Beefy Boxes and Bandwidth Generously Provided by pair Networks
good chemistry is complicated,
and a little bit messy -LW
 
PerlMonks  

Re: Moose types & taint removal?

by ikegami (Pope)
on Aug 11, 2010 at 19:23 UTC ( #854487=note: print w/replies, xml ) Need Help??


in reply to Moose types & taint removal?

The best way might be to have a Trait that removes the tainting on assignment.

subtype 'FilePath' => as 'Str' => where { m{^[\w/_.-]{1,80}\z} } => message { "I don't trust file name '$_'" }; has logfile => ( traits => [qw( Untaint )], is => 'rw', isa => 'FilePath', default => '/var/log/walrus.log', );

Or if you want to allow any untainted value:

subtype 'FilePath' => as 'Str' => where { !tainted($_) || m{^[\w/_.-]{1,80}\z} } => message { "I don't trust file name '$_'" }; has logfile => ( traits => [qw( Untaint )], is => 'rw', isa => 'FilePath', default => '/var/log/walrus.log', );

However, I don't see anything like that on CPAN, and writing it is bound to be a bit complex. Instead, you could use coercion.

subtype 'FilePath' => as 'Str' => where { m{^[\w/_.-]{1,80}\z} } => message { "I don't trust file name '$_'" }; coerce 'FilePath' => from 'Str' => via { /(.*)/s; $1 }; # Will be validated soon. has logfile => ( is => 'rw', isa => 'FilePath', default => '/var/log/walrus.log', coerce => 1, );

As you can see, it's a bit icky since the tainting has to be removed before the validation. Also, it prevents having a looser check when the value isn't tainted.

Untested.

Notes:

  • Removed useless captures from regex patterns for speed.
  • Substituted "\z" for "$" since "$" can allow a newline.
  • "\w" is includes a suprising number of characters. You may want to pick something stricter.
  • "_" is already included in "\w".
  • Removed useless escaping from character classes for readability.

Replies are listed 'Best First'.
Re^2: Moose types & taint removal?
by pileofrogs (Priest) on Aug 12, 2010 at 16:28 UTC
Re^2: Moose types & taint removal?
by pileofrogs (Priest) on Aug 12, 2010 at 21:02 UTC

    As I have no idea how to approach this with a Trait, I've gone the coerce route. Your example almost works, with the exception that your subtype needs to check for tainted-ness in order to untaint an acceptable string. It won't do coercion if the where clause is satisfied by the original string.

    You Rule!

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://854487]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others wandering the Monastery: (3)
As of 2020-07-13 11:49 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found

    Notices?