[Bug web/50297] New: Bugzilla suffers an internal error

[Bug web/50297] New: Bugzilla suffers an internal error

[d.g.gorbachev at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50297

             Bug #: 50297
           Summary: Bugzilla suffers an internal error
    Classification: Unclassified
           Product: gcc
           Version: unknown
               URL: http://gcc.gnu.org/PR48333
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: web
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: d.g.gorbachev@gmail.com


Trying to access that bug report, I receive:

undef error - Insecure dependency in parameter 3 of
DBI::db=HASH(0x9c9091c)->selectrow_hashref method call while running with -T
switch at Bugzilla/Object.pm line 93.

It only happens when I'm not logged in to Bugzilla.

[Bug web/50297] Bugzilla suffers an internal error

[LpSolit at netscape dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50297

Frédéric Buclin <LpSolit at netscape dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011-09-28
                 CC|                            |LpSolit at netscape dot net
     Ever Confirmed|0                           |1
           Severity|normal                      |critical

--- Comment #1 from Frédéric Buclin <LpSolit at netscape dot net> 2011-09-28 18:01:05 UTC ---
Confirmed. I'll investigate.

[Bug web/50297] Bugzilla suffers an internal error

[LpSolit at netscape dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50297

--- Comment #2 from Frédéric Buclin <LpSolit at netscape dot net> 2011-09-28 18:28:31 UTC ---
I just enabled Bugzilla debug mode, and the relevant error is:

undef error - Insecure dependency in parameter 3 of
DBI::db=HASH(0xb097df4)->selectrow_hashref method call while running with -T
switch at Bugzilla/Object.pm line 93. at Bugzilla/Object.pm line 93
Bugzilla::Object::_init('Bugzilla::Attachment', 23798) called at
Bugzilla/Object.pm line 58 Bugzilla::Object::new('Bugzilla::Attachment', 23798)
called at Bugzilla/Template.pm line 274
Bugzilla::Template::get_attachment_link(23798, 'attachment 23798') called at
Bugzilla/Template.pm line 230 Bugzilla::Template::quoteUrls('Created attachment
23798\x{a}partially reduced testcase\x{a}\x{a}Compiler...',
'Bugzilla::Bug=HASH(0xb180258)', 'Bugzilla::Comment=HASH(0xb3a22a4)') called at
Bugzilla/Template.pm line 698 Bugzilla::Template::__ANON__('Created attachment
23798\x{a}partially reduced testcase\x{a}\x{a}Compiler...') called at
template/en/default/bug/comments.html.tmpl line 188 eval {...} called at
template/en/default/bug/comments.html.tmpl line 121

[Bug web/50297] Bugzilla suffers an internal error

[LpSolit at netscape dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50297

--- Comment #3 from Frédéric Buclin <LpSolit at netscape dot net> 2011-09-28 19:19:28 UTC ---
This is totally crazy. Perl complains that the attachment ID is tainted if you
are logged out, but not if you are logged in. And the error comes right *after*
a call to detaint_natural(), whose job is to detaint the data!! I suspect this
is a bug in Perl 5.8.5 itself. I cannot reproduce with Perl 5.12.3.

[Bug web/50297] Bugzilla suffers a taint issue when viewing bug 48333 while being logged out

[LpSolit at netscape dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50297

Frédéric Buclin <LpSolit at netscape dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Bugzilla suffers an         |Bugzilla suffers a taint
                   |internal error              |issue when viewing bug
                   |                            |48333 while being logged
                   |                            |out
           Severity|critical                    |major

--- Comment #4 from Frédéric Buclin <LpSolit at netscape dot net> 2011-09-28 19:38:40 UTC ---
The error doesn't occur with all bugs having attachments in them. For instance,
I could view bug 28382 without any problem. So the good news is that this
problem seems to affect a few bugs at most.

[Bug web/50297] Bugzilla suffers a taint issue when viewing bug 48333 while being logged out

[LpSolit at netscape dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50297

Frédéric Buclin <LpSolit at netscape dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |LpSolit at netscape dot net
                   |gnu.org                     |

--- Comment #5 from Frédéric Buclin <LpSolit at netscape dot net> 2011-09-29 22:22:56 UTC ---
Created attachment 25385
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25385
Ugly hack

Here is a ugly hack which fixes the problem. This code is not necessary on my
local installations so this is not something I'm going to apply upstream (but
you don't care).

[Bug web/50297] Bugzilla suffers a taint issue when viewing bug 48333 while being logged out

[LpSolit at netscape dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50297

Frédéric Buclin <LpSolit at netscape dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #6 from Frédéric Buclin <LpSolit at netscape dot net> 2011-09-29 22:23:27 UTC ---
I fixed both Sources and GCC Bugzilla.