X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=blobdiff_plain;f=lib%2FCatalyst%2FAction%2FDeserialize%2FData%2FSerializer.pm;h=e19d460ba4c1d825a8a22f378680d4ae2da5f1a0;hb=0fd45d2a3fbf41c788823c527f4c325cf6368c7c;hp=35917ec7d3b01ec4c75a4fd4e8dcbf209a190c69;hpb=7ad87df957f65463dba321ebe616e2581b7ff58f;p=catagits%2FCatalyst-Action-REST.git diff --git a/lib/Catalyst/Action/Deserialize/Data/Serializer.pm b/lib/Catalyst/Action/Deserialize/Data/Serializer.pm index 35917ec..e19d460 100644 --- a/lib/Catalyst/Action/Deserialize/Data/Serializer.pm +++ b/lib/Catalyst/Action/Deserialize/Data/Serializer.pm @@ -1,38 +1,64 @@ -# -# Catalyst::Action::Deserialize::Data::Serializer.pm -# Created by: Adam Jacob, Marchex, -# Created on: 10/12/2006 03:00:32 PM PDT -# -# $Id$ - package Catalyst::Action::Deserialize::Data::Serializer; -use strict; -use warnings; +use Moose; +use namespace::autoclean; -use base 'Catalyst::Action'; +extends 'Catalyst::Action'; use Data::Serializer; +use Safe; +my $compartment = Safe->new; +$compartment->permit_only( qw(padany null lineseq const pushmark list anonhash anonlist refgen leaveeval undef) ); + +our $VERSION = '0.85'; +$VERSION = eval $VERSION; sub execute { my $self = shift; my ( $controller, $c, $serializer ) = @_; - + + my $sp = $serializer; + $sp =~ s/::/\//g; + $sp .= ".pm"; + eval { + require $sp + }; + if ($@) { + $c->log->debug("Could not load $serializer, refusing to serialize: $@") + if $c->debug; + return 0; + } my $body = $c->request->body; if ($body) { my $rbody; - if (-f $c->request->body) { - open(BODY, "<", $c->request->body); - while (my $line = ) { + if ( -f $c->request->body ) { + open( BODY, "<", $c->request->body ); + while ( my $line = ) { $rbody .= $line; } close(BODY); } - my $dso = Data::Serializer->new(serializer => $serializer); - my $rdata = $dso->raw_deserialize($rbody); + my $rdata; + if ( $serializer eq "Data::Dumper" ) { + # Taken from Data::Serialize::Data::Dumper::deserialize, but run within a Safe compartment + my $code = $rbody =~ /^\{/ ? "+".$rbody : $rbody; + $rdata = $compartment->reval( $code ); + } + else { + my $dso = Data::Serializer->new( serializer => $serializer ); + eval { + $rdata = $dso->raw_deserialize($rbody); + }; + } + if ($@) { + return $@; + } $c->request->data($rdata); } else { - $c->log->debug('I would have deserialized, but there was nothing in the body!'); + $c->log->debug( + 'I would have deserialized, but there was nothing in the body!') + if $c->debug; } -}; + return 1; +} 1;