Fix for collector issue #650: Implicit marshalling for lists where the first

two values are tainted failed because no implicit conversion to a list took
place.

lib/python/ZPublisher/HTTPRequest.py

@@ -11,7 +11,7 @@
 #
 ##############################################################################
 
-__version__='$Revision: 1.83 $'[11:-2]
+__version__='$Revision: 1.84 $'[11:-2]
 
 import re, sys, os,  urllib, time, random, cgi, codecs
 from types import StringType, UnicodeType
@@ -760,6 +760,9 @@ class HTTPRequest(BaseRequest):
                                     taintedform[tainted_key] = copied
                                 else:
                                     taintedform[tainted_key] = [copied]
+                            elif not isinstance(taintedform[tainted_key], lt):
+                                taintedform[tainted_key] = [
+                                    taintedform[tainted_key]]
                             taintedform[tainted_key].append(tainted)
 
                         elif taintedform.has_key(tainted_key):

lib/python/ZPublisher/tests/testHTTPRequest.py

@@ -324,28 +324,35 @@ class ProcessInputsTests(unittest.TestCase):
             ('tainted', '<tainted value>'),
             ('<tainted key>', 'value'),
             ('spacey key', 'val'), ('key', 'spacey val'),
-            ('multi', '1'), ('multi', '2'))
+            ('tinitmulti', '<1>'), ('tinitmulti', '2'),
+            ('tdefermulti', '1'), ('tdefermulti', '<2>'),
+            ('tallmulti', '<1>'), ('tallmulti', '<2>'))
         req = self._processInputs(inputs)
 
         taintedformkeys = list(req.taintedform.keys())
         taintedformkeys.sort()
-        self.assertEquals(taintedformkeys, ['<tainted key>', 'tainted'])
+        self.assertEquals(taintedformkeys, ['<tainted key>', 'tainted',
+            'tallmulti', 'tdefermulti', 'tinitmulti'])
 
         self._taintedKeysAlsoInForm(req)
         self._onlyTaintedformHoldsTaintedStrings(req)
 
     def testSimpleMarshallingWithTaints(self):
         inputs = (
-            ('foo', 'bar'), ('spam', 'eggs'),
-            ('number', '1'),
-            ('tainted', '<tainted value>'), ('<tainted key>', 'value'),
-            ('spacey key', 'val'), ('key', 'spacey val'),
-            ('multi', '1'), ('multi', '2'))
+            ('<tnum>:int', '42'), ('<tfract>:float', '4.2'),
+            ('<tbign>:long', '45'),
+            ('twords:string', 'Some <words>'), ('t2tokens:tokens', 'one <two>'),
+            ('<taday>:date', '2002/07/23'),
+            ('taccountedfor:required', '<yes>'),
+            ('tmultiline:lines', '<one\ntwo>'),
+            ('tmorewords:text', '<one\ntwo>\n'))
         req = self._processInputs(inputs)
 
         taintedformkeys = list(req.taintedform.keys())
         taintedformkeys.sort()
-        self.assertEquals(taintedformkeys, ['<tainted key>', 'tainted'])
+        self.assertEquals(taintedformkeys, ['<taday>', '<tbign>', '<tfract>',
+            '<tnum>', 't2tokens', 'taccountedfor', 'tmorewords', 'tmultiline',
+            'twords'])
 
         self._taintedKeysAlsoInForm(req)
         self._onlyTaintedformHoldsTaintedStrings(req)