diff options
author | Frédéric Buclin <LpSolit@gmail.com> | 2016-03-19 17:33:48 +0100 |
---|---|---|
committer | Frédéric Buclin <LpSolit@gmail.com> | 2016-03-19 17:33:48 +0100 |
commit | 6e0182e55396213869186764abb1620dcbf307f0 (patch) | |
tree | 9f5157d8ace42ea7d8650e8879e05fab3e40eee7 /Bugzilla/WebService/Util.pm | |
parent | 1c5ecdf1c8d11dbd47f1361bc11565d1175c81bd (diff) | |
download | bugs-6e0182e55396213869186764abb1620dcbf307f0.tar bugs-6e0182e55396213869186764abb1620dcbf307f0.tar.gz bugs-6e0182e55396213869186764abb1620dcbf307f0.tar.bz2 bugs-6e0182e55396213869186764abb1620dcbf307f0.tar.xz bugs-6e0182e55396213869186764abb1620dcbf307f0.zip |
Bug 1230932: Providing a condition as an ID to the webservice results in a taint error
r/a=dkl
Diffstat (limited to 'Bugzilla/WebService/Util.pm')
-rw-r--r-- | Bugzilla/WebService/Util.pm | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/Bugzilla/WebService/Util.pm b/Bugzilla/WebService/Util.pm index 26a6ebbb0..a879c0e0d 100644 --- a/Bugzilla/WebService/Util.pm +++ b/Bugzilla/WebService/Util.pm @@ -16,6 +16,7 @@ use Bugzilla::FlagType; use Bugzilla::Error; use Storable qw(dclone); +use List::MoreUtils qw(any none); use parent qw(Exporter); @@ -220,14 +221,19 @@ sub validate { # $params should be. return ($self, undef) if (defined $params and !ref $params); + my @id_params = qw(ids comment_ids); # If @keys is not empty then we convert any named # parameters that have scalar values to arrayrefs # that match. foreach my $key (@keys) { if (exists $params->{$key}) { - $params->{$key} = ref $params->{$key} - ? $params->{$key} - : [ $params->{$key} ]; + $params->{$key} = [ $params->{$key} ] unless ref $params->{$key}; + + if (any { $key eq $_ } @id_params) { + my $ids = $params->{$key}; + ThrowCodeError('param_scalar_array_required', { param => $key }) + unless ref($ids) eq 'ARRAY' && none { ref $_ } @$ids; + } } } |