Discussion:
[Mason-devel] Filters Extension
Daniel Zulla
2010-05-31 12:30:04 UTC
Permalink
Hi,

i want sugget an input filter, based on MooseX::Types, cause i just think
if the variables given to your application
don't match your needs, you shouldn't continue the execution. that improves
security and performance. example given:
if you expect an integer<5-100> as $foo, but you get a string, you don't
have to go on, and execute the sql statement,
cause you already know, it will fail.

i wrote am example extension for the lexer [1] and the compiler [2], and a
in-use example [3].

if the parameters don't match, or if the request method is wrong, a default
error template, showing the specified error messages,
should be delivered - unless no <%callback> is set.

line 60-61 in compiler.txt is calling is_Int from Moose, checking if the
paremeter is an integer.

what do you guys think about it?

greets,
scio

[1] Lexer Code: http://scix.de/lexical.txt
[2] Compiler Code: http://scix.de/compiler.txt
[3] In-Use Example: http://scix.de/in_use.txt
Jonathan Swartz
2010-06-11 22:57:55 UTC
Permalink
That looks nice Daniel!

Is this written in a way that it can be used as an extension, or would
it have to be added to the core?

Jon
Post by Daniel Zulla
Hi,
i want sugget an input filter, based on MooseX::Types, cause i just think
if the variables given to your application
don't match your needs, you shouldn't continue the execution. that improves
if you expect an integer<5-100> as $foo, but you get a string, you don't
have to go on, and execute the sql statement,
cause you already know, it will fail.
i wrote am example extension for the lexer [1] and the compiler [2], and a
in-use example [3].
if the parameters don't match, or if the request method is wrong, a default
error template, showing the specified error messages,
should be delivered - unless no <%callback> is set.
line 60-61 in compiler.txt is calling is_Int from Moose, checking if the
paremeter is an integer.
what do you guys think about it?
greets,
scio
[1] Lexer Code: http://scix.de/lexical.txt
[2] Compiler Code: http://scix.de/compiler.txt
[3] In-Use Example: http://scix.de/in_use.txt
------------------------------------------------------------------------------
_______________________________________________
Mason-devel mailing list
https://lists.sourceforge.net/lists/listinfo/mason-devel
Daniel Zulla
2010-06-14 09:39:25 UTC
Permalink
At the moment, it would have to be directly added to the core.
Mason should solve "common problems of site development" - so why not
security too.
And adding security by an extension, isn't a good idea.

for the core, my impression looks like:
<%args>
<%need:Int[1-100]:$foo>No Int</%need>
<%need:Str:$bar>No Str</%need>
<%opt:Int:$error></%opt>
<%e:custom>
</%args>
<html>
<%ifdef:$error><%=>Error Occured $table{$error}</%=>
[loginform ...]
<%exception:custom>
errors: $__E[0], $__E[1] # no int, no str
</%exception>

or something like that.
if you like it; would be glad to implement it.

h() could be written in XS too btw. If there's a mason application in
really productional use, this method is called so damn often, that C would
improve performance. :)

A <%minify> tag for <%minify:css> (Minify::CSS::XS) and <%minify:js>
(Minify::JavaScript::XS) is worth a thougt about it too.

--
scio
Post by Jonathan Swartz
That looks nice Daniel!
Is this written in a way that it can be used as an extension, or would
it have to be added to the core?
Jon
Continue reading on narkive:
Loading...