| Subject: | untainted multiline fields in FV_length methods are truncated |
The method used to untaint values in FV_length_* constraints will remove
everything after the first newline.
I've attached a patch which fixes the problem and provides additional tests.
| Subject: | untaint_fv_length.diff |
--- lib/Data/FormValidator/Constraints.pm Sat Jan 3 17:12:02 2009
+++ lib/Data/FormValidator/Constraints.pm Tue Mar 10 14:29:29 2009
@@ -279,7 +279,7 @@
$dfv->name_this('length_between');
return undef if ( ( length($value) > $max ) || ( length($value) < $min) );
# Use a regexp to untaint
- $value=~/(.*)/;
+ $value=~/(.*)/s;
return $dfv->untainted_constraint_value($1);
}
}
@@ -292,7 +292,7 @@
$dfv->name_this('max_length');
return undef if ( length($value) > $max );
# Use a regexp to untaint
- $value=~/(.*)/;
+ $value=~/(.*)/s;
return $dfv->untainted_constraint_value($1);
}
}
@@ -305,7 +305,7 @@
$dfv->name_this('min_length');
return undef if ( length($value) < $min );
# Use a regexp to untaint
- $value=~/(.*)/;
+ $value=~/(.*)/s;
return $dfv->untainted_constraint_value($1);
}
}
--- t/FV_length.t Sat Jan 3 17:12:02 2009
+++ t/FV_length.t Tue Mar 10 14:31:03 2009
@@ -41,7 +41,7 @@
# Test multi-line input: someone might be using this for a textarea or somesuch
my $multiline_result = Data::FormValidator->check(
- {
+ my $expect = {
alpha => "apple\naeroplane\n", # 16 char
beta => "bus\nbuffalo\n", # 12 char
charlie => "cat\ncoconut\ncoffee\n", # 19 char
@@ -52,6 +52,7 @@
},
{
required => [qw/alpha beta charlie delta echo foxtrot golf/],
+ untaint_all_constraints => 1,
constraint_methods => {
alpha => FV_max_length(16), # max length
beta => FV_max_length(11), # too long
@@ -71,6 +72,11 @@
ok( $multiline_result->valid('echo'), 'multiline FV_length_between in bounds');
ok( $multiline_result->invalid('foxtrot'), 'multiline FV_length_between too short');
ok( $multiline_result->invalid('golf'), 'multiline FV_length_between too long' );
+
+# check expected values for valid untainted fields
+for my $field (qw( alpha charlie echo )) {
+ is( $multiline_result->valid($field), $expect->{$field}, "identity $field");
+}
# Test "long" results. Early implementations checked length with
# regular expressions which limit length options to 32kb.