#753 500 error: Project user search is vulnerable to regex injection

v1.0.0
closed
sf-2 (994)
General
nobody
2015-08-20
2010-07-20
No

The search string is directly inserted into the regex. It should instead be escaped using re.escape

Related

Tickets: #772

Discussion

  • Rick Copeland - 2010-07-30
    • assigned_to: Jenny Steele

    • custom_field__size: 1 --> 1

     
  • Rick Copeland - 2010-07-30

    To demonstrate the 500 error, just start the search with a *

     
  • Jenny Steele - 2010-07-30
    • status: open --> code-review
     
  • Jenny Steele - 2010-07-30
    • status: code-review --> validation
     
  • Anonymous - 2010-08-03

    Originally by: n_oostendorp

    • status: validation --> closed
     

Log in to post a comment.