NAME
Apache2::TaintRequest - HTML Escape tainted data to prevent CSS Attacks
SYNOPSIS
use Apache2::TaintRequest ();
sub handler { my $r = shift; $r = Apache2::TaintRequest->new($r);
my $querystring = $r->query_string();
$r->print($querystring); # html is escaped...
$querystring =~ s/<script>//;
$r->print($querystring); # html is NOT escaped...
}
DESCRIPTION
Note: This code is derived from the *Apache::TaintRequest*
module, available as part of "The mod_perl Developer's
Cookbook".
One of the harder problems facing web developers involves dealing with
potential cross site scripting attacks. Frequently this involves many
calls to HTML::Entities::escape_html().
This module aims to automate this tedious process. It overrides the
print mechanism in the mod_perl Apache module. The new print method
tests each chunk of text for taintedness. If it is tainted we assume the
worst and html-escape it before printing.
Note that this module requires that you have the line
PerlSwitches -T
in your httpd.conf. This may have other unintended side effects, so be
warned.
SEE ALSO
perl(1), mod_perl(1), Apache(3), Taint, Apache::TaintRequest
http://perl.apache.org/docs/2.0/user/porting/compat.html#C_PerlTaintChec
k_
AUTHORS
Fred Moyer <
[email protected]>
COPYRIGHT
Apache2::TaintRequest Copryright (c) 2012, Fred Moyer
Apache::TaintRequest Copyright (c) 2001, Paul Lindner, Geoffrey Young,
Randy Kobes.
All rights reserved.
This module is free software. It may be used, redistributed and/or
modified under the same terms as Perl itself.
HISTORY
This code is derived from the *Apache::TaintRequest* module, available
on the CPAN.
