Closed Bug 39536 Opened 25 years ago Closed 23 years ago

showdependencytree.cgi needs to validate "id" param

Categories

(Bugzilla :: Bugzilla-General, defect, P3)

Product:
Bugzilla
Component:
Bugzilla-General
Platform:
Other
Other
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
Bugzilla 2.14

People

(Reporter: jruderman, Assigned: myk)

References

Details

(Whiteboard: security)

showdependencytree.cgi feeds an unchecked "id" parameter to the person viewing the page and also to the sql server. Replace: my $id = $::FORM{'id'}; my $linkedid = qq{<a href="show_bug.cgi?id=$id">$id</a>}; With: my $id = $::FORM{'id'}; die "Invalid id: $id" unless $id =~ /^\s*\d+\s*$/; my $linkedid = qq{<a href="show_bug.cgi?id=$id">$id</a>}; (i don't actually know perl. "die" line copied from showdependencygraph.cgi.)
Blocks: 38852
Whiteboard: 2.14
Whiteboard: 2.14 → 2.14,security
moving to real milestones...
Whiteboard: 2.14,security → security
Target Milestone: --- → Bugzilla 2.14
The patch for bug 39531 also fixes this bug. Reassigning to myself and setting dependency.
Assignee: tara → myk
Depends on: 39531
accepting
Status: NEW → ASSIGNED
Resolving this fixed since the patch for bug 39531 was checked in and has fixed this bug.
Status: ASSIGNED → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
Moving to Bugzilla product
Component: Bugzilla → Bugzilla-General
Product: Webtools → Bugzilla
Version: other → unspecified
QA Contact: matty_is_a_geek → default-qa
You need to log in before you can comment on or make changes to this bug.