[rt.cpan.org 76314] Untaint externally supplied domains.

Resolves part of the ticket reported by Dylan Doxey. Thank you for the test case, Dylan!
rcaputo · Apr 29, 2012 · 5f22fca · 5f22fca
1 parent 88d27d6
commit 5f22fca
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/lib/POE/Wheel/SocketFactory.pm b/lib/POE/Wheel/SocketFactory.pm
@@ -495,7 +495,13 @@ sub new {
 
   # Default to Internet sockets.
   my $domain = delete $params{SocketDomain};
-  $domain = AF_INET unless defined $domain;
+  if (defined $domain) {
+    # [rt.cpan.org 76314] Untaint the domain.
+    ($domain) = ($domain =~ /\A(.*)\z/);
+  }
+  else {
+    $domain = AF_INET;
+  }
   $self->[MY_SOCKET_DOMAIN] = $domain;
 
   # Abstract the socket domain into something we don't have to keep