use URI::https;
use URI::QueryParam;
use HTTP::Headers;
-
+use Stream::Buffered;
+use Hash::MultiValue;
+use Scalar::Util;
+use Catalyst::Exception;
use Moose;
use namespace::clean -except => 'meta';
with 'MooseX::Emulate::Class::Accessor::Fast';
-has env => (is => 'ro', writer => '_set_env', predicate => 'has_env');
+has env => (is => 'ro', writer => '_set_env', predicate => '_has_env');
# XXX Deprecated crap here - warn?
has action => (is => 'rw');
# XXX: Deprecated in docs ages ago (2006), deprecated with warning in 5.8000 due
has match => (is => 'rw');
has method => (is => 'rw');
has protocol => (is => 'rw');
-has query_parameters => (is => 'rw', default => sub { {} });
+has query_parameters => (is => 'rw', lazy=>1, default => sub { shift->_use_hash_multivalue ? Hash::MultiValue->new : +{} });
has secure => (is => 'rw', default => 0);
has captures => (is => 'rw', default => sub { [] });
has uri => (is => 'rw', predicate => 'has_uri');
has io_fh => (
is=>'ro',
- predicate=>'has_io_fh',
+ predicate=>'_has_io_fh',
lazy=>1,
builder=>'_build_io_fh');
sub _build_io_fh {
my $self = shift;
return $self->env->{'psgix.io'}
+ || (
+ $self->env->{'net.async.http.server.req'} &&
+ $self->env->{'net.async.http.server.req'}->stream) ## Until I can make ioasync cabal see the value of supportin psgix.io (jnap)
|| die "Your Server does not support psgix.io";
};
sub _build_body_data {
my ($self) = @_;
- my $content_type = $self->content_type;
+
+ # Not sure if these returns should not be exceptions...
+ my $content_type = $self->content_type || return;
+ return unless ($self->method eq 'POST' || $self->method eq 'PUT');
+
my ($match) = grep { $content_type =~/$_/i }
keys(%{$self->data_handlers});
local $_ = $fh;
return $self->data_handlers->{$match}->($fh, $self);
} else {
- return undef;
+ Catalyst::Exception->throw("$content_type is does not have an available data handler");
}
}
+has _use_hash_multivalue => (
+ is=>'ro',
+ required=>1,
+ default=> sub {0});
+
# Amount of data to read from input on each pass
our $CHUNKSIZE = 64 * 1024;
my $parameters = {};
my $body_parameters = $self->body_parameters;
my $query_parameters = $self->query_parameters;
+
+ if($self->_use_hash_multivalue) {
+ return Hash::MultiValue->new($query_parameters->flatten, $body_parameters->flatten);
+ }
+
# We copy, no references
foreach my $name (keys %$query_parameters) {
my $param = $query_parameters->{$name};
sub prepare_body {
my ( $self ) = @_;
- #warn "XXX ${\$self->_uploadtmp}" if $self->_has_uploadtmp;
+ # If previously applied middleware created the HTTP::Body object, then we
+ # just use that one.
- if(my $plack_body = $self->env->{'plack.request.http.body'}) {
- warn "wtF" x 100;
+ if(my $plack_body = $self->_has_env ? $self->env->{'plack.request.http.body'} : undef) {
$self->_body($plack_body);
- $self->_body->cleanup(1); # Make extra sure!
- $self->_body->tmpdir( $self->_uploadtmp )
- if $self->_has_uploadtmp;
- } else {
-
+ $self->_body->cleanup(1);
+ return;
}
- if ( my $length = $self->_read_length ) {
- unless ( $self->_body ) {
- my $type = $self->header('Content-Type');
- $self->_body(HTTP::Body->new( $type, $length ));
- $self->_body->cleanup(1); # Make extra sure!
- $self->_body->tmpdir( $self->_uploadtmp )
- if $self->_has_uploadtmp;
- }
+ # If there is nothing to read, set body to naught and return. This
+ # will cause all body code to be skipped
- # Check for definedness as you could read '0'
- while ( defined ( my $buffer = $self->read() ) ) {
- $self->prepare_body_chunk($buffer);
- }
+ return $self->_body(0) unless my $length = $self->_read_length;
- # paranoia against wrong Content-Length header
- my $remaining = $length - $self->_read_position;
- if ( $remaining > 0 ) {
- Catalyst::Exception->throw(
- "Wrong Content-Length value: $length" );
- }
- }
- else {
- # Defined but will cause all body code to be skipped
- $self->_body(0);
- }
-}
+ # Unless the body has already been set, create it. Not sure about this
+ # code, how else might it be set, but this was existing logic.
-sub prepare_bodyXXX {
- my ( $self ) = @_;
- if(my $plack_body = $self->env->{'plack.request.http.body'}) {
-
+ unless ($self->_body) {
+ my $type = $self->header('Content-Type');
+ $self->_body(HTTP::Body->new( $type, $length ));
+ $self->_body->cleanup(1);
- } else {
+ # JNAP: I'm not sure this is doing what we expect, but it also doesn't
+ # seem to be hurting (seems ->_has_uploadtmp is true more than I would
+ # expect.
+ $self->_body->tmpdir( $self->_uploadtmp )
+ if $self->_has_uploadtmp;
}
- die "XXX ${\$self->_uploadtmp}" x1000; $self->_has_uploadtmp;
-
- if ( my $length = $self->_read_length ) {
- unless ( $self->_body ) {
-
- ## If something plack middle already ready the body, just use
- ## that.
-
- my $body;
- if(my $plack_body = $self->env->{'plack.request.http.body'}) {
- $body = $plack_body;
- } else {
- my $type = $self->header('Content-Type');
- $body = HTTP::Body->new($type, $length);
-
- ## Play nice with Plak Middleware that looks for a body
- $self->env->{'plack.request.http.body'} = $body;
- $self->_body($body);
+ # Ok if we get this far, we have to read psgi.input into the new body
+ # object. Lets play nice with any plack app or other downstream, so
+ # we create a buffer unless one exists.
+
+ my $stream_buffer;
+ if ($self->env->{'psgix.input.buffered'}) {
+ # Be paranoid about previous psgi middleware or apps that read the
+ # input but didn't return the buffer to the start.
+ $self->env->{'psgi.input'}->seek(0, 0);
+ } else {
+ $stream_buffer = Stream::Buffered->new($length);
+ }
- $body->cleanup(1); # Make extra sure!
- $body->tmpdir( $self->_uploadtmp )
- if $self->_has_uploadtmp;
- }
- }
+ # Check for definedness as you could read '0'
+ while ( defined ( my $chunk = $self->read() ) ) {
+ $self->prepare_body_chunk($chunk);
+ $stream_buffer->print($chunk) if $stream_buffer;
+ }
- # Check for definedness as you could read '0'
- while ( defined ( my $buffer = $self->read() ) ) {
- $self->prepare_body_chunk($buffer);
- }
+ # Ok, we read the body. Lets play nice for any PSGI app down the pipe
- # paranoia against wrong Content-Length header
- my $remaining = $length - $self->_read_position;
- if ( $remaining > 0 ) {
- Catalyst::Exception->throw(
- "Wrong Content-Length value: $length" );
- }
+ if ($stream_buffer) {
+ $self->env->{'psgix.input.buffered'} = 1;
+ $self->env->{'psgi.input'} = $stream_buffer->rewind;
+ } else {
+ $self->env->{'psgi.input'}->seek(0, 0); # Reset the buffer for downstream middleware or apps
}
- else {
- # Defined but will cause all body code to be skipped
- $self->_body(0);
+
+ # paranoia against wrong Content-Length header
+ my $remaining = $length - $self->_read_position;
+ if ( $remaining > 0 ) {
+ Catalyst::Exception->throw("Wrong Content-Length value: $length" );
}
}
-
sub prepare_body_chunk {
my ( $self, $chunk ) = @_;
my ( $self ) = @_;
$self->prepare_body if ! $self->_has_body;
- return {} unless $self->_body;
- return $self->_body->param;
+ unless($self->_body) {
+ return $self->_use_hash_multivalue ? Hash::MultiValue->new : {};
+ }
+
+ return $self->_use_hash_multivalue ?
+ Hash::MultiValue->from_mixed($self->_body->param) :
+ $self->_body->param;
}
sub prepare_connection {
$req->uri;
$req->user;
$req->user_agent;
+ $req->env;
See also L<Catalyst>, L<Catalyst::Request::Upload>.
method. You may define addition data_handlers via a global configuration
setting. See L<Catalyst\DATA HANDLERS> for more information.
+If the POST is malformed in some way (such as undefined or not content that
+matches the content-type) we raise a L<Catalyst::Exception> with the error
+text as the message.
+
+If the POSTed content type does not match an availabled data handler, this
+will also raise an exception.
+
=head2 $req->body_parameters
Returns a reference to a hash containing body (POST) parameters. Values can
cause a hash initialization error. For a more straightforward interface see
C<< $c->req->parameters >>.
+B<NOTE> Interfaces like this, which are based on L<CGI> and the C<param> method
+are now known to cause demonstrated exploits. It is highly recommended that you
+avoid using this method, and migrate existing code away from it. Here's the
+whitepaper of the exploit:
+
+L<http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/>
+
+Basically this is an exploit that takes advantage of how L<\param> will do one thing
+in scalar context and another thing in list context. This is combined with how Perl
+chooses to deal with duplicate keys in a hash definition by overwriting the value of
+existing keys with a new value if the same key shows up again. Generally you will be
+vulnerale to this exploit if you are using this method in a direct assignment in a
+hash, such as with a L<DBIx::Class> create statement. For example, if you have
+parameters like:
+
+ user?user=123&foo=a&foo=user&foo=456
+
+You could end up with extra parameters injected into your method calls:
+
+ $c->model('User')->create({
+ user => $c->req->param('user'),
+ foo => $c->req->param('foo'),
+ });
+
+Which would look like:
+
+ $c->model('User')->create({
+ user => 123,
+ foo => qw(a user 456),
+ });
+
+(or to be absolutely clear if you are not seeing it):
+
+ $c->model('User')->create({
+ user => 456,
+ foo => 'a',
+ });
+
+Possible remediations include scrubbing your parameters with a form validator like
+L<HTML::FormHandler> or being careful to force scalar context using the scalar
+keyword:
+
+ $c->model('User')->create({
+ user => scalar($c->req->param('user')),
+ foo => scalar($c->req->param('foo')),
+ });
+
+Upcoming versions of L<Catalyst> will disable this interface by default and require
+you to positively enable it should you require it for backwards compatibility reasons.
+
=cut
sub param {
return keys %{ $self->parameters };
}
- if ( @_ == 1 ) {
+ # If anything in @_ is undef, carp about that, and remove it from
+ # the list;
+
+ my @params = grep { defined($_) ? 1 : do {carp "You called ->params with an undefined value"; 0} } @_;
+
+ if ( @params == 1 ) {
- my $param = shift;
+ defined(my $param = shift @params) ||
+ carp "You called ->params with an undefined value 2";
unless ( exists $self->parameters->{$param} ) {
return wantarray ? () : undef;
: $self->parameters->{$param};
}
}
- elsif ( @_ > 1 ) {
- my $field = shift;
- $self->parameters->{$field} = [@_];
+ elsif ( @params > 1 ) {
+ my $field = shift @params;
+ $self->parameters->{$field} = [@params];
}
}
If parameters have already been set will clear the parameters and build them again.
+=head2 $self->env
+
+Access to the raw PSGI env.
=head2 meta