[Issue 224] security vulnerability when using verifymsg, loginfo etc and perl

https://ccvs.cvshome.org/issues/show_bug.cgi?id=224



User dprice changed the following:

                What    |Old value                 |New value
================================================================================
                  Status|NEW                       |RESOLVED
--------------------------------------------------------------------------------
              Resolution|                          |FIXED
--------------------------------------------------------------------------------




------- Additional comments from [email protected] Thu Apr 14 07:36:42 -0700 2005 -------
Craig, without actually looking at your script, it is possible that it was
written to be robust about missing modules, e.g. running with an alternate
module or with some functionality disabled if a module is found to be missing. 
In such a case, you might not see an error message and still remain vulnerable
to this problem.

.... ---- .....

I've committed the following fixes, noting the problem in the NEWS file, the
manual, and correcting all the contrib Perl scripts to run in taint mode, though
this probably breaks them.  I am closing this issue anyhow, since the now broken
contrib scripts should be reopened as a separate issue.

2005-04-14  Derek Price  <[email protected]>

        * NEWS: Note contrib Perl taint vulnerability fix.

2005-04-14  Derek Price  <[email protected]>

        * cvs.texinfo (Administrative files): Add "Trigger Scripts" node to
        the menu.
        (Trigger Scripts, Trigger Script Security): New nodes.
        (syntax): Move under Trigger scripts node.
        (commit files, taginfo): Rewrite to reference Trigger Script node.

2005-04-14  Derek Price  <[email protected]>

        * commit_prep.in, cvs_acls.in, log.in, log_accum.in, mfpipe.in,
        rcslock.in: Enable taint checking and comment.  This closes cvshome.org
        Issue #224.