Hi,

I am trying to write a module (which it is not yet, just a test script it is) for automatically filtering input submitted from the web. I plan to mark every variable in forms or queries like i_var or a_var, which then get classified by the module.

I would be very glad, if someone with real Perl knowledge would have a look at the code and tell me what problems could arise, whether there is already a module I could use, or could give me tips about it in general.


Thanks in advance 


#!/usr/bin/perl

use strict;
use warnings;

use CGI::Lite;

my %fd;
my $DO_DIE=0;
my $VALID_NAME='[^0-9a-zA-Z_]';
my $BOUNDARY=2;
my %REGS;

####regs
$REGS{'b_'}='[^0-1]';            #bool
$REGS{'i_'}='[^0-9\.]';            #int,float?
$REGS{'a_'}='[^0-9a-zA-Z_\.]';        #alphanumeric
$REGS{'c_'}='[^0-9a-zA-Z_:\.]';        #cmd
$REGS{'p_'}='[^0-9a-zA-Z_\.\/]';    #path
$REGS{'t_'}='[.*]';            #text
#...
####/regs

%fd=&get_form_data;
# use Data::Dumper;
# print Dumper(\%fd);

sub get_form_data
{
  my $cgi = new CGI::Lite;
  my %_fd=$cgi->parse_form_data;
   foreach (keys(%_fd))
  {
    if (&is_valid_name($_))
    {  
      $_fd{$_}=$_fd{$_}[0] if ref($_fd{$_};
      my $chk=&is_valid_value($_,$_fd{$_});
      if ($chk == undef)
      {
        die "wrong value" if $DO_DIE;
        delete $_fd{$_};
      }
    }
    else
    {
      die "wrong variable name" if $DO_DIE;
      delete $_fd{$_};
    }
  }
  return %_fd;
}

sub is_valid_value
{
  my $n=shift;
  my $v=shift;
  my $v_id=substr($n,0,$BOUNDARY);
  #empty errror
  #or is empty value okay? 
  if ($n && $v_id && $REGS{$v_id})
  {
    return ($v=~/$REGS{$v_id}/)?undef:1;
  }
  else
  {
    return undef;
  }
}

sub is_valid_name
{
  return (shift =~/$VALID_NAME/)?0:1;
}

[download]
special defects

In reply to Web Security by eternius

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.