Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #45999 Ensure `extract()` is not called on untrusted inputs
    Infos
    #45999
    Thomas Gerbet (tgerbet)
    2025-12-23 12:24
    2025-12-22 16:23
    47725
    Details
    Ensure `extract()` is not called on untrusted inputs

    Spotted by Psalm taint analysis. In \Tuleap_Template is called on possibly untrusted data. This should be avoided to not give malicious users a way to influence the execution context.

    Note there is no security impact, as the existing code does not pass untrusted information.

    Other
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2025-12-23
    Attachments
    Empty
    References
    Referencing request #45999

    Git commit

    tuleap/tuleap/stable

    fix: request #45999 Ensure `extract()` is not called on untrusted inputs 681f555753
    User avatar Thomas Gerbet (tgerbet) , 2025-12-23 08:33
    Merge commit 'refs/changes/17/36517/3' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD dd854d3f00
    User avatar Nicolas Terray (nterray) , 2025-12-23 11:55
    Display settings

    Follow-ups