Attachment 705046 Details for Bug 877015 – Fix ported to perl-5.8.8

[patch] Fix ported to perl-5.8.8

perl-5.8.8-CVE-2012-5526.patch (text/plain), 2.41 KB, created by Petr Pisar on 2013-03-04 15:44:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Petr Pisar

Created: 2013-03-04 15:44:54 UTC

Size: 2.41 KB

patch

obsolete

>From 3950e0ea1b2a017db7beaeaccd39970499418391 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
>Date: Mon, 4 Mar 2013 16:36:34 +0100
>Subject: [PATCH] Escape new-lines in Cookie and P3P headers (CVE-2012-5526)
>
>This is relevant difference between CGI 3.62 and 3.63.
>See <https://bugzilla.redhat.com/show_bug.cgi?id=876974>.
>
>Port for CGI-3.15 bundled in perl-5.8.8.
>---
> lib/CGI.pm | 25 +++++++++++++------------
> 1 file changed, 13 insertions(+), 12 deletions(-)
>
>diff --git a/lib/CGI.pm b/lib/CGI.pm
>index 84641a5..fb2bf2f 100644
>--- a/lib/CGI.pm
>+++ b/lib/CGI.pm
>@@ -1423,8 +1423,18 @@ sub header {
>                             'EXPIRES','NPH','CHARSET',
>                             'ATTACHMENT','P3P'],@p);
> 
>+    # Since $cookie and $p3p may be array references,
>+    # we must stringify them before CR escaping is done.
>+    my @cookie;
>+    for (ref($cookie) eq 'ARRAY' ? @{$cookie} : $cookie) {
>+        my $cs = UNIVERSAL::isa($_,'CGI::Cookie') ? $_->as_string : $_;
>+        push(@cookie,$cs) if defined $cs and $cs ne '';
>+    }
>+    $p3p = join ' ',@$p3p if ref($p3p) eq 'ARRAY';
>+
>+
>     # CR escaping for values, per RFC 822
>-    for my $header ($type,$status,$cookie,$target,$expires,$nph,$charset,$attachment,$p3p,@other) {
>+    for my $header ($type,$status,@cookie,$target,$expires,$nph,$charset,$attachment,$p3p,@other) {
>         if (defined $header) {
>             # From RFC 822:
>             # Unfolding  is  accomplished  by regarding   CRLF   immediately
>@@ -1465,19 +1475,10 @@ sub header {
> 
>     push(@header,"Status: $status") if $status;
>     push(@header,"Window-Target: $target") if $target;
>-    if ($p3p) {
>-       $p3p = join ' ',@$p3p if ref($p3p) eq 'ARRAY';
>-       push(@header,qq(P3P: policyref="/w3c/p3p.xml", CP="$p3p"));
>-    }
>+    push(@header,"P3P: policyref=\"/w3c/p3p.xml\", CP=\"$p3p\"") if $p3p;
>     # push all the cookies -- there may be several
>-    if ($cookie) {
>-	my(@cookie) = ref($cookie) && ref($cookie) eq 'ARRAY' ? @{$cookie} : $cookie;
>-	foreach (@cookie) {
>-            my $cs = UNIVERSAL::isa($_,'CGI::Cookie') ? $_->as_string : $_;
>-	    push(@header,"Set-Cookie: $cs") if $cs ne '';
>-	}
>-    }
>     # if the user indicates an expiration time, then we need
>+    push(@header,map {"Set-Cookie: $_"} @cookie);
>     # both an Expires and a Date header (so that the browser is
>     # uses OUR clock)
>     push(@header,"Expires: " . expires($expires,'http'))
>-- 
>1.8.1.4
>

Actions: View | Diff

Attachments on bug 877015: 646250 | 704881 | 705046