| Subject: | Problems with stringify_self and untaint |
Although Maypole::Model::CDBI provides a list of required_cols to FromCGI, it does not provide a list of "ignore" cols. Using the attached patch one can bypass untaint for any column (most useful to me for columns which aren't entered via a public interface) using this syntax:
Beer::Drinker->config->{donor}{ignore_cols} = [qw/ id secret_beer_recipe /];
Without this patch, an application hang will result for any columns for which an untaint type is not provided. Additionally, if stringify_self is used in a module, the primary key in a create_from_cgi is checked, resulting in a terrible mess, even though the primary key is supposedly "silently skipped" by FromCGI. (The silent part applies, there is no error message.) Symptoms include a resource-hungry apache (under mod_perl) and seg faults.
Tested with stock:
Maypole 2.10
CDBI::FromCGI 1.00
CGI::Untaint 1.26
Perl 5.8.4
Apache 2.0.54-5, using mod_perl
running on Debian Woody (kernel 2.6.8-2-686-smp)
--- /usr/local/src/Maypole-2.10/lib/Maypole/Model/CDBI.pm 2005-07-15 01:18:56.000000000 -0700
+++ CDBI.pm 2005-11-09 21:32:38.002118272 -0800
@@ -116,7 +116,9 @@
eval {
$obj =
$self->create_from_cgi( $h =>
- { required => $r->{config}{ $r->{table} }{required_cols} || [], }
+ { required => $r->{config}{ $r->{table} }{required_cols} || [],
+ ignore => $r->{config}{ $r->{table} }{ignore_cols} || [],
+ }
);
};
if ($fatal = $@) {