[prev in list] [next in list] [prev in thread] [next in thread] 

List:       mason-cvs
Subject:    [Mason-checkins] CVS: mason/dist/lib/HTML/Mason Escapes.pm,NONE,1.1
From:       Dave Rolsky <autarch () users ! sourceforge ! net>
Date:       2002-09-29 21:00:48
[Download RAW message or body]

Update of /cvsroot/mason/mason/dist/lib/HTML/Mason
In directory usw-pr-cvs1:/tmp/cvs-serv22378

Added Files:
	Escapes.pm 
Log Message:
first version of spiffy new module


--- NEW FILE ---
# Copyright (c) 1998-2002 by Jonathan Swartz. All rights reserved.
# This program is free software; you can redistribute it and/or modify it
# under the same terms as Perl itself.

#
# A library of escape subroutines to be used for substitution escaping
#

package HTML::Mason::Escapes;

use strict;

use HTML::Mason::Tools qw(load_pkg);

my %html_escape = ('&' => '&amp;', '>'=>'&gt;', '<'=>'&lt;', '"'=>'&quot;');
my $html_escape = qr/([&<>"])/;

sub basic_html_escape
{
    return unless defined ${ $_[0] };

    ${ $_[0] } =~ s/$html_escape/$html_escape{$1}/mg;
}

sub html_entities_escape
{
    return unless defined ${ $_[0] };

    load_pkg( 'HTML::Entities',
              'HTML escaping requires the HTML::Entities module, available from CPAN.');

    HTML::Entities::encode_entities( ${ $_[0] } );
}

sub url_escape
{
    return unless defined ${ $_[0] };

    ${ $_[0] } =~ s/([^a-zA-Z0-9_.-])/uc sprintf("%%%02x",ord($1))/eg;
}


1;

__END__

=head1 NAME

HTML::Mason::Escapes - Function library used internally in Mason

=head1 DESCRIPTION

This module contains exportable functions that are intended to be used
by other Mason modules.

=item html_entities_escape

This function takes a string reference and HTML-escapes it using the
C<HTML::Entities> module.  By default, this module assumes that the
string it is escaping is in ISO-8859-1 (pre Perl 5.8.0) or UTF-8 (Perl
5.8.0 onwards).  If this is not the case for your data, you will want
to override this escape to do the right thing for your encoding.  See
the section on L<User-defined Escapes in the Developer's
Manual|HTML::Mason::Devel/User-defined Escapes> for more details on
how to do this.

=item uri_escape

This takes a scalar reference and replaces any text it contains
matching C<[^a-zA-Z0-9_.-]> with the URI-escaped equivalent, a percent
sign (%) followed by the hexadecimal number of that character.

=item basic_html_escape

This function takes a string reference and HTML-escapes it, escaping
the following characters: '&', '>', '<', and '"'.

It is provided for those who wish to use it to replace (or supplement)
the existing 'h' escape flag, via the Interpreter's L<C<set_escape()>
method|HTML>::Mason::Interp/item_set_escape>.

This function is provided in order to allow people to return the HTML
escaping behavior in 1.0x.  However, this behavior presents a
potential security risk of allowing cross-site scripting attacks.
HTML escaping should always be done based on the character set a page
is in.  Merely escaping the four characters mentioned above is not
sufficient.  The quick summary of why is that for some character sets,
characters other than '<' may be interpreter as a "less than" sign,
meaning that just filtering '<' and '>' will not stop all cross-site
scripting attacks.  See
http://www.megasecurity.org/Info/cross-site_scripting.txt for more
details.

It is not exportable.

=cut



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Mason-checkins mailing list
Mason-checkins@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mason-checkins
[prev in list] [next in list] [prev in thread] [next in thread]