No description, website, or topics provided.
Switch branches/tags
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
lib/LWPx
t
xt
.gitignore
Build.PL
Changes
LICENSE
META.json
README.md
cpanfile

README.md

NAME

LWPx::ParanoidHandler - Handler for LWP::UserAgent that protects you from harm

SYNOPSIS

use LWPx::ParanoidHandler;
use LWP::UserAgent;

my $ua = LWP::UserAgent->new();
make_paranoid($ua);

my $res = $ua->request(GET 'http://127.0.0.1/');
# my $res = $ua->request(GET 'http://google.com/');
use Data::Dumper; warn Dumper($res);
warn $res->status_line;

DESCRIPTION

LWPx::ParanoidHandler is a clever firewall for LWP::UserAgent.

This module provides a handler to prevent a request from reaching or being (re)directed to internal servers, loopbacks, or multicast addresses.

It is useful when implementing OpenID servers, crawlers, etc.

FUNCTIONS

  • make_paranoid($ua[, $dns]);

    Make your LWP::UserAgent instance paranoid.

    The optional $dns argument is an instance of Net::DNS::Paranoid. Useful if you want to add your own blocked_hosts or whitelisted_hosts, or adjust the timeout on DNS lookups.

FAQ

  • How can I set a timeout for the whole request?

    LWP::UserAgent does not provide a timeout over the whole request (its timeout is only on inactivity on the server connection). Since LWPx::ParanoidHandler uses LWP::UserAgent's handler protocol, it cannot change this.

    You may want to protect your whole request with a timeout to stop it getting stuck in a malicious tar-pit (as provided by the timeout in LWPx::ParanoidAgent).

    You can do this as follows by using alarm():

      my $res = eval {
          local $SIG{ALRM} = sub { die "ALRM\n" };
          alarm(10);
          my $res = $ua->get($url);
          alarm(0);
          $res;
      };
      $res = HTTP::Response->new(500, 'Timeout') unless $res;
    

    And I recommend using Furl. Furl can handle per-request timeouts cleanly.

AUTHOR

Tokuhiro Matsuno <tokuhirom AAJKLFJEF@ GMAIL COM>

SEE ALSO

LWPx::ParanoidAgent has the same feature as this module. But it's not currently maintained, and it's too hack-ish. LWPx::ParanoidHandler uses the handler protocol provided by LWP::UserAgent, which is safer.

This module uses a lot of code taken from LWPx::ParanoidAgent, thanks.

LICENSE

Copyright (C) Tokuhiro Matsuno

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.