1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
#-*- perl -*-
#
# Copyright (C) 2001,2002,2004,2005 Ken'ichi Fukamachi
# All rights reserved.
#
# $FML: CGI.pm,v 1.12 2004/07/23 13:16:43 fukachan Exp $
#
package FML::Restriction::CGI;
use vars qw($debug @ISA @EXPORT @EXPORT_OK);
use strict;
use Carp;
use FML::Restriction::Base;
@ISA = qw(FML::Restriction::Base);
=head1 NAME
FML::Restriction::CGI -- define safe data regexp for CGI modules.
=head1 SYNOPSIS
use FML::Restriction::CGI;
$safe = new FML::Restriction::CGI;
my $regexp = $safe->method_regexp();
if ($data =~ /^($regexp)$/) {
# o.k. do something ...
}
=head1 DESCRIPTION
FML::Restriction::CGI provides data type considered as safe.
=head1 METHODS
=head1 Safe Parameter Definition for CGI use
Please extract regexp hash { varname => allowed_regexp } as HASH
REFERENCE via the following access method:
param_regexp()
method_regexp()
=cut
my %cgi_methond =
(
'threadcgi_change_status' => 'change_status\.(__ml_name_regexp__)\/(\d+)',
);
# Descriptions: return a set of basic variable safe expressions as HASH_REF.
# Arguments: OBJ($self)
# Side Effects: none
# Return Value: HASH_REF
sub param_regexp
{
my ($self) = @_;
return $self->basic_variable();
}
# Descriptions: return a set of method safe expressions as HASH_REF.
# Arguments: OBJ($self)
# Side Effects: none
# Return Value: HASH_REF
sub method_regexp
{
my ($self) = @_;
my $basic_variable = $self->basic_variable();
# expand __var__regexp__ to regular expression defined in other hash
for my $key (keys %cgi_methond) {
my $value = $cgi_methond{ $key };
if ($value =~ /__/o) {
# expand variables defined in %basic_variable HASH
for my $regexpkey (keys %$basic_variable) {
my $x = "__${regexpkey}_regexp__";
my $y = $basic_variable->{$regexpkey};
$value =~ s/$x/$y/g;
$cgi_methond{ $key } = $value;
}
}
}
return \%cgi_methond;
}
#
# debug
#
if ($0 eq __FILE__) {
my $safe = new FML::Restriction::CGI;
my $regexp = $safe->param_regexp();
print "-- safe parameter regexp\n";
for my $k (keys %$regexp) {
printf "%-20s => %s\n", $k, $regexp->{ $k };
}
$regexp = $safe->method_regexp();
print "\n-- safe method regexp\n";
for my $k (keys %$regexp) {
printf "%-20s => %s\n", $k, $regexp->{ $k };
}
}
=head1 CODING STYLE
See C<http://www.fml.org/software/FNF/> on fml coding style guide.
=head1 AUTHOR
Ken'ichi Fukamachi
=head1 COPYRIGHT
Copyright (C) 2001,2002,2004,2005 Ken'ichi Fukamachi
All rights reserved. This program is free software; you can
redistribute it and/or modify it under the same terms as Perl itself.
=head1 HISTORY
FML::Process::Configure first appeared in fml8 mailing list driver package.
See C<http://www.fml.org/> for more details.
=cut
1;
|
