Bug 1811297 - Full Account Takeover on BMO using Github authentication

diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm
index d98c3f3fb9efe721f59d7785fc4b220f3ec68b96..7ae4f68978b2c5123b04922fcb333216efcdfb7a 100644 (file)
--- a/Bugzilla/User.pm
+++ b/Bugzilla/User.pm
@@ -155,7 +155,19 @@ sub new {
       $_[0] = $param;
     }
   }
-  return $class->SUPER::new(@_);
+
+  $user = $class->SUPER::new(@_);
+
+  # MySQL considers some non-ascii characters such as umlauts to equal
+  # ascii characters returning a user when it should not.
+  if ($user && ref $param eq 'HASH' && exists $param->{name}) {
+    my $login = $param->{name};
+    if (lc $login ne lc $user->login) {
+      $user = undef;
+    }
+  }
+
+  return $user;
 }
 
 sub super_user {

diff --git a/extensions/GitHubAuth/lib/Login.pm b/extensions/GitHubAuth/lib/Login.pm
index 15d0cdd4b7aa44c367c17dfd0f7103926491c655..e1f61a6d7bcb6a906163c9ea8c8326ae6e9fc55a 100644 (file)
--- a/extensions/GitHubAuth/lib/Login.pm
+++ b/extensions/GitHubAuth/lib/Login.pm
@@ -17,7 +17,7 @@ use fields qw(github_failure);
 use Scalar::Util qw(blessed);
 
 use Bugzilla::Constants qw(AUTH_NODATA AUTH_ERROR USAGE_MODE_BROWSER);
-use Bugzilla::Util qw(generate_random_password);
+use Bugzilla::Util qw(generate_random_password validate_email_syntax);
 use Bugzilla::Token qw(issue_short_lived_session_token set_token_extra_data);
 use List::MoreUtils qw(any);
 use Bugzilla::Extension::GitHubAuth::Client;
@@ -102,9 +102,15 @@ sub _get_login_info_from_github {
     grep { $_->{verified} && $_->{email} !~ /\@users\.noreply\.github\.com$/ }
     @$emails;
 
+  # Validate each email address similar to if we were creating the account locally
+  my @valid_emails;
+  foreach my $email (@emails) {
+    push @valid_emails, $email if validate_email_syntax($email);
+  }
+
   my @bugzilla_users;
   my @github_emails;
-  foreach my $email (@emails) {
+  foreach my $email (@valid_emails) {
     my $user = Bugzilla::User->new({name => $email, cache => 1});
     if ($user) {
       push @bugzilla_users, $user;