From: Simon Green <sgreen+mozilla@redhat.com>
Date: Thu, 17 May 2012 13:23:35 +0000 (+0200)
Subject: Bug 752751: Perl modules that start with a protocol (eg HTTP::Header) are not escaped... 
X-Git-Tag: bugzilla-4.2.2~23
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5ec002f8c6aaf5dba9039ac8ae5898b07af4afee;p=thirdparty%2Fbugzilla.git

Bug 752751: Perl modules that start with a protocol (eg HTTP::Header) are not escaped correctly in SAFE_URL_REGEXP
r/a=LpSolit
---

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index 527b704b27..c907f92674 100644
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -69,7 +69,7 @@ use constant FORMAT_2_SIZE => [19,55];
 # Pseudo-constant.
 sub SAFE_URL_REGEXP {
     my $safe_protocols = join('|', SAFE_PROTOCOLS);
-    return qr/($safe_protocols):[^\s<>\"]+[\w\/]/i;
+    return qr/($safe_protocols):[^:\s<>\"][^\s<>\"]+[\w\/]/i;
 }
 
 # Convert the constants in the Bugzilla::Constants module into a hash we can