Bug 338573: Auth could throw an insecure dependency error if username is tainted

Patch By Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=justdave

diff --git a/Bugzilla/Auth/Verify.pm b/Bugzilla/Auth/Verify.pm
index da277cefda4974a053a914b81647e7ee964bec27..68a20f6dfda83fc5547987656eca2a9b596be39d 100644 (file)
--- a/Bugzilla/Auth/Verify.pm
+++ b/Bugzilla/Auth/Verify.pm
@@ -106,10 +106,16 @@ sub create_or_update_user {
         validate_email_syntax($username)
           || return { failure => AUTH_ERROR, error => 'auth_invalid_email',
                       details => {addr => $username} };
+        # Username is more than likely tainted, but we only use it in a
+        # placeholder, and we've already validated it, so it's safe.
+        trick_taint($username);
         $dbh->do('UPDATE profiles SET login_name = ? WHERE userid = ?',
                  $username, $user->id);
     }
     if ($real_name && $user->name ne $real_name) {
+        # $real_name is more than likely tainted, but we only use it
+        # in a placeholder and we never use it after this.
+        trick_taint($real_name);
         $dbh->do('UPDATE profiles SET realname = ? WHERE userid = ?',
                  undef, $real_name, $user->id);
     }