Skip to content
  • Thomas Sibley's avatar
    Explicitly override any Graph parameter passed into RT::Graph::Tickets · 04a9551f
    Thomas Sibley authored
    Specifying a defined Graph argument to RT::Graph::Tickets->TicketLinks
    is only used internally when it is called recursively.  Since Graph is
    expected to be an existing GraphViz object if defined, it never makes
    sense to start with anything but an undefined Graph parameter.
    
    This prevents a user-supplied Graph parameter from having ->add_node
    called on it.  Since the Graph parameter could contain a Perl package
    name, it previously provided a means to call to ->add_node on arbitrary
    Perl packages already loaded into memory.  While of unlikely utility,
    there's no reason to allow such behaviour.
    
    Fixes part of CVE-2011-4458.
    04a9551f