Item9053: Move attachment results in Taint error

Priority: Urgent
Current State: Closed
Released In: 1.1.0
Target Release: minor

Applies To: Engine
Component: TopicAttachment
Branches:

Reported By: GeorgeClark
Waiting For:
Last Change By: GeorgeClark

Attachment move failed
During move of attachment userdata.xml to Trash.TrashAttachment an error was found. Please notify your Foswiki administrator.

Insecure dependency in rename while running with -T switch at /usr/lib/perl5/5.10.1/File/Copy.pm line 271. at /usr/lib/perl5/5.10.1/File/Copy.pm line 271 File::Copy::move('/var/www/SVN/foswiki/core/pub/System/AttachContentPlugin/user...', '/var/www/SVN/foswiki/core/pub/Trash/TrashAttachment/userdata.xml') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/Store/VC/Handler.pm line 809 Foswiki::Store::VC::Handler::moveFile('Foswiki::Store::VC::RcsWrapHandler=HASH(0x873ab30)', '/var/www/SVN/foswiki/core/pub/System/AttachContentPlugin/user...', '/var/www/SVN/foswiki/core/pub/Trash/TrashAttachment/userdata.xml') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/Store/VC/Handler.pm line 602 Foswiki::Store::VC::Handler::moveAttachment('Foswiki::Store::VC::RcsWrapHandler=HASH(0x873ab30)', 'Foswiki::Store::RcsWrap=HASH(0x8557110)', 'Trash', 'TrashAttachment', 'userdata.xml') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/Store/VC/Store.pm line 151 Foswiki::Store::VC::Store::moveAttachment('Foswiki::Store::RcsWrap=HASH(0x8557110)', 'Foswiki::Meta=HASH(0x8741010)', 'userdata.xml', 'Foswiki::Meta=HASH(0x873aca0)', 'userdata.xml', 'BaseUserMapping_333') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/Meta.pm line 2556 Foswiki::Meta::__ANON__() 
called at /var/www/SVN/foswiki/core/lib/CPAN/lib//Error.pm line 379 eval {...} 
called at /var/www/SVN/foswiki/core/lib/CPAN/lib//Error.pm line 371 Error::subs::try('CODE(0x8849780)', 'HASH(0x88610e0)') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/Meta.pm line 2593 Foswiki::Meta::moveAttachment('Foswiki::Meta=HASH(0x8741010)', 'userdata.xml', 'Foswiki::Meta=HASH(0x873aca0)', 'new_name', 'userdata.xml') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/UI/Rename.pm line 738 Foswiki::UI::Rename::__ANON__() 
called at /var/www/SVN/foswiki/core/lib/CPAN/lib//Error.pm line 379 eval {...} 
called at /var/www/SVN/foswiki/core/lib/CPAN/lib//Error.pm line 371 Error::subs::try('CODE(0x873ad70)', 'HASH(0x873ae50)') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/UI/Rename.pm line 749 Foswiki::UI::Rename::_moveTopicOrAttachment('Foswiki=HASH(0x854f9c8)', 'Foswiki::Meta=HASH(0x8741010)', 'Foswiki::Meta=HASH(0x873aca0)', 'userdata.xml', 'userdata.xml', undef) 
called at /var/www/SVN/foswiki/core/lib/Foswiki/UI/Rename.pm line 262 Foswiki::UI::Rename::_renameTopicOrAttachment('Foswiki=HASH(0x854f9c8)', 'System', 'AttachContentPlugin') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/UI/Rename.pm line 66 Foswiki::UI::Rename::rename('Foswiki=HASH(0x854f9c8)') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/UI.pm line 310 Foswiki::UI::__ANON__() 
called at /var/www/SVN/foswiki/core/lib/CPAN/lib//Error.pm line 379 eval {...} 
called at /var/www/SVN/foswiki/core/lib/CPAN/lib//Error.pm line 371 Error::subs::try('CODE(0x85434e8)', 'HASH(0x854f6f8)') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/UI.pm line 427 Foswiki::UI::_execute('Foswiki::Request=HASH(0x8431bf0)', 'CODE(0x8431780)', 'rename', 1) 
called at /var/www/SVN/foswiki/core/lib/Foswiki/UI.pm line 277 Foswiki::UI::handleRequest('Foswiki::Request=HASH(0x8431bf0)') 
called at /var/www/SVN/foswiki/core/lib/Foswiki/Engine/CGI.pm line 30 Foswiki::Engine::CGI::run('Foswiki::Engine::CGI=HASH(0x81e2bd8)') called

Please go back in your browser and try again. 

diff --git a/UnitTestContrib/lib/Unit/Request.pm b/UnitTestContrib/lib/Unit/Request.pm
index 8606879..1d0b878 100644
--- a/UnitTestContrib/lib/Unit/Request.pm
+++ b/UnitTestContrib/lib/Unit/Request.pm
@@ -13,6 +13,50 @@ package Unit::Request;
 use Foswiki::Request;
 our @ISA = qw( Foswiki::Request );
 
+sub _taint_recursively {
+    my ($element) = @_;
+    my $ref = ref $element;
+
+    Assert::TAINT($element);
+    if ($ref eq 'HASH') {
+        foreach my $item (%$element) {
+            print '%';
+            _taint_recursively($item);
+        }
+    } elsif ($ref eq 'ARRAY') {
+        foreach my $item (@$element) {
+            print '@';
+            _taint_recursively($item);
+        }
+    }
+
+    return;
+}
+
+sub new {
+    my $this = shift;
+    $this = $this->SUPER::new(@_);
+    _taint_recursively($this->{action});
+    _taint_recursively($this->{base_action});
+    _taint_recursively($this->{cookies});
+    _taint_recursively($this->{handle});
+    _taint_recursively($this->{headers});
+    _taint_recursively($this->{http});
+    _taint_recursively($this->{method});
+    _taint_recursively($this->{param_list});
+    _taint_recursively($this->{param});
+    _taint_recursively($this->{path_info});
+    _taint_recursively($this->{protocol});
+    _taint_recursively($this->{remote_address});
+    _taint_recursively($this->{remote_user});
+    _taint_recursively($this->{secure});
+    _taint_recursively($this->{server_port});
+    _taint_recursively($this->{uploads});
+    _taint_recursively($this->{uri});
+
+    return $this;
+}
+
 sub setUrl {
     my ( $this, $queryString ) = @_;

FuncTests::test_subweb_attachments
Insecure dependency in open while running with -T switch at /var/www/SVN/foswiki/core/lib/Foswiki/Store/VC/Handler.pm line 778.

Index: /var/www/SVN/foswiki/core/lib/Foswiki/Attach.pm
===================================================================
--- /var/www/SVN/foswiki/core/lib/Foswiki/Attach.pm     (revision 7550)
+++ /var/www/SVN/foswiki/core/lib/Foswiki/Attach.pm     (working copy)
@@ -110,6 +110,8 @@
     my ( $this, $topicObject, %attrs ) = @_;

     my $users = $this->{session}->{users};
+    # SMELL:  This was needed to avoid a taint error.  Foswikitask:Item9053
+    $attrs{name} = Foswiki::Sandbox::normalizeFileName( $attrs{name} );
     my $revIt = $topicObject->getRevisionHistory( $attrs{name} );

     my $templates = $this->{session}->templates;