Package: libdata-formvalidator-perl
Version: 4.66-2
Severity: important
Tags: security squeeze sid wheezy upstream
Forwarded: https://rt.cpan.org/Ticket/Display.html?id=61792
If there is a previous match in $&, the validation routine erroneously
returns success:
$ perl <<'EOF'
use Data::FormValidator;
"bug" =~ /b/;
my $result = Data::FormValidator->check(
{ a => 'b' }, # input data
{ # validation profile
untaint_all_constraints => 1,
optional => [ 'a' ],
constraints => {
a => qr/a/, # RE that must match
},
},
);
print $result->success, "\n";
EOF
1
$
The following patch fixes the bug by correcting the check for a
successful match.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
--- a/lib/Data/FormValidator/Results.pm
+++ b/lib/Data/FormValidator/Results.pm
@@ -807,7 +807,7 @@ sub _create_sub_from_RE {
# With methods, the value is the second argument
my $val = $force_method_p ? $_[1] : $_[0];
my ($match) = scalar ($val =~ $re);
- if ($untaint_this && defined $match) {
+ if ($untaint_this && $match) {
# pass the value through a RE that matches anything to untaint
it.
my ($untainted) = ($& =~ m/(.*)/s);
return $untainted;
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
I plan to push this via squeeze-updates, unless the security team
considers it suitable for a DSA.
Cheers!
-- System Information:
Debian Release: wheezy/sid
APT prefers oldstable
APT policy: (500, 'oldstable'), (500, 'unstable'), (500, 'stable'), (1,
'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.39-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=bg_BG.utf8, LC_CTYPE=bg_BG.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages libdata-formvalidator-perl depends on:
ii libemail-valid-perl 0.184-1 Perl module for checking the valid
ii libfile-mmagic-perl 1.27-1 Perl module to guess file type
ii libimage-size-perl 3.230-1 module for determining image sizes
ii libmime-types-perl 1.30-1 Perl extension for determining MIM
ii libperl6-junction-perl 1.40000-1 Perl6 style Junction operators in
ii libregexp-common-perl 2011041701-1 module with common regular express
ii perl 5.12.3-7 Larry Wall's Practical Extraction
Versions of packages libdata-formvalidator-perl recommends:
ii libdate-calc-perl 6.0-2+b1 Perl library for accessing dates
libdata-formvalidator-perl suggests no packages.
-- no debconf information
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
