Skip to content

bugzilla
bugzilla
Commit 901c2d3a authored by justdave%syndicomm.com's avatar justdave%syndicomm.com
Browse files
Options

Bug 197153: Fix for insecure temporary filename handling.

Patch by Brad Baetz <bbaetz@acm.org> r= justdave, gerv a= justdave
parent e9841817
Hide whitespace changes
Inline Side-by-side
Showing with 59 additions and 43 deletions
checksetup.pl
View file @ 901c2d3a
......@@ -873,14 +873,13 @@ END
# Restrict access to .dot files to the public webdot server at research.att.com
# if research.att.com ever changed their IP, or if you use a different
# webdot server, you'll need to edit this
<FilesMatch ^[0-9]+\.dot$>
<FilesMatch \.dot$>
Allow from 192.20.225.10
Deny from all
</FilesMatch>
# Allow access by a local copy of 'dot' to .png, .gif, .jpg, and
# .map files
<FilesMatch ^[0-9]+\.(png|gif|jpg|map)$>
# Allow access to .png files created by a local copy of 'dot'
<FilesMatch \.png$>
Allow from all
</FilesMatch>
......
defparams.pl
View file @ 901c2d3a
......@@ -99,7 +99,7 @@ sub check_webdotbase {
# Check .htaccess allows access to generated images
if(-e "data/webdot/.htaccess") {
open HTACCESS, "data/webdot/.htaccess";
if(! grep(/png/,<HTACCESS>)) {
if(! grep(/ \\\.png\$/,<HTACCESS>)) {
return "Dependency graph images are not accessible.\nDelete data/webdot/.htaccess and re-run checksetup.pl to rectify.\n";
}
close HTACCESS;
......
globals.pl
View file @ 901c2d3a
......@@ -237,19 +237,21 @@ sub GenerateVersionTable {
my @list = sort { uc($a) cmp uc($b)} keys(%::versions);
@::legal_product = @list;
my $tmpname = "data/versioncache.$$";
open(FID, ">$tmpname") || die "Can't create $tmpname";
print FID "#\n";
print FID "# DO NOT EDIT!\n";
print FID "# This file is automatically generated at least once every\n";
print FID "# hour by the GenerateVersionTable() sub in globals.pl.\n";
print FID "# Any changes you make will be overwritten.\n";
print FID "#\n";
require File::Temp;
my ($fh, $tmpname) = File::Temp::tempfile("versioncache.XXXXX",
DIR => "data");
print $fh "#\n";
print $fh "# DO NOT EDIT!\n";
print $fh "# This file is automatically generated at least once every\n";
print $fh "# hour by the GenerateVersionTable() sub in globals.pl.\n";
print $fh "# Any changes you make will be overwritten.\n";
print $fh "#\n";
require Data::Dumper;
print FID Data::Dumper->Dump([\@::log_columns, \%::versions],
['*::log_columns', '*::versions']);
print($fh,Data::Dumper->Dump([\@::log_columns, \%::versions],
['*::log_columns', '*::versions']));
foreach my $i (@list) {
if (!defined $::components{$i}) {
......@@ -257,23 +259,23 @@ sub GenerateVersionTable {
}
}
@::legal_versions = sort {uc($a) cmp uc($b)} keys(%varray);
print FID Data::Dumper->Dump([\@::legal_versions, \%::components],
['*::legal_versions', '*::components']);
print($fh,Data::Dumper->Dump([\@::legal_versions, \%::components],
['*::legal_versions', '*::components']));
@::legal_components = sort {uc($a) cmp uc($b)} keys(%carray);
print FID Data::Dumper->Dump([\@::legal_components, \@::legal_product,
print($fh,Data::Dumper->Dump([\@::legal_components, \@::legal_product,
\@::legal_priority, \@::legal_severity,
\@::legal_platform, \@::legal_opsys,
\@::legal_bug_status, \@::legal_resolution],
['*::legal_components', '*::legal_product',
'*::legal_priority', '*::legal_severity',
'*::legal_platform', '*::legal_opsys',
'*::legal_bug_status', '*::legal_resolution']);
'*::legal_bug_status', '*::legal_resolution']));
print FID Data::Dumper->Dump([\@::settable_resolution, \%::proddesc,
print($fh,Data::Dumper->Dump([\@::settable_resolution, \%::proddesc,
\@::enterable_products, \%::prodmaxvotes],
['*::settable_resolution', '*::proddesc',
'*::enterable_products', '*::prodmaxvotes']);
'*::enterable_products', '*::prodmaxvotes']));
if ($dotargetmilestone) {
# reading target milestones in from the database - matthew@zeroknowledge.com
......@@ -296,12 +298,12 @@ sub GenerateVersionTable {
}
}
print FID Data::Dumper->Dump([\%::target_milestone,
print($fh,Data::Dumper->Dump([\%::target_milestone,
\@::legal_target_milestone,
\%::milestoneurl],
['*::target_milestone',
'*::legal_target_milestone',
'*::milestoneurl']);
'*::milestoneurl']));
}
SendSQL("SELECT id, name FROM keyworddefs ORDER BY name");
......@@ -312,11 +314,11 @@ sub GenerateVersionTable {
$::keywordsbyname{$name} = $id;
}
print FID Data::Dumper->Dump([\@::legal_keywords, \%::keywordsbyname],
['*::legal_keywords', '*::keywordsbyname']);
print($fh,Data::Dumper->Dump([\@::legal_keywords, \%::keywordsbyname],
['*::legal_keywords', '*::keywordsbyname']));
print FID "1;\n";
close FID;
print $fh "1;\n";
close $fh;
rename $tmpname, "data/versioncache" || die "Can't rename $tmpname to versioncache";
ChmodDataFile('data/versioncache', 0666);
......
showdependencygraph.cgi
View file @ 901c2d3a
......@@ -25,6 +25,8 @@ use strict;
use lib qw(.);
use File::Temp;
require "CGI.pl";
ConnectToDatabase();
......@@ -62,11 +64,11 @@ sub CreateImagemap {
}
sub AddLink {
my ($blocked, $dependson) = (@_);
my ($blocked, $dependson, $fh) = (@_);
my $key = "$blocked,$dependson";
if (!exists $edgesdone{$key}) {
$edgesdone{$key} = 1;
print DOT "$blocked -> $dependson\n";
print $fh "$blocked -> $dependson\n";
$seen{$blocked} = 1;
$seen{$dependson} = 1;
}
......@@ -78,12 +80,13 @@ if (!defined($::FORM{'id'}) && !defined($::FORM{'doall'})) {
ThrowCodeError("missing_bug_id");
}
my $filename = "data/webdot/$$.dot";
my ($fh, $filename) = File::Temp::tempfile("XXXXXXXXXX",
SUFFIX => '.dot',
DIR => "data/webdot");
my $urlbase = Param('urlbase');
open(DOT, ">$filename") || die "Can't create $filename";
print DOT "digraph G {";
print DOT qq{
print $fh "digraph G {";
print $fh qq{
graph [URL="${urlbase}query.cgi", rankdir=$::FORM{'rankdir'}, size="64,64"]
node [URL="${urlbase}show_bug.cgi?id=\\N", style=filled, color=lightgrey]
};
......@@ -95,7 +98,7 @@ if ($::FORM{'doall'}) {
while (MoreSQLData()) {
my ($blocked, $dependson) = FetchSQLData();
AddLink($blocked, $dependson);
AddLink($blocked, $dependson, $fh);
}
} else {
foreach my $i (split('[\s,]+', $::FORM{'id'})) {
......@@ -119,7 +122,7 @@ if ($::FORM{'doall'}) {
push @stack, $dependson;
}
AddLink($blocked, $dependson);
AddLink($blocked, $dependson, $fh);
}
}
......@@ -159,15 +162,15 @@ foreach my $k (keys(%seen)) {
}
if (@params) {
print DOT "$k [" . join(',', @params) . "]\n";
print $fh "$k [" . join(',', @params) . "]\n";
} else {
print DOT "$k\n";
print $fh "$k\n";
}
}
print DOT "}\n";
close DOT;
print $fh "}\n";
close $fh;
chmod 0777, $filename;
......@@ -180,11 +183,23 @@ if ($webdotbase =~ /^https?:/) {
$vars->{'map_url'} = $url . ".map";
} else {
# Local dot installation
my $pngfilename = "data/webdot/$$.png";
my $mapfilename = "data/webdot/$$.map";
system("$webdotbase","-Tpng","-o","$pngfilename","$filename");
my $dotfh;
my ($pngfh, $pngfilename) = File::Temp::tempfile("XXXXXXXXXX",
SUFFIX => '.png',
DIR => 'data/webdot');
open (DOT, '-|') or exec ($webdotbase, "-Tpng", $filename);
print $pngfh $_ while <DOT>;
close DOT;
close $pngfh;
$vars->{'image_url'} = $pngfilename;
system("$webdotbase","-Tismap","-o","$mapfilename","$filename");
my ($mapfh, $mapfilename) = File::Temp::tempfile("XXXXXXXXXX",
SUFFIX => '.map',
DIR => 'data/webdot');
open (DOT, '-|') or exec ($webdotbase, "-Tismap", $filename);
print $mapfh $_ while <DOT>;
close DOT;
close $mapfh;
$vars->{'image_map'} = CreateImagemap($mapfilename);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment