tracker issue : CF-4126662

select a category, or use search below
(searches all categories and all time range)
Title:

Security Analyzer - Need top honor more cfparam types

| View in Tracker

Status/Resolution/Reason: Closed/Fixed/

Reporter/Name(from Bugbase): David Epler / David Epler (David Epler)

Created: 03/09/2016

Components: Security Analyzer

Versions: 2016

Failure Type: Unspecified

Found In Build/Fixed In Build: Alpha_v12 /

Priority/Frequency: Normal / Unknown

Locale/System: English / Win All

Vote Count: 1

Currently the security analyzer seems to only check for <cfparam type="integer">. There are additional types that have specific format which will block invalid/dangerous input.

The other types that should be allowed are:
 * boolean
 * creditcard
 * date
 * eurodate
 * usdate
 * email
 * float
 * guid
 * range
 * ssn
 * telephone
 * uuid
 * url
 * zipcode

----------------------------- Additional Watson Details -----------------------------

Watson Bug ID:	4126662

External Customer Info:
External Company:  
External Customer Name: David Epler
External Customer Email: dcepler@dcepler.net
External Test Config: Friendly Name: Current MBP
System Type: Laptop
Brand: Apple 
Model: Mid-2012 15"
Processor Type: Intel Core i7
Processor Speed: 2GHz to 3GHz
Memory: 8GB to 16GB
Hard Drive Storage: 500GB-1TB
Peripherals: LCD Display
Peripherals: Web-Cam
Connectivity: Ethernet
Connectivity: Wireless 802.11 N
Interfaces: Firewire
Interfaces: USB 2.x
Media: CD
Media: CD-R
Media: CD-RW
Media: DVD
Media: DVD+R
Media: DVD-R
Media: SD Card
Primary Operating System: Mac OS X 10.9 (Mavericks)
Secondary Operating System: Windows 7 64
System Location: Other
Time Owned: 2 to 3 Years

Attachments:

Comments:

Adding BUG AUDIT TRAIL ********action: updated fieldName: Priority newValue: 2 oldValue: 0 oprid: vmannebo recordName: RQ_DEFECT timpestamp: 2016-02-16 15:13:29.0 action: updated fieldName: Date Closed newValue: 2015-09-22 02:37:27.0 oldValue: Blank oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-09-22 09:37:27.0 action: updated fieldName: Closed By newValue: preethi oldValue: Blank oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-09-22 09:37:27.0 action: updated fieldName: Owner newValue: Blank oldValue: preethi oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-09-22 09:37:27.0 action: updated fieldName: Reason newValue: Blank oldValue: Fixed oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-09-22 09:37:27.0 action: updated fieldName: Status newValue: Fixed oldValue: ToTest oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-09-22 09:37:27.0 action: updated fieldName: State newValue: Closed oldValue: Open oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-09-22 09:37:27.0 action: updated fieldName: Date Fixed newValue: 2015-09-21 05:15:01.0 oldValue: Blank oprid: uogra recordName: RQ_DEFECT timpestamp: 2015-09-21 12:15:01.0 action: updated fieldName: Fixed By newValue: uogra oldValue: Blank oprid: uogra recordName: RQ_DEFECT timpestamp: 2015-09-21 12:15:01.0 action: updated fieldName: Owner newValue: preethi oldValue: uogra oprid: uogra recordName: RQ_DEFECT timpestamp: 2015-09-21 12:15:01.0 action: updated fieldName: Reason newValue: Fixed oldValue: Blank oprid: uogra recordName: RQ_DEFECT timpestamp: 2015-09-21 12:15:01.0 action: updated fieldName: Changelist newValue: 295602 oldValue: Blank oprid: uogra recordName: RQ_DEFECT timpestamp: 2015-09-21 12:15:01.0 action: updated fieldName: Status newValue: ToTest oldValue: ToFix oprid: uogra recordName: RQ_DEFECT timpestamp: 2015-09-21 12:15:01.0 action: updated fieldName: Fix By Milestone newValue: Beta oldValue: Blank oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-07-28 03:31:24.0 action: updated fieldName: Dev Assigned newValue: uogra oldValue: sanniset oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-07-28 03:31:24.0 action: updated fieldName: Fix By Product Milestone newValue: Beta oldValue: Blank oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-07-28 03:31:24.0 action: updated fieldName: Status newValue: ToFix oldValue: Unverified oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-07-28 03:31:24.0 action: updated fieldName: Reason newValue: Blank oldValue: Blank oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-07-28 03:31:24.0 action: updated fieldName: Owner newValue: uogra oldValue: preethi oprid: preethi recordName: RQ_DEFECT timpestamp: 2015-07-28 03:31:24.0 action: added fieldName: Vote Type newValue: BETA oldValue: Blank oprid: prerelease recordName: AD_DEFECT_VOTE timpestamp: 2015-07-27 20:11:26.0
Comment by CFwatson U.
3566 | March 09, 2016 04:29:10 AM GMT
I agree this is necessary.
Vote by External U.
3568 | March 09, 2016 04:29:11 AM GMT
Added By:preethi Note Added: Fix will be available in the next release. Thanks! Date Added :2015-09-22 09:37:28.0 Added By: PreRelease User User Name:David Epler Note Added: Forgot regex in the list Date Added :2015-07-27 16:10:47.0 Added By: PreRelease User User Name:David Epler Note Added: Entered Bug. Date Added :2015-07-27 12:14:40.0
Comment by CFwatson U.
3567 | March 09, 2016 04:29:12 AM GMT