From 23a4baa8ca8d4c974e4db2a3827cf55455bf512f Mon Sep 17 00:00:00 2001 From: Reed Loden Date: Mon, 24 Jan 2011 10:15:49 -0800 Subject: [PATCH] Bug 621572: (CVE-2010-4572) [SECURITY] chart.cgi vulnerable to header-injection due to use of |print "Location:"| instead of $cgi->redirect [r=mkanat a=LpSolit] --- chart.cgi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/chart.cgi b/chart.cgi index 5da0d7b22c..f3f5f5c611 100755 --- a/chart.cgi +++ b/chart.cgi @@ -65,8 +65,8 @@ local our $vars = {}; # Go back to query.cgi if we are adding a boolean chart parameter. if (grep(/^cmd-/, $cgi->param())) { my $params = $cgi->canonicalise_query("format", "ctype", "action"); - print "Location: query.cgi?format=" . $cgi->param('query_format') . - ($params ? "&$params" : "") . "\n\n"; + print $cgi->redirect("query.cgi?format=" . $cgi->param('query_format') . + ($params ? "&$params" : "")); exit; } @@ -89,7 +89,7 @@ $action ||= "assemble"; # Go to buglist.cgi if we are doing a search. if ($action eq "search") { my $params = $cgi->canonicalise_query("format", "ctype", "action"); - print "Location: buglist.cgi" . ($params ? "?$params" : "") . "\n\n"; + print $cgi->redirect("buglist.cgi" . ($params ? "?$params" : "")); exit; } -- 2.47.2