From: mkanat%bugzilla.org <>
Date: Wed, 31 May 2006 04:19:09 +0000 (+0000)
Subject: Bug 338573: Auth could throw an insecure dependency error if username is tainted
X-Git-Tag: bugzilla-2.23.2~146
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b70d6c5950e2840db85b0207f715c58708e2e8d;p=thirdparty%2Fbugzilla.git

Bug 338573: Auth could throw an insecure dependency error if username is tainted
Patch By Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=justdave
---

diff --git a/Bugzilla/Auth/Verify.pm b/Bugzilla/Auth/Verify.pm
index da277cefda..68a20f6dfd 100644
--- a/Bugzilla/Auth/Verify.pm
+++ b/Bugzilla/Auth/Verify.pm
@@ -106,10 +106,16 @@ sub create_or_update_user {
         validate_email_syntax($username)
           || return { failure => AUTH_ERROR, error => 'auth_invalid_email',
                       details => {addr => $username} };
+        # Username is more than likely tainted, but we only use it in a
+        # placeholder, and we've already validated it, so it's safe.
+        trick_taint($username);
         $dbh->do('UPDATE profiles SET login_name = ? WHERE userid = ?',
                  $username, $user->id);
     }
     if ($real_name && $user->name ne $real_name) {
+        # $real_name is more than likely tainted, but we only use it
+        # in a placeholder and we never use it after this.
+        trick_taint($real_name);
         $dbh->do('UPDATE profiles SET realname = ? WHERE userid = ?',
                  undef, $real_name, $user->id);
     }