Skip to content

Instantly share code, notes, and snippets.

@Woody2143
Created November 9, 2012 14:56
Show Gist options
  • Save Woody2143/4046144 to your computer and use it in GitHub Desktop.
Save Woody2143/4046144 to your computer and use it in GitHub Desktop.
Untainting data in Moose::Util::TypeConstraints
[user@host dev]$ ./test.pl 20121112
20121112 is tainted!
$VAR1 = bless( {
'date' => '20121112',
}, 'Index' );
date is NOT tainted!
package Index;
use Moose;
use namespace::autoclean;
use Index::Types;
use POSIX qw(strftime);
has 'date' => (
is => 'rw',
isa => 'Index::Types::Date',
default => sub {strftime '%Y%m%d', gmtime;},
coerce => 1,
);
_PACKAGE__->meta->make_immutable();
#!perl -T
use Modern::Perl;
use lib 'lib';
use Index;
use Data::Dumper;
use Scalar::Util qw(tainted);
use Try::Tiny;
my $date = $ARGV[0];
say "$date is tainted!" if tainted($date);
my $index;
try {
$index = Index->new( date => $date );
say Dumper($index);
say "date made it through moose tainted!" if tainted($index->date);
} catch {
$_ =~ m/__START__(.*)__END__/;
if (defined $1) {
say $1;
} else {
say "SYSTEM ERROR! $_";
}
};
say "date is NOT tainted!" unless tainted($index->date);
package Index::Types;
use Moose::Util::TypeConstraints;
use Scalar::Util qw(tainted);
subtype 'Index::Types::Date'
=> as 'Str'
=> where { ( m/^[0-9]{8}$/ && !tainted($_) ) }
=> message { "__START__This date ($_) is not a valid date!__END__"};
coerce 'Index::Types::Date',
from 'Str',
via {
$_ =~ s/[^0-9]//g; # Strip anything that isn't a digit.
$_ =~ m/^([0-9]{8})$/ or die "__START__The date is not a valid!__END__";
return $1;
};
1;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment