1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
#-*- perl -*-
#
# Copyright (C) 2001 Ken'ichi Fukamachi
# All rights reserved. This program is free software; you can
# redistribute it and/or modify it under the same terms as Perl itself.
#
# $FML: Param.pm,v 1.10 2001/12/22 09:21:10 fukachan Exp $
#
package FML::Process::CGI::Param;
use strict;
use vars qw(@ISA @EXPORT @EXPORT_OK $AUTOLOAD);
use Carp;
# load standard CGI routines
use CGI qw/:standard/;
=head1 NAME
FML::Process::CGI::Param - CGI input restriction
=head1 SYNOPSIS
See FML::CGI:: on usage.
=head1 DESCRIPTION
cleaner for data.
=head1 METHODS
=head2 safe_param(str, key)
return value for key if the value is appropriate.
=cut
# Descriptions: return value for key if the value is appropriate.
# Arguments: OBJ($self) STR($key)
# Side Effects: none
# History: similar to fml 4.0's SecureP() and libcgi_cleanup.pl
# Return Value: STR
sub safe_param
{
my ($self, $key) = @_;
use FML::Restriction::CGI;
my $safe = new FML::Restriction::CGI;
my $safe_param_regexp = $safe->param_regexp();
my $safe_method_regexp = $safe->method_regexp();
if (defined $safe_param_regexp->{ $key }) {
if (defined param($key)) {
my $value = param($key);
my $filter = $safe_param_regexp->{ $key };
if ($value =~ /^$filter$/) {
return $value;
}
else {
croak("CGI parameter $key has invalid character");
}
}
else {
# accpeptable but not defined, so return undef anyway
return undef;
}
}
else {
croak("CGI parameter $key is undefined");
}
}
=head2 safe_paramlist($self, $numregexp, $key)
return HASH_ARRAY for $key.
=cut
# Descriptions: return HASH_ARRAY for key if the value is appropriate.
# Arguments: OBJ($self) NUM($numregexp) STR($key)
# Side Effects: none
# History: similar to fml 4.0's SecureP() and libcgi_cleanup.pl
# Return Value: HASH_ARRAY
sub safe_paramlist
{
my ($self, $numregexp, $key) = @_;
my (@list) = ();
use FML::Restriction::CGI;
my $safe = new FML::Restriction::CGI;
my $safe_param_regexp = $safe->param_regexp();
my $safe_method_regexp = $safe->method_regexp();
# match method and return HASH ARRAY with matching values
$key = $safe_method_regexp->{ $key };
for my $x (param()) {
print STDERR "\n<!-- check param: $x =~ /^$key$/ -->\n";
if ($x =~ /^$key$/) {
my $value = defined param($x) ? param($x) : '';
if ($numregexp == 1) { push(@list, [ $1, $value ] );}
if ($numregexp == 2) { push(@list, [ $1, $2, $value ] );}
if ($numregexp == 3) { push(@list, [ $1, $2, $3, $value ] );}
}
}
return \@list;
}
=head1 AUTHOR
Ken'ichi Fukamachi
=head1 COPYRIGHT
Copyright (C) 2001 Ken'ichi Fukamachi
All rights reserved. This program is free software; you can
redistribute it and/or modify it under the same terms as Perl itself.
=head1 HISTORY
FML::Process::CGI::Param appeared in fml5 mailing list driver package.
See C<http://www.fml.org/> for more details.
=cut
1;
|
