note
dragonchild
[cpan://CGI::Application] is meant to be subclassed. This means that you're supposed to write a class that uses it as a <i>starting point</i>. When I write C::A apps, I actually have 2-3 levels of baseclasses. The first one is my global baseclass. It's my version of what C::A should do. This includes providing a print() method that dispatches between HTML::Template, Excel::Template, and PDF::Template. I see no reason why you shouldn't go ahead and provide a param()-type method in your global baseclass that will untaint the parameters as you need them. You could even link it with CGI::Untaint as so:
<code>
sub cgiapp_prerun {
my $self = shift;
$self->param( handler => CGI::Untaint->new( $self->query->Vars ) );
return $self->SUPER::prerun( @_ );
}
sub extract {
my $self = shift;
my ($method, $name) = @_;
my $handler = $self->param( 'taint_handler' );
return $handler->extract( $method => $name );
}
</code>
Now, your calls to $self->extract() are wrappers around CGI::Untaint's extract(). Done.
<!-- Node text goes above. Div tags should contain sig only -->
<div class="pmsig"><div class="pmsig-85580">
<hr>
<ul>
<li>In general, if you think something isn't in Perl, try it out, because it usually is. :-)
<li>"What is the sound of Perl? Is it not the sound of a wall that people have stopped banging their heads against?"
</ul>
</div></div>
458388
458388