CGI-Untaint-upload

 view release on metacpan or  search on metacpan

Changes  view on Meta::CPAN

Revision history for Perl extension CGI::Untaint::upload.

0.01  Mon Jun 16 12:09:13 2003
	- original version; created by h2xs 1.2 with options
		-AX -n CGI::Untaint::upload

MANIFEST  view on Meta::CPAN

Changes
MANIFEST
Makefile.PL
upload.pm
t/1.t
t/testdata

Makefile.PL  view on Meta::CPAN

use ExtUtils::MakeMaker;
# See lib/ExtUtils/MakeMaker.pm for details of how to influence
# the contents of the Makefile that is written.
WriteMakefile(
    'NAME'		=> 'CGI::Untaint::upload',
    'VERSION_FROM'	=> 'upload.pm', # finds $VERSION
    'PREREQ_PM'		=> {}, # e.g., Module::Name => 1.1
);

t/1.t  view on Meta::CPAN

seek STDIN, 0, 0;
$ENV{CONTENT_LENGTH} = length $formdata;
$ENV{CONTENT_TYPE} = "multipart/form-data; boundary=----------0xKhTmLbOuNdArY";
$ENV{REQUEST_METHOD} = "POST";
}

use CGI::Untaint;
use CGI;
my $x = CGI->new;
my $handler = CGI::Untaint->new( map { $_ => $x->param($_) } $x->param);
my $uploaded = $handler->extract(-as_upload => "filetest");

is(ref($uploaded), "HASH", "We got the right sort of thing back");

is($uploaded->{filename}, "mynat", "Filename correct");

# Not superfluous! It caught a bug in _untaint_payload_re!
like($uploaded->{payload}, qr/^#!.*any to any$/s, "Payload correct");

upload.pm  view on Meta::CPAN

package CGI::Untaint::upload;
use strict;
use base 'CGI::Untaint::object';

sub _untaint {
    my $self = shift;
    my $fh = $self->value;
    local $/; 
    my $file = {
        filename => $fh,
        payload  => <$fh>

upload.pm  view on Meta::CPAN

sub _untaint_filename_re { qr/(.*)/  }
sub _untaint_payload_re  { qr/(.*)/s }

our $VERSION = '1.0';

1;
__END__

=head1 NAME

CGI::Untaint::upload - receive a file upload

=head1 SYNOPSIS

    my $handler = CGI::Untaint->new( map { $_ => $cgi->param($_) } $cgi->param);
    # NOT my $handler = CGI::Untaint->new( $cgi->Vars ); !

    $file = $handler->extract(-as_upload => "uploaded");
    print "File name was ", $file->{filename}, "\n";
    print "File contents: \n";
    print $file->{payload};

=head1 DESCRIPTION

This L<CGI::Untaint> handler receives a file from an upload field,
returning its filename and contents. This may be used as a base class
for validating that a file upload conforms to certain properties.

It's important that you use C<< CGI->param >> rather than C<< CGI->Vars >>
as the latter only returns the uploaded file's name and not its
contents.

=head1 SUBCLASSING

By default, the class does no taint checking, blindly untainting both
the filename and the contents; this may not be what you want. You can
subclass this module and override the C<_untaint_filename_re> and
C<_untaint_payload_re> methods to control the regular expression used
to untaint these data. In addition, the usual L<CGI::Untaint::object>
C<is_valid> method can be overriden to perform more checks on the data.