mia
/
cyberman
forked from .cyb/cyberman
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Separate record sanitisation tests 

Patch submitted by verax on IRC, checked and committed by albino
This commit is contained in:
verax 2017-08-19 23:56:21 +01:00
parent f97a931d13
commit d2499d551f
2 changed files with 29 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cpanfile
View File

@ -10,7 +10,6 @@ requires "DBD::SQLite" => "0";
requires "HTML::Entities" => "0";
requires "Digest::Bcrypt" => "0";
requires "Math::Random::Secure" => "0";
requires "Switch" => "0";
requires "Email::Simple" => "0";
requires "Email::Simple::Creator" => "0";
requires "Email::Sender::Simple" => "0";

53
lib/cyberman/Records.pm
View File

@ -2,7 +2,6 @@ package cyberman::Records;
use Dancer2 appname => "cyberman";
use Dancer2::Plugin::Database;
use Switch;
use cyberman::Helper;
@ -52,6 +51,31 @@ get '/domains/:name/records/add' => sub {
};
};
my %tests = ( IN => {
# Tests return 1 on invalid value, 0 on valid
A => sub {
my $val_l = shift;
if ($val_l !~ m/^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.|$)){4}$/) {
return 1;
}
return 0;
},
AAAA => sub {
my $val_l = shift;
if ($val_l !~ m/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/) {
return 1;
}
return 0;
},
NS => sub {
my $val_l = shift;
if ($val_l !~ m/^([a-zA-Z0-9]([a-zA-Z0-9-_]*[a-zA-Z0-9])?\.)+$/) {
return 1;
}
return 0;
},
});
post '/domains/:name/records/add' => sub {
my $domain = database->quick_select(
"domain",
@ -68,29 +92,10 @@ post '/domains/:name/records/add' => sub {
my %errs;
# tw overuse of regex
switch (param("type")) {
case "A" {
if (param("value") !~ m/^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.|$)){4}$/) {
# here we go...
$errs{"e_bad_value"} = 1;
}
}
case "AAAA" {
if (param("value") !~ m/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/) {
# I am sorry
$errs{"e_bad_value"} = 1;
}
}
case "NS" {
if (param("value") !~ m/^([a-zA-Z0-9]([a-zA-Z0-9-_]*[a-zA-Z0-9])?\.)+$/) {
$errs{"e_bad_value"} = 1;
}
}
else {
$errs{"e_bad_type"} = 1;
}
if ( ref($tests{param("type")}) == "CODE" ) {
$errs{"e_bad_value"} = 1 if &{$tests{IN}{param("type")}}(param("value"));
} else {
$errs{"e_bad_type"} = 1;
}
if (param("rname") !~ m/^(@|([a-zA-Z0-9]([a-zA-Z0-9-_]*[a-zA-Z0-9])?\.)*[a-zA-Z0-9]([a-zA-Z0-9-_]*[a-zA-Z0-9])?)$/) {