Trying to access that bug report, I receive: undef error - Insecure dependency in parameter 3 of DBI::db=HASH(0x9c9091c)->selectrow_hashref method call while running with -T switch at Bugzilla/Object.pm line 93. It only happens when I'm not logged in to Bugzilla.
Confirmed. I'll investigate.
I just enabled Bugzilla debug mode, and the relevant error is: undef error - Insecure dependency in parameter 3 of DBI::db=HASH(0xb097df4)->selectrow_hashref method call while running with -T switch at Bugzilla/Object.pm line 93. at Bugzilla/Object.pm line 93 Bugzilla::Object::_init('Bugzilla::Attachment', 23798) called at Bugzilla/Object.pm line 58 Bugzilla::Object::new('Bugzilla::Attachment', 23798) called at Bugzilla/Template.pm line 274 Bugzilla::Template::get_attachment_link(23798, 'attachment 23798 [details]') called at Bugzilla/Template.pm line 230 Bugzilla::Template::quoteUrls('Created attachment 23798 [details]\x{a}partially reduced testcase\x{a}\x{a}Compiler...', 'Bugzilla::Bug=HASH(0xb180258)', 'Bugzilla::Comment=HASH(0xb3a22a4)') called at Bugzilla/Template.pm line 698 Bugzilla::Template::__ANON__('Created attachment 23798 [details]\x{a}partially reduced testcase\x{a}\x{a}Compiler...') called at template/en/default/bug/comments.html.tmpl line 188 eval {...} called at template/en/default/bug/comments.html.tmpl line 121
This is totally crazy. Perl complains that the attachment ID is tainted if you are logged out, but not if you are logged in. And the error comes right *after* a call to detaint_natural(), whose job is to detaint the data!! I suspect this is a bug in Perl 5.8.5 itself. I cannot reproduce with Perl 5.12.3.
The error doesn't occur with all bugs having attachments in them. For instance, I could view bug 28382 without any problem. So the good news is that this problem seems to affect a few bugs at most.
Created attachment 25385 [details] Ugly hack Here is a ugly hack which fixes the problem. This code is not necessary on my local installations so this is not something I'm going to apply upstream (but you don't care).
I fixed both Sources and GCC Bugzilla.