| Subject: | add option to untaint? |
I think it would be *very* convenient if Params::Validate could (optionally) untaint parameters. I envision an optional 'untaint' key in the validation spec for each argument in which untainting is desired. Possible values for this key could be a regex (with appropriate parentheses such that the value could be replaced with $1) or a supplied code reference. Untainting should occur only after the parameter passes all other validation requirements. Here's an example of usage:
my %args =
validate( @_,
foo =>
{ type => SCALAR,
untaint => sub {
my $handler = CGI::Untaint->new({ url => $_[0] });
return $handler->extract(-as_url => 'url');
},
bar =>
{ type => SCALAR,
regex => qr/^\d+$/,
callbacks =>
{ # ... and smaller than 90
'less than 90' => sub { shift() < 90 },
},
untaint => qr/^(\d+)$/,
}
}
);
Web developers that use Params::Validate currently have to untaint all parameters after validation. It would be great if Params::Validate could subsume this task, especially since parameter validation and untainting are very much related.
While adding this capability to Params::Validate would put it in competition with CGI::Untaint to some degree, they could also complement each other, as seen in the above example with the code reference. In the simpler cases of regex validation, untainting with Params::Validate would be vastly easier than implementing the same thing in CGI::Untaint, but CGI::Untaint would still be useful for more complex things like e-mail and URL address untainting, for example.