CGI-Safe
view release on metacpan or search on metacpan
Revision history for Perl extension CGI-Safe.
1.25 2005-10-04
- Added tests for POD. Converted to Module::Build.
Minor code cleanup. Improved directory structure.
Minor POD cleanup.
1.24 Fri Jan 04 13:12:00 2001
- Updated. I didn't include the tests in the manifest,
thus, failing to upload them. How humiliating :)
0.01 Wed Nov 28 09:15:14 2001
- original version; created by h2xs 1.21 with options
-AX -n CGI-Safe
lib/CGI/Safe.pm view on Meta::CPAN
@ISA = qw/ CGI /;
use vars qw/ $shell $path /;
BEGIN {
# Clean up the environment and establish some defaults
$shell = $ENV{'SHELL'};
$path = $ENV{'PATH'};
delete @ENV{qw/ IFS CDPATH ENV BASH_ENV PATH SHELL /};
$CGI::DISABLE_UPLOADS = 1; # Disable uploads
$CGI::POST_MAX = 512 * 1024; # limit posts to 512K max
}
sub import {
if ( grep { /:(?:standard|cgi)/ } @_ ) {
my $set_sub = caller(0) . '::set';
my $shell_sub = caller(0) . '::get_shell';
my $path_sub = caller(0) . '::get_path';
{
no strict 'refs';
lib/CGI/Safe.pm view on Meta::CPAN
for most CGI scripts.
=head1 SYNOPSIS
use CGI::Safe qw/ taint /;
my $q = CGI::Safe->new;
=head1 DESCRIPTION
If you've been working with CGI.pm for any length of time, you know that it
allows uploads by default and does not have a maximum post size. Since it
saves the uploads as a temp file, someone can simply upload enough data to fill
up your hard drive to initiate a DOS attack. To prevent this, we're regularly
warned to include the following two lines at the top of our CGI scripts:
$CGI::DISABLE_UPLOADS = 1; # Disable uploads
$CGI::POST_MAX = 512 * 1024; # limit posts to 512K max
As long as those are their before you instantiate a CGI object (or before you
access param and related CGI functions with the function oriented interface),
you have pretty safely plugged this problem. However, most CGI scripts don't
have these lines of code. Some suggest changing these settings directly in
CGI.pm. I dislike this for two reasons:
=over 4
lib/CGI/Safe.pm view on Meta::CPAN
use CGI::Safe qw/ taint /;
my $q = CGI::Safe->new( DISABLE_UPLOADS => 0 );
Or:
use CGI::Safe qw/ :standard taint /;
$CGI::DISABLE_UPLOADS = 0;
=head2 Uploads and Maximum post size
As mentioned earlier, most scripts that do not need uploading should have
something like the following at the start of their code to disable uploads:
$CGI::DISABLE_UPLOADS = 1; # Disable uploads
$CGI::POST_MAX = 512 * 1024; # limit posts to 512K max
The C<CGI::Safe> sets these values in an C<BEGIN{}> block. If necessary, the
programmer can override these values two different ways. When using the
function oriented interface, if needing file uploads and wanting to allow up
to a 1 megabyte upload, they would set these values directly I<before> using
any of the CGI.pm CGI functions:
use CGI::Safe qw/ :standard taint /;
$CGI::DISABLE_UPLOADS = 0;
$CGI::POST_MAX = 1_024 * 1_024; # limit posts to 1 meg max
If using the OO interface, you can set these explicitly I<or> pass them as
parameters to the C<CGI::Safe> constructor:
use CGI::Safe qw/ taint /;
t/f-admin-interface.t view on Meta::CPAN
print "1..7\n";
use strict;
my $limit = 666;
my $upload = 17;
use vars qw/ $path $shell /;
BEGIN {
# This test cannot "use" CGI safe or else we'll have PATH
# and SHELL gone before we can get their values
$path = $ENV{ 'PATH' };
$shell = $ENV{ 'SHELL' };
require CGI::Safe;
CGI::Safe->import( qw/ :standard admin / );
t/f-admin-interface.t view on Meta::CPAN
$CGI::DISABLE_UPLOADS = $CGI::DISABLE_UPLOADS;
$CGI::POST_MAX = $CGI::POST_MAX;
eval {
set( POST_MAX => $limit );
};
print "not " if $@;
print "ok 1\n";
eval {
set( DISABLE_UPLOADS => $upload );
};
print "not " if $@;
print "ok 2\n";
print "not " unless $CGI::POST_MAX == $limit;
print "ok 3\n";
print "not " unless $CGI::DISABLE_UPLOADS == $upload;
print "ok 4\n";
my $header = header;
print "not " unless $header =~ /content/i;
print "ok 5\n";
print "not " if exists $ENV{ 'IFS ' };
print "ok 6\n";
print "not " unless $ENV{ 'PATH' } eq $path;
t/function-interface.t view on Meta::CPAN
print "1..7\n";
use strict;
my $limit = 666;
my $upload = 17;
use CGI::Safe qw/:standard/;
# stop spurious warnings about only used once
$CGI::DISABLE_UPLOADS = $CGI::DISABLE_UPLOADS;
$CGI::POST_MAX = $CGI::POST_MAX;
eval {
set( POST_MAX => $limit );
};
print "not " if $@;
print "ok 1\n";
eval {
set( DISABLE_UPLOADS => $upload );
};
print "not " if $@;
print "ok 2\n";
print "not " unless $CGI::POST_MAX == $limit;
print "ok 3\n";
print "not " unless $CGI::DISABLE_UPLOADS == $upload;
print "ok 4\n";
my $header = header;
print "not " unless $header =~ /content/i;
print "ok 5\n";
print "not " if exists $ENV{ 'PATH' };
print "ok 6\n";
print "not " if exists $ENV{ 'IFS ' };
t/oo-admin-interface.t view on Meta::CPAN
print "1..9\n";
use strict;
my $limit = 666;
my $upload = 17;
use vars qw/ $path $shell /;
BEGIN {
# This test cannot "use" CGI safe or else we'll have PATH
# and SHELL gone before we can get their values
$path = $ENV{ 'PATH' };
$shell = $ENV{ 'SHELL' };
require CGI::Safe;
CGI::Safe->import( qw/ admin taint / );
t/oo-admin-interface.t view on Meta::CPAN
$CGI::DISABLE_UPLOADS = $CGI::DISABLE_UPLOADS;
$CGI::POST_MAX = $CGI::POST_MAX;
eval {
CGI::Safe->set( POST_MAX => $limit );
};
print "not " if $@;
print "ok 1\n";
eval {
CGI::Safe::set( DISABLE_UPLOADS => $upload );
};
print "not " if $@;
print "ok 2\n";
my $q;
eval {
$q = CGI::Safe->new( source => { color => 'red', color => 'blue', name => 'Ovid' } );
};
print "not " if $@ or ! defined $q;
print "ok 3\n";
print "not " unless $CGI::POST_MAX == $limit;
print "ok 4\n";
print "not " unless $CGI::DISABLE_UPLOADS == $upload;
print "ok 5\n";
my $header = $q->header;
print "not " unless $header =~ /content/i;
print "ok 6\n";
my @colors = $q->param('color');
print "not " unless grep { /blue/ } @colors;
print "ok 7\n";
t/oo-interface.t view on Meta::CPAN
print "1..10\n";
use strict;
my $limit = 666;
my $upload = 17;
use CGI::Safe;
# stop spurious warnings about only used once
$CGI::DISABLE_UPLOADS = $CGI::DISABLE_UPLOADS;
$CGI::POST_MAX = $CGI::POST_MAX;
eval {
CGI::Safe->set( POST_MAX => $limit );
};
print "not " if $@;
print "ok 1\n";
eval {
CGI::Safe::set( DISABLE_UPLOADS => $upload );
};
print "not " if $@;
print "ok 2\n";
my $q;
eval {
$q = CGI::Safe->new( source => { color => 'red', color => 'blue', name => 'Ovid' } );
};
print "not " if $@;
print "ok 3\n";
print "not " unless $CGI::POST_MAX == $limit;
print "ok 4\n";
print "not " unless $CGI::DISABLE_UPLOADS == $upload;
print "ok 5\n";
print "not " unless defined $q;
print "ok 6\n";
my $header = $q->header;
print "not " unless $header =~ /content/i;
print "ok 7\n";
my @colors = $q->param('color');
( run in 3.986 seconds using v1.01-cache-2.11-cpan-b16cb0d3907 )