1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
|
#-*- perl -*-
#
# Copyright (C) 2001,2002,2003,2004,2005 Ken'ichi Fukamachi
# All rights reserved. This program is free software; you can
# redistribute it and/or modify it under the same terms as Perl itself.
#
# $FML: Param.pm,v 1.23 2004/07/23 13:08:56 fukachan Exp $
#
package FML::Process::CGI::Param;
use strict;
use vars qw(@ISA @EXPORT @EXPORT_OK $AUTOLOAD);
use Carp;
# load standard CGI routines
use CGI qw/:standard/;
=head1 NAME
FML::Process::CGI::Param - restrict CGI input.
=head1 SYNOPSIS
See FML::CGI:: on usage.
=head1 DESCRIPTION
cleaner for input data.
=head1 METHODS
=head2 safe_param(key)
return value for key if the value is appropriate.
=cut
# Descriptions: return value for key if the value is appropriate.
# Arguments: OBJ($self) STR($key)
# Side Effects: none
# History: similar to fml 4.0's SecureP() and libcgi_cleanup.pl
# Return Value: STR
sub safe_param
{
my ($self, $key) = @_;
use FML::Restriction::CGI;
my $safe = new FML::Restriction::CGI;
my $safe_param_regexp = $safe->param_regexp();
my $safe_method_regexp = $safe->method_regexp();
if (defined $safe_param_regexp->{ $key }) {
if (defined param($key)) {
my $value = param($key);
my $filter = $safe_param_regexp->{ $key };
if ($value =~ /^$filter$/) {
return $value;
}
elsif ($value =~ /^\s*$/) {
return '';
}
else {
my $r = "CGI parameter $key has invalid character(s).";
croak("__ERROR_cgi.insecure__: $r");
}
}
else {
# accpeptable but not defined, so return undef anyway
return undef;
}
}
else {
my $r = "CGI parameter $key is undefined";
croak("__ERROR_cgi.insecure__: $r");
}
}
=head2 safe_paramlist($numregexp, $key)
return ARRAY_REF for $key.
=cut
# XXX-TODO: safe_paramlist NOT USED ?
# Descriptions: return ARRAY_REF for key if the value is appropriate.
# Arguments: OBJ($self) NUM($numregexp) STR($key)
# Side Effects: none
# History: similar to fml 4.0's SecureP() and libcgi_cleanup.pl
# Return Value: ARRAY_REF
sub safe_paramlist
{
my ($self, $numregexp, $key) = @_;
my (@list) = ();
# XXX-TODO: who uses safe_paramlist() ?
use FML::Restriction::CGI;
my $safe = new FML::Restriction::CGI;
my $safe_param_regexp = $safe->param_regexp();
my $safe_method_regexp = $safe->method_regexp();
# match method and return ARRAY_REF with matching values
$key = $safe_method_regexp->{ $key };
for my $x (param()) {
if ($x =~ /^$key$/) {
# XXX-TODO: $value is checked ???
my $value = defined param($x) ? param($x) : '';
if ($numregexp == 1) { push(@list, [ $1, $value ] );}
if ($numregexp == 2) { push(@list, [ $1, $2, $value ] );}
if ($numregexp == 3) { push(@list, [ $1, $2, $3, $value ] );}
}
elsif ($x =~ /^\s*$/) {
return '';
}
else {
croak("__ERROR_cgi.insecure__");
}
}
return \@list;
}
=head1 CODING STYLE
See C<http://www.fml.org/software/FNF/> on fml coding style guide.
=head1 AUTHOR
Ken'ichi Fukamachi
=head1 COPYRIGHT
Copyright (C) 2001,2002,2003,2004,2005 Ken'ichi Fukamachi
All rights reserved. This program is free software; you can
redistribute it and/or modify it under the same terms as Perl itself.
=head1 HISTORY
FML::Process::CGI::Param first appeared in fml8 mailing list driver package.
See C<http://www.fml.org/> for more details.
=cut
1;
|
