Bug 714472: (CVE-2012-0448) [SECURITY] utf8 homoglyphs are allowed in email addresses...

r=glob a=LpSolit

diff --git a/Bugzilla/Util.pm b/Bugzilla/Util.pm
index 074b8fefdc2c8192e7ffe2655601598b7c056fe6..285fb32b73f21cdfa0fd6492a2317477c3454cc3 100644 (file)
--- a/Bugzilla/Util.pm
+++ b/Bugzilla/Util.pm
@@ -606,7 +606,7 @@ sub _do_srand {
 sub validate_email_syntax {
     my ($addr) = @_;
     my $match = Bugzilla->params->{'emailregexp'};
-    my $ret = ($addr =~ /$match/ && $addr !~ /[\\\(\)<>&,;:"\[\] \t\r\n]/);
+    my $ret = ($addr =~ /$match/ && $addr !~ /[\\\(\)<>&,;:"\[\] \t\r\n\P{ASCII}]/);
     if ($ret) {
         # We assume these checks to suffice to consider the address untainted.
         trick_taint($_[0]);

diff --git a/editflagtypes.cgi b/editflagtypes.cgi
index 4f85e6c65ea2499fc2bf3612b1cba69195ed8e0d..5b0b708bc721bc0dd5f8935f9f05270d5f133b15 100755 (executable)
--- a/editflagtypes.cgi
+++ b/editflagtypes.cgi
@@ -579,7 +579,7 @@ sub validateCCList {
     # - do not contain any illegal character.
     foreach my $address (@addresses) {
         ($address =~ /^[\w\.\+\-=]+@[\w\.\-]+\.[\w\-]+$/
-           && $address !~ /[\\\(\)<>&,;:"\[\] \t\r\n]/)
+           && $address !~ /[\\\(\)<>&,;:"\[\] \t\r\n\P{ASCII}]/)
           || ThrowUserError('illegal_email_address',
                             {addr => $address, default => 1});
     }

diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index e70f5b2a6771f3ef93af074fe013a678f5fa3018..3db03fca4a1915cfc6bf4a5314042850594ac2d4 100644 (file)
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -66,8 +66,7 @@
     [% ELSE %]
       [%+ Param('emailregexpdesc') %]
     [% END %]
-    It must also not contain any of these special characters:
-    <tt>\ ( ) &amp; &lt; &gt; , ; : &quot; [ ]</tt>, or any whitespace.
+    It also must not contain any illegal characters.
 
   [% ELSIF error == "authres_unhandled" %]
     The result value of [% value FILTER html %] was not handled by

diff --git a/template/en/default/global/user-error.html.tmpl b/template/en/default/global/user-error.html.tmpl
index 39e5d42f77eaf9c8097a47c10724353874345360..76531a24039787df823b9f1ee6c7f50f2afea8bb 100644 (file)
--- a/template/en/default/global/user-error.html.tmpl
+++ b/template/en/default/global/user-error.html.tmpl
@@ -830,9 +830,8 @@
     [% ELSE %]
       [%+ Param('emailregexpdesc') %]
     [% END %]
-    It must also not contain any of these special characters:
-    <tt>\ ( ) &amp; &lt; &gt; , ; : &quot; [ ]</tt>, or any whitespace.
-    
+    It also must not contain any illegal characters.
+
   [% ELSIF error == "illegal_frequency" %]
     [% title = "Too Frequent" %]
     Unless you are an administrator, you may not create series which are