Skip to content

Commit

Permalink
Ask CGI to not warn about param() in list context.
Browse files Browse the repository at this point in the history
Mason protects from the class of param() bugs which allow users to sneak in
arguments as described here:
http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/

Since CGI.pm 4.05 the only way to quiet this warning is by setting their
variable as documented here
https://metacpan.org/pod/CGI#Fetching-the-value-or-values-of-a-single-named-parameter

Mason has always allowed foo=1&foo=2 to end up available in a template
as @foo = (1,2) so retain backcompat.

Quiets a warning in t/14-cgi.t tied to faking up CGI.pm
  • Loading branch information
jibsheet committed Nov 11, 2014
1 parent fe60fc8 commit 59a9d7f
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 1 deletion.
1 change: 1 addition & 0 deletions lib/HTML/Mason/Utils.pm
Expand Up @@ -42,6 +42,7 @@ sub cgi_request_args

foreach my $key ( map { $q->$_() } @methods ) {
next if exists $args{$key};
local $CGI::LIST_CONTEXT_WARN = 0;
my @values = map { $q->$_($key) } @methods;
$args{$key} = @values == 1 ? $values[0] : \@values;
}
Expand Down
2 changes: 1 addition & 1 deletion t/14-cgi.t
Expand Up @@ -29,7 +29,7 @@ use CGI qw(-no_debug); # Prevent "(offline mode: enter name=value pairs on stan
%interp_params,
);

eval { $self->_execute($interp) };
eval { local $CGI::LIST_CONTEXT_WARN = 0; $self->_execute($interp) };

return $self->check_result($@);
}
Expand Down

0 comments on commit 59a9d7f

Please sign in to comment.