lists of tainted values in query string kill processInputs

[Bug Importer]

The issue: lists of tainted values in HTTP_QUERY_STRING won't survive. That is,
multiple parameters from the web with the same key value, thet contain '<'
symbols kill the parser so your script won't even get executed.
It generates an AttributeError on "append" with the following stack trace:
[//ZServer/medusa/asyncore.py|poll|94]
[//ZServer/medusa/asyncore.py|handle_read_event|395]
[//ZServer/UserListServer.py|handle_read|83]
[//ZServer/UserListServer.py|calc_reply|120]
[//lib/python/ZPublisher/Publish.py|publish|114]
[//lib/python/Zope/__init__.py|zpublisher_exception_hook|171]
[//lib/python/ZPublisher/Publish.py|publish|63]
[//lib/python/ZPublisher/HTTPRequest.py|processInputs|763]
[//lib/python/ZPublisher/TaintedString.py|__getattr__|89])

I digged around a bit in the source, and it seems the problem is in
processInputs. 'append' is called on a string, which should be a list, but is
initialized wrongly in another part of processInputs.
Following is a patch to fix the issue in lib/python/ZPublisher/HTTPRequest.py
--- HTTPRequest.py.old 2002-10-28 20:13:40.000000000 +0100
+++ HTTPRequest.py.new 2002-10-28 20:14:32.000000000 +0100
@@ -780,7 +780,7 @@
                     else:
                         mapping_object[key]=item
                         if tainted:
- taintedform[tainted_key] = tainted
+ taintedform[tainted_key] = [tainted]

             #insert defaults into form dictionary
             if defaults:

[Martijn Pieters (mjpieters)]

Status: Pending => Accepted

 Supporters added: mj

Confirmed; the test suite wasn't testing for implicit sequences with taints. I'll fix this and port it to the various branches that need fixed.

[Martijn Pieters (mjpieters)]

Status: Accepted => Resolved

Fixed for Zope 2.6.1, Zope 2.5.2 (if it ever is released ;)) and the trunk.

Thanks!