Page MenuHomePhorge
Create Task
Maniphest T137

Make channelmgnt::chanopget properly handle recursion and duplicate items
Open, HighPublic
Actions

Description

Was looking at this code and think it might be able to.

Need to put a bit of a test case together but marking as a security in case you can.

It should be low risk

Details

Security
None

Related Objects
Search...

Event Timeline

• RhinosF1 created this task.Dec 20 2020, 1:31 PM

https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-q2qh-4g5c-f7hc

• RhinosF1 added a comment.Dec 20 2020, 1:38 PM

Running the test in https://github.com/MirahezeBots/sopel-channelmgnt-ghsa-q2qh-4g5c-f7hc/pull/1/files is needed

• RhinosF1 added a comment.Dec 20 2020, 1:41 PM

Do not make this public or merge without my approval

• RhinosF1 updated the task description. (Show Details)Dec 20 2020, 1:42 PM
• RhinosF1 added a comment.Dec 20 2020, 1:59 PM

I've had a quick check and I'm not sure it does so I'm going to try and get a test case 100% working tonight but there's definately a bug here as you can duplicate items in the array

• RhinosF1 renamed this task from Can channelmgnt::chanopget infinitely recurse? to Make channelmgnt::chanopget properly handle recursion and duplicate items.Dec 20 2020, 2:00 PM
• RhinosF1 added a project: MirahezeBot-Plugins.
• RhinosF1 added a comment.Dec 20 2020, 3:56 PM

Gonna make public as I can't see a security issue here checking again

• RhinosF1 changed the visibility from "Custom Policy" to "Public (No Login Required)".Dec 20 2020, 3:56 PM
• RhinosF1 removed a project: Security.
• RhinosF1 changed Security from Software security bug to None.
• RhinosF1 added a subtask: T122: Allow improved per channel config.Feb 24 2021, 1:41 PM
• RhinosF1 added a parent task: T152: Release Version 10 (last version not a 'bundle').
Main Website · Terms of use · Privacy Policy