match that.
+            if ($key !~ /^[\w\.\-]+$/) {
                 delete $item->{$key};
             }
         }