[FFmpeg-cvslog] [ffmpeg-fateserver] branch master updated. 0618f75 Add missing validation of out of process data

[ffmpeg-git at ffmpeg.org]

The branch, master has been updated
       via  0618f7564ab01bddde942477d2a9da83e0f987a3 (commit)
       via  79bfde568cd9dc818e930dbc592d184e312d6c1d (commit)
      from  e8b609c0515c6574a9bd4a0a5edd5f8f7482dc4d (commit)


- Log -----------------------------------------------------------------
commit 0618f7564ab01bddde942477d2a9da83e0f987a3
Author:     Martin Storsjö <martin at martin.st>
AuthorDate: Tue Sep 7 14:19:22 2021 +0300
Commit:     Nicolas George <george at nsup.org>
CommitDate: Tue Sep 7 15:58:09 2021 +0200

    Add missing validation of out of process data
    
    When invoking unxz, the variables making up the path
    passed to unxz need to be validated.
    
    load_summary normally only reads the "summary" file, but
    if missing, it tries to use unxz to unpack report.xz. In
    this case the slot value needs to be validated, which can
    be done in the main loop in index.cgi.
    
    load_report uses unxz, with a slot and date read from
    the summary file, when the report contained failures.
    In this case, the slot and date values can either be
    validated as they're read from the summary in load_summary
    or split_header, or before they're used in load_report.
    
    This unbreaks the main results listings for slots with one or
    more test failures.

diff --git a/FATE.pm b/FATE.pm
index b7d7260..ccb8958 100644
--- a/FATE.pm
+++ b/FATE.pm
@@ -147,6 +147,8 @@ sub load_summary {
 
 sub load_report {
     my ($slot, $date) = @_;
+    ($slot) = $slot =~ /^([A-Za-z0-9_\-.]{1,80})\z/ or exit 1;
+    ($date) = $date =~ /^([0-9]{1,80})\z/ or exit 1;
     my $report = "$fatedir/$slot/$date/report.xz";
     my @recs;
 
diff --git a/index.cgi b/index.cgi
index 8fe92db..c053d0e 100755
--- a/index.cgi
+++ b/index.cgi
@@ -47,6 +47,7 @@ my $allpass = 0;
 my $allfail = 0;
 
 for my $slot (@slots) {
+    ($slot) = $slot =~ /^([A-Za-z0-9_\-.]{1,80})\z/ or next;
     next if -e "$fatedir/$slot/hidden";
     my $rep = load_summary $slot, 'latest' or next;
     next if time - parse_date($$rep{date}) > $hidden_age;

commit 79bfde568cd9dc818e930dbc592d184e312d6c1d
Author:     Martin Storsjö <martin at martin.st>
AuthorDate: Tue Sep 7 14:19:21 2021 +0300
Commit:     Nicolas George <george at nsup.org>
CommitDate: Tue Sep 7 15:58:09 2021 +0200

    Add a missed taint check in report.cgi
    
    This was missed in 505f620a5d22ffef86ad5ffa1328e87ba6dc191b.

diff --git a/report.cgi b/report.cgi
index 2b388e4..fb00fee 100755
--- a/report.cgi
+++ b/report.cgi
@@ -1,4 +1,4 @@
-#! /usr/bin/perl
+#! /usr/bin/perl -T
 #
 # Copyright (c) 2011 Mans Rullgard <mans at mansr.com>
 #

-----------------------------------------------------------------------

Summary of changes:
 FATE.pm    | 2 ++
 index.cgi  | 1 +
 report.cgi | 2 +-
 3 files changed, 4 insertions(+), 1 deletion(-)


hooks/post-receive
--