Security Review of Request Tracker
http://www.jadevine.org.uk/request-tracker/
General impression
- HUUUUGE (ca. 200.000 LOC)
- completely written in Perl
- code runs as www-data by default, so can potentially compromise all apache instances; can manually be configured to use apache's suexec, or a standalone server (/usr/bin/rt-standalone_httpd-3.4) though (depends on how many other apps apache servers in addition)
Security history
- 0 CANs
one XSS in old version in 2003 (http://www.gossamer-threads.com/lists/rt/announce/72, http://secunia.com/product/1542)
-> excellent
Installation
- A bit clumsy since db user initially must have CREATEDB privs; however, can be revoked after rt-setup-database
- Hangs with apache-worker (my default module), works with -prefork.
Source code
I could not review the whole source code, so I looked at some crucial points to get a general impression.
- general: does not use taint mode
- general: no unsafe exec/system calls
EmailParser.pm: correct temp file handling
- bin/rt.in (CLI client): looks good, uncritical
- bin/mason_handler.fcgi.in: ok
- XSS attempt failed, Mason properly escapes HTML meta characters automatically
encapsulates DB access over DBIx::SearchBuilder, which properly escapes quotes (I checked this)