MantisBT - CDash
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0007504CDashpublic2008-08-19 18:022008-08-20 07:40
ReporterUli M 
Assigned ToJulien Jomier 
PrioritynormalSeveritymajorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version 
Target VersionFixed in Version1.2 
Summary0007504: <DartMeasurement> output is not SQL-escaped
DescriptionDownsides are that you can't upload files with ' in them. Well and then there's of course SQL injection...(which is why I tagged this major). Patch attached.


On a side note: I'm uploading text/string and not text/html which seems to be unsupported. Stuff gets displayed in one line and xml fragments vanish. Had to add a 
 tag in testDetails.xsl file and remove the disable-output-escaping flag. I would think that should be the default behavior for non-html input. Oh and why do you document a base64 encoding attribute if it's really only used for images. By the way documentation is the hardest thing about ctest/cdash...you can't trust what you read because half of it is outdated or just a proposal and not what's really implemented. Anyway, thanks for the cool software ;)
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
Attached Filespatch cdash-measurement-sql-escape.patch (744) 2008-08-19 18:02
https://public.kitware.com/Bug/file/1667/cdash-measurement-sql-escape.patch
Issue History
Date ModifiedUsernameFieldChange
2008-08-19 18:02Uli MNew Issue
2008-08-19 18:02Uli MFile Added: cdash-measurement-sql-escape.patch
2008-08-19 18:11Julien JomierStatusnew => assigned
2008-08-19 18:11Julien JomierAssigned To => Julien Jomier
2008-08-19 18:11Julien JomierNote Added: 0013092
2008-08-20 02:21Uli MNote Added: 0013106
2008-08-20 07:40Julien JomierStatusassigned => closed
2008-08-20 07:40Julien JomierNote Added: 0013108
2008-08-20 07:40Julien JomierResolutionopen => fixed
2008-08-20 07:40Julien JomierFixed in Version => 1.2

Notes
(0013092)
Julien Jomier   
2008-08-19 18:11   
What version of CDash are you using? I think we fixed this issue recently. Thanks for the report.
(0013106)
Uli M   
2008-08-20 02:21   
I used revision 1069 (see the patch). Current HEAD(rev 1084) looks the same to me besides some added viewvc stuff. So I think the problem persists!
(0013108)
Julien Jomier   
2008-08-20 07:40   
I should have looked at the patch :). I've put the patch in SVN. Thanks for the report and providing a fix.