- dancer-users - lists.preshweb.co.uk

Re: [Dancer-users] Dancer and XSS
by Alexis Sukrieh 14 Apr '10

14 Apr '10

Hi John, I'm CC the list so everyone can join/contribute to this discussion. Le mercredi 14 avril 2010 à 07:23 +0000, John Berthels a écrit : > Hi, > > I'm maintaining a largeish perl web app on bare apache2 mod_perl. We're having some pain, having perhaps outgrown our existing home-grown partial-framework and I'm looking at different frameworks with a view to either stealing ideas or possibly migrating the app across. > > In particular, does Dancer give any support for html-escaping to prevent cross-site-scripting (XSS)? > > Different solutions I've seen so far include: Currently, Dancer does not provide any XSS-protection, but as you may now, the Dancer::Plugin interface allows you to build your own extensions. > 1 - html-escape all params on entry to the app (con: you need lots of un-escaping and so is hard to audit for correctness) Filtering all incoming params can easily be done with a before filter, like the following: before sub { while(my ($param, $value) = each(%{ params() })) { params->{$param} = some_xss_filter($value); } }; Better, this could be written in a plugin, like Dancer::Plugin::XSS and would then be enabled by just using that module in your webapp. > 2 - explicit html-escape in templates (con: you need this on nearly all variable interpolations in every template) This is not yet possible, but will be as soon as we add support for another kind of filter: "before_template", see http://github.com/sukria/Dancer/issues#issue/60 > 3 - auto html-escape in templates (con: this breaks some complex template logic) I suppose this can be done dependening on the tempate engine you're using (as Dancer lets you chose which one you want to use). For instance, I'm sure you can find some Teamplte Toolkit filters for that, and enable them in your Dancer configuration. > If you can give me any pointers to places in the Dancer docs that I've missed that cover this, that would be great. Otherwise, any advice you have would be gratefully received. Feel free to join the users mailing list if you have any questions. http://lists.perldancer.org/cgi-bin/listinfo/dancer-users Regards, -- Alexis Sukrieh

2 1

Return after redirect
by Juan J. Martínez 10 Apr '10

10 Apr '10

Hello, Sometimes I need to redirect to another page after testing things, and I want to leave the route ASAP, so I do something like: get '/test' => sub { if(params->{whatever}) { redirect '/'; return; } "Other stuff, blah"; }; get '/' => sub { template 'index'; }; I've switched to the dev branch, and that return after the redirect results in following error: Use of uninitialized value $line in length at ../local/HTTP/Server/Simple/PSGI.pm line 137. My question is: am I doing it right using return to leave the handler? Cheers, Juanjo -- jjm's home: http://www.usebox.net/jjm/ blackshell: http://blackshell.usebox.net/ ramble on: http://rambleon.usebox.net/

2 2

Create standard CPAN module structure
by Gabor Szabo 09 Apr '10

09 Apr '10

Hi, I have a couple of issues, before opening tickets let me ask them. IMHO it would be better to create a CPAN like distribution instead of what dancer creates now so I wonder if it would be better to dancer -a rock - create Makefile.PL - put module in lib and call it Rock.pm - in order to find the module the rock.pl should contain something like this: use Cwd (); use lib path(dirname(Cwd::abs_path $0), 'lib'); Making sure the module can be loaded even if the script is executed while the current directory is in another place. Add this before the "use Application;" line or add a function to Dancer setup_relative_dir() and insert that in the script or make this part of Dancer.pm. - creat t/ directory and a simple test that can launch the application and test it - Add default pod in the module: =head1 NAME Module - A Dance based web application =head COPYRIGHT =head1 LICENSE =cut regards Gabor

3 3

Plack deployment question
by Deepak Gulati 07 Apr '10

07 Apr '10

Hi Folks, This is more of a Plack/PSGI question, but I am hoping someone here can help. I am using plackup to test app.psgi with Starlet (and occasionally with Starman) server. My CSS files are being served with content-type of text/plain and end up not being interpreted by Firefox or Chrome (I see unstyled content). This doesn't happen when using HTTP::Server::PSGI. Any idea where I can configure the mime types for Starlet or Starman? Thanks, Deepak

1 1

Deployment question
by Robert Olson 07 Apr '10

07 Apr '10

I'm starting to try to use Dancer in some apps at my day job; here, we have a bunch of apps that we have hung off an nginx proxy server (some using fcgi, some straight reverse proxy). What distinguishes this that we don't use vhosts for all of them; instead, we distinguish based on a toplevel directory. For instance / foo would be delivered to one machine's fcgi , /bar to some other machine's apache. I'd like to be able to use this mechanism to proxy off to a Dancer standalone server. However, to the instance locally it things stuff is rooted at /, but to the clients it's rooted at /somethingelse. I have tinkered with the prefix directive, which makes the actions work ok, but breaks the stuff under public. And if I generate urls inside the actions (like /something/postme), they are incorrect when used in the proxied context. (I'm not sure if this is an entirely cogent explanation; if not let me know and I'll take another run at it with a concrete example :-). --bob

2 3

A few more random issues
by Gabor Szabo 07 Apr '10

07 Apr '10

Hi as I am playing with Dancer I encountered a few more small issues: Could the default template say? Powered by <a href="http://www.perl.org/">Perl</a> <a href="http://perldancer.org/">Dancer</a> Add the following to both the script and the module: # strict and warnings are automatcially on The config.yml could already contain all the configuration entries (maybe commented out) Why is this necessary in Dancer.pm? $AUTHORITY = 'SUKRIA'; What do you think? Gabor

2 1

Re: [Dancer-users] Using utf-8 data from database and template toolkit
by Deepak Gulati 07 Apr '10

07 Apr '10

Hi, Does it work for you without DBIx::Class? I did the following: 1. Created a SQLite database: sqlite3 names.sqlite 2. Executed the following SQL sqlite> .read names.sql where names.sql contains: create table names (FirstName varchar(20), LastName varchar(20)); insert into names (FirstName, LastName) values ('Bedřich', 'Smetana'); insert into names (FirstName, LastName) values ('Antonín', 'Dvořák'); insert into names (FirstName, LastName) values ('Fréderyck', 'Chopin'); 3. My mywebapp.pl looks like this (the database names.sqlite is in the folder db under the default mywebapp created by dancer): #!/usr/bin/perl use Dancer; use mywebapp; use Data::Dumper; use Template; use DBI; get '/names/' => sub { my $dbh = DBI->connect("dbi:SQLite:dbname=db/names.sqlite", "", ""); my $sql = "select FirstName, LastName from names"; my $sth = $dbh->prepare($sql); $sth->execute; my $names = $sth->fetchall_arrayref; template 'names' => { 'names' => $names }; }; dance; 4. And my TT2 template looks like this: <table> [% FOREACH n IN names %] <tr> <td>[% n.0 %]</td> <td>[% n.1 %]</td> </tr> [% END %] </table> This setup works for me without any data corruption issues. I am on Mac OS 10.6, with Perl 5.10.0, SQLite3 and Dancer 1.173.

2 1

Supporting ; as a separator in querystring
by Deepak Gulati 06 Apr '10

06 Apr '10

Hi Folks, By default dancer supports parsing key-value pairs in a querystring separated by an ampersand - &. Is there a way to get it to working with a semicolon ; as well? e.g. http://localhost/hello?key1=value1;key2=value2 Thanks, Deepak

2 3

Debugging and logging
by Gabor Szabo 04 Apr '10

04 Apr '10

Hi, I just started to play with Dancer. I wanted to see what's going on so I wanted to turn on logging. I found I can say at the top of my Dancer script: set logger => 'file'; set log => 'debug'; and then I can add calls to debug "hello"; and see the output with tail -f MYAPP/logs/development.log but I was hoping 1) to see the logging on the console window just after this message: >> Dancer server 25189 listening on http://0.0.0.0:3000 == Entering the development dance floor ... 2) See default debug messages on calling various routes, or missing all routes Can I do these? How? Gabor -- Gabor Szabo http://szabgab.com/

2 3

bug tracking: RT or Github ?
by Gabor Szabo 04 Apr '10

04 Apr '10

Which is the preferred way to submit bugs and requests? RT, Github or something else? regards Gabor

2 1