#578: Unvalidated arguments are left behind by non-required validators if those
have multiple arguments and did not run
------------------------+---------------------------------------------------
Reporter: david | Owner: dominik
Type: defect | Status: new
Priority: normal | Milestone: 0.11
Component: validation | Version: 0.11.0RC5
Severity: minor | Resolution:
Keywords: |
------------------------+---------------------------------------------------
Old description:
> An example:
>
> {{{
> <validator class="equals" name="sansgleich" required="false"
> provides="fieldsequal">
> <argument>field1</argument>
> <argument>field2</argument>
> <error>Fields not equal</error>
> </validator>
>
> <validator class="regex" name="importantregexp" depends="fieldsequal">
> <argument>field1</argument>
> <parameter
> name="pattern">veryimportantregexthatpreventshugesecurityissue</parameter>
> </validator>
> }}}
>
> Now if {{{field1}}} has a value, and {{{field2}}} does not, then regex is
> never executed. Of course, in this case, the action is not executed, but
> still, {{{field1}}} is left behind in the request data, and potentially
> dangerous.
New description:
An example:
{{{
<validator class="equals" name="fieldsequal" required="false"
provides="fieldsequal">
<argument>field1</argument>
<argument>field2</argument>
<error>Fields not equal</error>
</validator>
<validator class="regex" name="importantregexp" depends="fieldsequal">
<argument>field1</argument>
<parameter
name="pattern">veryimportantregexthatpreventshugesecurityissue</parameter>
</validator>
}}}
Now if {{{field1}}} has a value, and {{{field2}}} does not, then regex is
never executed. Of course, in this case, the action is not executed, but
still, {{{field1}}} is left behind in the request data, and potentially
dangerous.
--
Ticket URL: <http://trac.agavi.org/ticket/578#comment:1>
Agavi <http://www.agavi.org/>
An MVC Framework for PHP5
_______________________________________________
Agavi Tickets Mailing List
[email protected]
http://lists.agavi.org/mailman/listinfo/tickets
