On 06/12/2011 10:49 AM, Jan Lieskovsky wrote: > Hello, Josh, Steve, vendors, > > It was found that perl-Data-FormValidator, a HTML form user input > validator, used to treat certain invalid fields as valid, when the > untaint_all_constraints directive was used (default for majority of > Data-FormValidator routines). A remote attacker could use this flaw to > bypass perl Taint mode protection mechanism via specially-crafted input > provided to the HTML form. > > Note: Hopefully Damyan, Mark can clarify here, if valid data from > Data-FormValidator are automatically marked as untainted for > perl Taint mode or not. If there still is perl Taint mode > protection check present, even on valid Data-FormValidator > data and it couldn't happen, that tainted data would be passed > further to the script processing, then this is not a security > issue.
I maintain DFV and have looked at this now. The issue was limited to fields whose constraints were defined as regular expressions. To trigger it, it was also required that a unrelated Regex match before the particular field validation happened was successful. In that case, a value could be marked as "valid" when it was invalid, and would also be untainted. I've reviewed a test and fix for this now and am ready to release it. If there is a CVE number about to be assigned, I can wait for that. Thanks for bringing this to my attention. Mark -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
