projects / catagits/Catalyst-Action-REST.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw
Version 1.04
[catagits/Catalyst-Action-REST.git] / lib / Catalyst / Action / Deserialize / Data / Serializer.pm
diff --git a/lib/Catalyst/Action/Deserialize/Data/Serializer.pm b/lib/Catalyst/Action/Deserialize/Data/Serializer.pm
index 4a49c8a..81200ec 100644 (file)
--- a/lib/Catalyst/Action/Deserialize/Data/Serializer.pm
+++ b/lib/Catalyst/Action/Deserialize/Data/Serializer.pm
@@ -5,8 +5,12 @@ use namespace::autoclean;
 
 extends 'Catalyst::Action';
 use Data::Serializer;
+use Safe;
+use Scalar::Util qw(openhandle);
+my $compartment = Safe->new;
+$compartment->permit_only( qw(padany null lineseq const pushmark list anonhash anonlist refgen leaveeval undef) );
 
-our $VERSION = '0.83';
+our $VERSION = '1.04';
 $VERSION = eval $VERSION;
 
 sub execute {
@@ -26,19 +30,29 @@ sub execute {
     }
     my $body = $c->request->body;
     if ($body) {
-        my $rbody;
-        if ( -f $c->request->body ) {
-            open( BODY, "<", $c->request->body );
-            while ( my $line = <BODY> ) {
+        my $rbody = '';
+
+        if(openhandle $body) {
+            seek($body, 0, 0); # in case something has already read from it
+            while ( defined( my $line = <$body> ) ) {
                 $rbody .= $line;
             }
-            close(BODY);
+        } else {
+            $rbody = $body;
         }
-        my $dso = Data::Serializer->new( serializer => $serializer );
+
         my $rdata;
-        eval {
-            $rdata = $dso->raw_deserialize($rbody);
-        };
+        if ( $serializer eq "Data::Dumper" ) {
+            # Taken from Data::Serialize::Data::Dumper::deserialize, but run within a Safe compartment
+            my $code = $rbody =~ /^\{/ ? "+".$rbody : $rbody;
+            $rdata = $compartment->reval( $code );
+        }
+        else {
+            my $dso = Data::Serializer->new( serializer => $serializer );
+            eval {
+                $rdata = $dso->raw_deserialize($rbody);
+            };
+        }
         if ($@) {
             return $@;
         }
@@ -51,4 +65,6 @@ sub execute {
     return 1;
 }
 
+__PACKAGE__->meta->make_immutable;
+
 1;
Catalyst-Action-REST