--- Begin Message ---
Package: libcgi-formbuilder-perl
Version: 3.08-2
Severity: normal
Tags: patch
X-Debbugs-Cc: Amitai Schlair <[email protected]>
CGI->param has the misfeature that it is context-sensitive, and in
particular can expand to more than one scalar in function calls.
This led to a security vulnerability in Bugzilla, and recent versions
of CGI.pm will warn when it is used in this way.
% REQUEST_METHOD=GET QUERY_STRING='a=1&a=2&b=3' \
perl -Mstrict -Mwarnings -MCGI \
-e 'my $q = new CGI; my $as = join ",", $q->param("a"); print "$as\n"'
CGI::param called in list context from package main line 1, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a single
named parameter" at /usr/share/perl5/CGI.pm line 436.
1,2
I have checked the CGI::FormBuilder code and I could not find any instances
of this being an actual vulnerability.
The attached patches 0004 to 0007 switch from list-context param('x')
to explicitly list-valued @{param_fetch('x')} to avoid these warnings.
Two of them are from Amitai Schlair via pkgsrc, two are additional
patches from me. They appear to be compatible with all CGI.pm versions
back to at least 2000.
The attached patch "Add-patches-from-pkgsrc-and-an-extra-similar-patch-t.patch"
alters the Debian packaging (based on the version in pkg-perl git) to add
those patches.
Please consider applying these and/or forwarding them upstream.
Thanks,
S
-- System Information:
Debian Release: jessie/sid
APT prefers proposed-updates
APT policy: (500, 'proposed-updates'), (500, 'unstable'), (500, 'testing'),
(500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.16-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages libcgi-formbuilder-perl depends on:
ii perl 5.20.1-2
Versions of packages libcgi-formbuilder-perl recommends:
ii libhtml-parser-perl 3.71-1+b2
Versions of packages libcgi-formbuilder-perl suggests:
ii libcgi-session-perl 4.48-1
pn libcgi-ssi-perl <none>
ii libhtml-template-perl 2.95-1
pn libtemplate-perl <none>
ii libtext-template-perl 1.46-1
-- no debconf information
From 1394d3e2bf9ef4c598801dda3548b91daa7bad68 Mon Sep 17 00:00:00 2001
From: Simon McVittie <[email protected]>
Date: Thu, 16 Oct 2014 10:43:30 +0100
Subject: [PATCH] Add patches from pkgsrc, and an extra similar patch, to avoid
warnings about calling CGI->param in list context with recent CGI.pm
---
debian/changelog | 5 +++++
...nneeded-warning-from-CGI.pm-4.05-or-newer.patch | 22 ++++++++++++++++++++++
...nneeded-warning-from-CGI.pm-4.05-or-newer.patch | 22 ++++++++++++++++++++++
...-use-of-param-that-will-cause-a-warning-i.patch | 21 +++++++++++++++++++++
...t-cgi_param-is-context-sensitive-just-lik.patch | 21 +++++++++++++++++++++
debian/patches/series | 4 ++++
6 files changed, 95 insertions(+)
create mode 100644 debian/patches/0004-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch
create mode 100644 debian/patches/0005-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch
create mode 100644 debian/patches/0006-Fix-another-use-of-param-that-will-cause-a-warning-i.patch
create mode 100644 debian/patches/0007-Comment-that-cgi_param-is-context-sensitive-just-lik.patch
diff --git a/debian/changelog b/debian/changelog
index 0603795..94d3fd4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,7 +1,12 @@
libcgi-formbuilder-perl (3.08-3) UNRELEASED; urgency=medium
+ [ Salvatore Bonaccorso ]
* Update Vcs-Browser URL to cgit web frontend
+ [ Simon McVittie ]
+ * Add patches from pkgsrc, and an extra similar patch, to avoid warnings
+ about calling CGI->param in list context with recent CGI.pm
+
-- Salvatore Bonaccorso <[email protected]> Sat, 16 Aug 2014 09:30:14 +0200
libcgi-formbuilder-perl (3.08-2) unstable; urgency=low
diff --git a/debian/patches/0004-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch b/debian/patches/0004-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch
new file mode 100644
index 0000000..3b0b3ca
--- /dev/null
+++ b/debian/patches/0004-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch
@@ -0,0 +1,22 @@
+From: Amitai Schlair <[email protected]>
+Date: Thu, 16 Oct 2014 10:33:57 +0100
+Subject: Avoid unneeded warning from CGI.pm 4.05 or newer
+
+Origin: http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/www/p5-CGI-FormBuilder/patches/patch-lib_CGI_FormBuilder.pm?rev=1.1&content-type=text/plain
+---
+ lib/CGI/FormBuilder.pm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/CGI/FormBuilder.pm b/lib/CGI/FormBuilder.pm
+index e8fc358..1ac861e 100644
+--- a/lib/CGI/FormBuilder.pm
++++ b/lib/CGI/FormBuilder.pm
+@@ -855,7 +855,7 @@ sub keepextras {
+
+ # Make sure to get all values
+ for my $p (@keep) {
+- for my $v ($self->{params}->param($p)) {
++ for my $v (@{$self->{params}->param_fetch($p)}) {
+ debug 1, "keepextras: saving hidden param $p = $v";
+ push @html, htmltag('input', name => $p, type => 'hidden', value => $v);
+ }
diff --git a/debian/patches/0005-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch b/debian/patches/0005-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch
new file mode 100644
index 0000000..81cfaa9
--- /dev/null
+++ b/debian/patches/0005-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch
@@ -0,0 +1,22 @@
+From: Amitai Schlair <[email protected]>
+Date: Thu, 16 Oct 2014 10:34:45 +0100
+Subject: Avoid unneeded warning from CGI.pm 4.05 or newer
+
+Origin: http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/www/p5-CGI-FormBuilder/patches/patch-lib_CGI_FormBuilder_Field.pm?rev=1.1&content-type=text/plain
+---
+ lib/CGI/FormBuilder/Field.pm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/CGI/FormBuilder/Field.pm b/lib/CGI/FormBuilder/Field.pm
+index 67bbcee..fa08e25 100644
+--- a/lib/CGI/FormBuilder/Field.pm
++++ b/lib/CGI/FormBuilder/Field.pm
+@@ -189,7 +189,7 @@ sub cgi_value {
+ my $self = shift;
+ debug 2, "$self->{name}: called \$field->cgi_value";
+ puke "Cannot set \$field->cgi_value manually" if @_;
+- if (my @v = $self->{_form}{params}->param($self->name)) {
++ if (my @v = @{$self->{_form}{params}->param_fetch($self->name)}) {
+ for my $v (@v) {
+ if ($self->other && $v eq $self->othername) {
+ debug 1, "$self->{name}: redoing value from _other field";
diff --git a/debian/patches/0006-Fix-another-use-of-param-that-will-cause-a-warning-i.patch b/debian/patches/0006-Fix-another-use-of-param-that-will-cause-a-warning-i.patch
new file mode 100644
index 0000000..44c3533
--- /dev/null
+++ b/debian/patches/0006-Fix-another-use-of-param-that-will-cause-a-warning-i.patch
@@ -0,0 +1,21 @@
+From: Simon McVittie <[email protected]>
+Date: Thu, 16 Oct 2014 10:39:16 +0100
+Subject: Fix another use of param that will cause a warning in recent CGI.pm
+
+---
+ lib/CGI/FormBuilder/Multi.pm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/CGI/FormBuilder/Multi.pm b/lib/CGI/FormBuilder/Multi.pm
+index bdc9f45..215f68f 100644
+--- a/lib/CGI/FormBuilder/Multi.pm
++++ b/lib/CGI/FormBuilder/Multi.pm
+@@ -218,7 +218,7 @@ sub navbar {
+ }
+ for my $k (@{$self->{keepextras}}) {
+ next if $k eq $pnam;
+- for my $v ($self->{params}->param($k)) {
++ for my $v (@{$self->{params}->param_fetch($k)}) {
+ push @keep, { name => $k, value => $v };
+ }
+ }
diff --git a/debian/patches/0007-Comment-that-cgi_param-is-context-sensitive-just-lik.patch b/debian/patches/0007-Comment-that-cgi_param-is-context-sensitive-just-lik.patch
new file mode 100644
index 0000000..184affd
--- /dev/null
+++ b/debian/patches/0007-Comment-that-cgi_param-is-context-sensitive-just-lik.patch
@@ -0,0 +1,21 @@
+From: Simon McVittie <[email protected]>
+Date: Thu, 16 Oct 2014 10:40:29 +0100
+Subject: Comment that cgi_param is context-sensitive just like param
+
+---
+ lib/CGI/FormBuilder.pm | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/CGI/FormBuilder.pm b/lib/CGI/FormBuilder.pm
+index 1ac861e..ad322c3 100644
+--- a/lib/CGI/FormBuilder.pm
++++ b/lib/CGI/FormBuilder.pm
+@@ -1175,6 +1175,8 @@ sub required_tag {
+
+ sub cgi_param {
+ my $self = shift;
++ # This returns a scalar or a list, depending on context, like CGI.pm.
++ # For best results, don't call it with a parameter in list context.
+ $self->{params}->param(@_);
+ }
+
diff --git a/debian/patches/series b/debian/patches/series
index 7636b8e..ae55f21 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,7 @@
perl5.18-hashes.patch
pod-encoding.patch
pod-spelling.patch
+0004-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch
+0005-Avoid-unneeded-warning-from-CGI.pm-4.05-or-newer.patch
+0006-Fix-another-use-of-param-that-will-cause-a-warning-i.patch
+0007-Comment-that-cgi_param-is-context-sensitive-just-lik.patch
--
2.1.1
From: Amitai Schlair <[email protected]>
Date: Thu, 16 Oct 2014 10:33:57 +0100
Subject: Avoid unneeded warning from CGI.pm 4.05 or newer
Origin: http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/www/p5-CGI-FormBuilder/patches/patch-lib_CGI_FormBuilder.pm?rev=1.1&content-type=text/plain
---
lib/CGI/FormBuilder.pm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/CGI/FormBuilder.pm b/lib/CGI/FormBuilder.pm
index e8fc358..1ac861e 100644
--- a/lib/CGI/FormBuilder.pm
+++ b/lib/CGI/FormBuilder.pm
@@ -855,7 +855,7 @@ sub keepextras {
# Make sure to get all values
for my $p (@keep) {
- for my $v ($self->{params}->param($p)) {
+ for my $v (@{$self->{params}->param_fetch($p)}) {
debug 1, "keepextras: saving hidden param $p = $v";
push @html, htmltag('input', name => $p, type => 'hidden', value => $v);
}
From: Amitai Schlair <[email protected]>
Date: Thu, 16 Oct 2014 10:34:45 +0100
Subject: Avoid unneeded warning from CGI.pm 4.05 or newer
Origin: http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/www/p5-CGI-FormBuilder/patches/patch-lib_CGI_FormBuilder_Field.pm?rev=1.1&content-type=text/plain
---
lib/CGI/FormBuilder/Field.pm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/CGI/FormBuilder/Field.pm b/lib/CGI/FormBuilder/Field.pm
index 67bbcee..fa08e25 100644
--- a/lib/CGI/FormBuilder/Field.pm
+++ b/lib/CGI/FormBuilder/Field.pm
@@ -189,7 +189,7 @@ sub cgi_value {
my $self = shift;
debug 2, "$self->{name}: called \$field->cgi_value";
puke "Cannot set \$field->cgi_value manually" if @_;
- if (my @v = $self->{_form}{params}->param($self->name)) {
+ if (my @v = @{$self->{_form}{params}->param_fetch($self->name)}) {
for my $v (@v) {
if ($self->other && $v eq $self->othername) {
debug 1, "$self->{name}: redoing value from _other field";
From: Simon McVittie <[email protected]>
Date: Thu, 16 Oct 2014 10:39:16 +0100
Subject: Fix another use of param that will cause a warning in recent CGI.pm
---
lib/CGI/FormBuilder/Multi.pm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/CGI/FormBuilder/Multi.pm b/lib/CGI/FormBuilder/Multi.pm
index bdc9f45..215f68f 100644
--- a/lib/CGI/FormBuilder/Multi.pm
+++ b/lib/CGI/FormBuilder/Multi.pm
@@ -218,7 +218,7 @@ sub navbar {
}
for my $k (@{$self->{keepextras}}) {
next if $k eq $pnam;
- for my $v ($self->{params}->param($k)) {
+ for my $v (@{$self->{params}->param_fetch($k)}) {
push @keep, { name => $k, value => $v };
}
}
From: Simon McVittie <[email protected]>
Date: Thu, 16 Oct 2014 10:40:29 +0100
Subject: Comment that cgi_param is context-sensitive just like param
---
lib/CGI/FormBuilder.pm | 2 ++
1 file changed, 2 insertions(+)
diff --git a/lib/CGI/FormBuilder.pm b/lib/CGI/FormBuilder.pm
index 1ac861e..ad322c3 100644
--- a/lib/CGI/FormBuilder.pm
+++ b/lib/CGI/FormBuilder.pm
@@ -1175,6 +1175,8 @@ sub required_tag {
sub cgi_param {
my $self = shift;
+ # This returns a scalar or a list, depending on context, like CGI.pm.
+ # For best results, don't call it with a parameter in list context.
$self->{params}->param(@_);
}
signature.asc
Description: Digital signature
--- End Message ---
