X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=blobdiff_plain;f=lib%2FCatalyst%2FAction%2FDeserialize%2FData%2FSerializer.pm;h=8b1df7c9fb724f5568ed895ca9bd286d9733a19f;hb=d91664fd395a48d880bdfdccb0cdefd0d5d9f5f3;hp=1aea6c4fd9ed1a373c03631a1bd98fd39ffeb0fb;hpb=930013e6f19b25a090c3f8839495ad8d9b15ff6d;p=catagits%2FCatalyst-Action-REST.git

diff --git a/lib/Catalyst/Action/Deserialize/Data/Serializer.pm b/lib/Catalyst/Action/Deserialize/Data/Serializer.pm
index 1aea6c4..8b1df7c 100644
--- a/lib/Catalyst/Action/Deserialize/Data/Serializer.pm
+++ b/lib/Catalyst/Action/Deserialize/Data/Serializer.pm
@@ -5,6 +5,12 @@ use namespace::autoclean;
 
 extends 'Catalyst::Action';
 use Data::Serializer;
+use Safe;
+my $compartment = Safe->new;
+$compartment->permit_only( qw(padany null lineseq const pushmark list anonhash anonlist refgen leaveeval undef) );
+
+our $VERSION = '0.91';
+$VERSION = eval $VERSION;
 
 sub execute {
     my $self = shift;
@@ -31,11 +37,18 @@ sub execute {
             }
             close(BODY);
         }
-        my $dso = Data::Serializer->new( serializer => $serializer );
         my $rdata;
-        eval {
-            $rdata = $dso->raw_deserialize($rbody);
-        };
+        if ( $serializer eq "Data::Dumper" ) {
+            # Taken from Data::Serialize::Data::Dumper::deserialize, but run within a Safe compartment
+            my $code = $rbody =~ /^\{/ ? "+".$rbody : $rbody;
+            $rdata = $compartment->reval( $code );
+        }
+        else {
+            my $dso = Data::Serializer->new( serializer => $serializer );
+            eval {
+                $rdata = $dso->raw_deserialize($rbody);
+            };
+        }
         if ($@) {
             return $@;
         }
@@ -48,4 +61,6 @@ sub execute {
     return 1;
 }
 
+__PACKAGE__->meta->make_immutable;
+
 1;