On Wed, Jul 19, 2017 at 2:53 PM, Craig Russell <[email protected]> wrote: > Hi Sam, > > What is a tainted email address?
Tainted strings are strings that are constructed from outside sources, and therefore potential security holes (think SQL injection attack[1]). Given the restrictions we have on Apache user ids, I think we are safe. > Craig - Sam Ruby >> On Jul 19, 2017, at 11:49 AM, [email protected] wrote: >> >> This is an automated email from the ASF dual-hosted git repository. >> >> rubys pushed a commit to branch master >> in repository https://gitbox.apache.org/repos/asf/whimsy.git >> >> >> The following commit(s) were added to refs/heads/master by this push: >> new ef281dd untaint addresses >> ef281dd is described below >> >> commit ef281ddf7b81d2f4936836caf78bdb1b8f7ae296 >> Author: Sam Ruby <[email protected]> >> AuthorDate: Wed Jul 19 14:49:41 2017 -0400 >> >> untaint addresses >> --- >> www/board/agenda/views/actions/todos.json.rb | 10 ++++++++-- >> 1 file changed, 8 insertions(+), 2 deletions(-) >> >> diff --git a/www/board/agenda/views/actions/todos.json.rb >> b/www/board/agenda/views/actions/todos.json.rb >> index 205a67e..336fd10 100644 >> --- a/www/board/agenda/views/actions/todos.json.rb >> +++ b/www/board/agenda/views/actions/todos.json.rb >> @@ -73,10 +73,16 @@ if @add and env.password >> ASF::Mail.configure >> sender = ASF::Person.new(env.user) >> mail = Mail.new do >> - from "#{sender.public_name} <#{sender.id}@apache.org>" >> - to people.map {|person| "#{person.public_name} >> <#{person.id}@apache.org>"} >> + from "#{sender.public_name} <#{sender.id}@apache.org>".untaint >> + >> + to people.map do |person| >> + "<#{person.id}@apache.org>".untaint >> + end >> + >> cc 'Apache Board <[email protected]>' >> + >> subject "Congratulations on your new role at Apache" >> + >> body "Dear new PMC chairs,\n\nCongratulations on your new role at " + >> "Apache. I've changed your LDAP privileges to reflect your new " + >> "status.\n\nPlease read this and update the foundation records:\n" + >> >> -- >> To stop receiving notification emails like this one, please contact >> ['"[email protected]" <[email protected]>']. > > Craig L Russell > Architect > [email protected] > P.S. A good JDO? O, Gasp! > > > > >
