svn commit: r1027098 - in /spamassassin/trunk/lib/Mail/SpamAssassin: Conf/Parser.pm Plugin/Check.pm

[mm...@apache.org]

Author: mmartinec
Date: Mon Oct 25 13:03:00 2010
New Revision: 1027098

URL: http://svn.apache.org/viewvc?rev=1027098&view=rev
Log:
Fix a taint issue which shows when running under a Devel::DProf profiler

Modified:
    spamassassin/trunk/lib/Mail/SpamAssassin/Conf/Parser.pm
    spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Check.pm

Modified: spamassassin/trunk/lib/Mail/SpamAssassin/Conf/Parser.pm
URL: http://svn.apache.org/viewvc/spamassassin/trunk/lib/Mail/SpamAssassin/Conf/Parser.pm?rev=1027098&r1=1027097&r2=1027098&view=diff
==============================================================================
--- spamassassin/trunk/lib/Mail/SpamAssassin/Conf/Parser.pm (original)
+++ spamassassin/trunk/lib/Mail/SpamAssassin/Conf/Parser.pm Mon Oct 25 13:03:00 2010
@@ -492,7 +492,9 @@ sub handle_conditional {
   my $bad = 0;
   foreach my $token (@tokens) {
     if ($token =~ /^(?:\W+|[+-]?\d+(?:\.\d+)?)$/) {
-      $eval .= untaint_var($token) . " ";
+      # using tainted subr. argument may taint the whole expression, avoid
+      my $u = untaint_var($token);
+      $eval .= $u . " ";
     }
     elsif ($token eq 'plugin') {
       # replace with method call
@@ -506,7 +508,8 @@ sub handle_conditional {
       $eval .= $Mail::SpamAssassin::VERSION." ";
     }
     elsif ($token =~ /^\w[\w\:]+$/) { # class name
-      $eval .= '"' . untaint_var($token) . '" ';
+      my $u = untaint_var($token);
+      $eval .= '"' . $u . '" ';
     }
     else {
       $bad++;

Modified: spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Check.pm
URL: http://svn.apache.org/viewvc/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Check.pm?rev=1027098&r1=1027097&r2=1027098&view=diff
==============================================================================
--- spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Check.pm (original)
+++ spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Check.pm Mon Oct 25 13:03:00 2010
@@ -1295,9 +1295,9 @@ EOT
 
 sub hash_line_for_rule {
   my ($self, $pms, $rulename) = @_;
-  return sprintf("\n#line 1 \"%s, rule %s,\"",
-                 untaint_var($pms->{conf}->{source_file}->{$rulename}),
-                 $rulename);
+  # using tainted subr. argument may taint the whole expression, avoid
+  my $u = untaint_var($pms->{conf}->{source_file}->{$rulename});
+  return sprintf("\n#line 1 \"%s, rule %s,\"", $u, $rulename);
 }
 
 sub is_user_rule_sub {