You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by Tomasz Potega <tp...@wp-sa.pl> on 2014/02/20 16:13:12 UTC
untaint_var() broken for undefined variables?
Hello all,
I have run into some problems trying to upgrade to 3.4.0.
The '-x' ('--nouser-config') option of spamd doesn't seem to work
correctly.
Tracing the spamd child process I can see it tries to open a user_prefs
file of the pattern (absolute path):
spamc_user_name/.spamassassin/user_prefs
As '-x' is in effect, there will be no $userdir set in
handle_user_setuid_basic().
That's OK. But handle_user_set_user_prefs() ends up called with the
user name in place of the directory name.
The cause can be traced to changes in untaint_var() - instead of
returning undef for $userdir, it just... returns, shifting the
arguments.
Shouldn't the code read more like:
--- Util.pm.orig 2014-02-07 09:36:28.000000000 +0100
+++ Util.pm 2014-02-20 14:47:09.879293333 +0100
@@ -285,7 +285,7 @@
my $r = ref $_[0];
if (!$r) {
no re 'taint'; # override a "use re 'taint'" from outer scope
- return if !defined $_[0];
+ return undef if !defined $_[0];
local($1); # avoid Perl taint bug: tainted global $1 propagates
taintedness
$_[0] =~ /^(.*)\z/s;
return $1;
?
Thanks,
Tomasz Potęga
[Wirtualna Polska]
<http://www.wp.pl>
Znajdziesz nas tutaj:
[Wp na Facebooku] <https://www.facebook.com/WirtualnaPolska>
[Wp na Twitterze] <https://twitter.com/wirtualnapolska>
[Wp na SlideShare] <http://www.slideshare.net/wirtualnapolska>
[Wp w Google+] <https://plus.google.com/+wppl>
[Wp na YouTube] <https://www.youtube.com/user/wptvwppl>
"WIRTUALNA POLSKA" Spółka Akcyjna z siedzibą w Gdańsku przy ul. Traugutta 115 C, wpisana do Krajowego Rejestru Sądowego - Rejestru Przedsiębiorców prowadzonego przez Sąd Rejonowy Gdańsk - Północ w Gdańsku pod numerem KRS 0000068548, o kapitale zakładowym 67.980.024,00 złotych opłaconym w całości oraz Numerze Identyfikacji Podatkowej 957-07-51-216.
Re: untaint_var() broken for undefined variables?
Posted by Tomasz Potęga <tp...@wp-sa.pl>.
W dniu 20.02.2014 17:23, Mark Martinec pisze:
> Please open a bug report.
Thanks to Kevin (Bug 7015) and you, great to have it fixed upstream :)
Best regards,
Tomasz
[Wirtualna Polska]
<http://www.wp.pl>
Znajdziesz nas tutaj:
[Wp na Facebooku] <https://www.facebook.com/WirtualnaPolska>
[Wp na Twitterze] <https://twitter.com/wirtualnapolska>
[Wp na SlideShare] <http://www.slideshare.net/wirtualnapolska>
[Wp w Google+] <https://plus.google.com/+wppl>
[Wp na YouTube] <https://www.youtube.com/user/wptvwppl>
"WIRTUALNA POLSKA" Spółka Akcyjna z siedzibą w Gdańsku przy ul. Traugutta 115 C, wpisana do Krajowego Rejestru Sądowego - Rejestru Przedsiębiorców prowadzonego przez Sąd Rejonowy Gdańsk - Północ w Gdańsku pod numerem KRS 0000068548, o kapitale zakładowym 67.980.024,00 złotych opłaconym w całości oraz Numerze Identyfikacji Podatkowej 957-07-51-216.
Re: untaint_var() broken for undefined variables?
Posted by Mark Martinec <Ma...@ijs.si>.
2014-02-20 Tomasz Potega wrote:
> I have run into some problems trying to upgrade to 3.4.0.
> The '-x' ('--nouser-config') option of spamd doesn't seem to work
> correctly.
>
> Tracing the spamd child process I can see it tries to open a user_prefs
> file of the pattern (absolute path):
[...]
> The cause can be traced to changes in untaint_var() - instead of
> returning undef for $userdir, it just... returns, shifting the
> arguments.
>
> Shouldn't the code read more like:
> --- Util.pm.orig 2014-02-07 09:36:28.000000000 +0100
> +++ Util.pm 2014-02-20 14:47:09.879293333 +0100
> - return if !defined $_[0];
> + return undef if !defined $_[0];
Agreed, it's a bug. Your fix is alright.
While in most other calls it does not matter, in this case it is wrong.
Please open a bug report.
Probably this happened for taking some advise from Perl::Critic
too literally.
Mark