File Coverage

lib/CGI/Application/Plugin/ValidateQuery.pm

Criterion	Covered	Total	%
statement	67	71	94.3
branch	22	26	84.6
condition	8	12	66.6
subroutine	12	12	100.0
pod	2	4	50.0
total	111	125	88.8

package CGI::Application::Plugin::ValidateQuery;

use warnings;
use strict;

use base 'Exporter';

use Carp 'croak';
use Params::Validate ':all';

=head1 NAME

CGI::Application::Plugin::ValidateQuery - lightweight query validation for CGI::Application

=head1 VERSION

Version 1.0.5

=cut

our $VERSION = '1.0.5';

our @EXPORT_OK = qw(
    validate_query_config
    validate_app_params
    validate_query
    validate_query_error_mode
);
push @EXPORT_OK, @Params::Validate::EXPORT_OK;
our %EXPORT_TAGS = (
    all   => \@EXPORT_OK,
    types => $Params::Validate::EXPORT_TAGS{types}
);

local $Params::Validate::NO_VALIDATION = 0;

sub validate_query_config {
    my $self = shift;

    my $opts = {@_};

    $opts = {map {uc $_ => $opts->{$_}} keys %$opts};

    # for now, default checking all params. First config arg is legacy.
    if ( defined $opts->{EXTRA_FIELDS_OPTIONAL} or defined $opts->{ALLOW_EXTRA} ) {
        delete $opts->{EXTRA_FIELDS_OPTIONAL};
        delete $opts->{ALLOW_EXTRA};
        $self->{__CAP_VALQUERY_ALLOW_EXTRA} = 1;
    } else {
        $self->{__CAP_VALQUERY_ALLOW_EXTRA} = 0;
    }

    $self->{__CAP_VALQUERY_ERROR_MODE} = defined $opts->{ERROR_MODE} ?
        delete $opts->{ERROR_MODE} : 'validate_query_error_mode';

    $self->{__CAP_VALQUERY_LOG_LEVEL} = defined $opts->{LOG_LEVEL} ?
        delete $opts->{LOG_LEVEL} : undef;

    croak 'log_level given but no logging interface exists.'
        if $self->{__CAP_VALQUERY_LOG_LEVEL} && !$self->can('log');

    croak 'Invalid option(s) ('.join(', ', keys %{$opts}).') passed to'
          .'validate_query_config' if %{$opts};
}

sub validate_app_params {
    my $self = shift;

    return unless @_;

    my $query_props = {@_};

    $query_props->{allow_extra} = 1;
    $query_props->{app_params}  = 1;

    return _validate($self, $query_props);
}

sub validate_query {
    my $self = shift;

    return unless @_;

    return _validate($self, {@_});
}


sub _validate {
    my $self        = shift;
    my $query_props = shift;

    my $log_level = delete $query_props->{log_level}
                    || $self->{__CAP_VALQUERY_LOG_LEVEL};

    my $allow_extra = delete($query_props->{extra_fields_optional})
                      || delete($query_props->{allow_extra})
                      || $self->{__CAP_ALLOW_EXTRA};

    my $app_params = delete $query_props->{app_params};

    my $param_obj = $app_params ? $self : $self->query;

    # filter query_props to support quick regex syntax
    # turns
        # key => qr/$regex/
    # into
        # key => { regex => qr/$regex/ }
    for my $key (keys %$query_props) {
        my $val = $query_props->{$key};
        if ( ref $val eq 'Regexp' ) {
            $query_props->{$key} = { regex => $val, type => SCALAR };
        }
    }

    my %validated;
    eval {
        my @vars_array;
        for my $p ($param_obj->param) {
            my @values = $param_obj->param($p);
            push @vars_array, ($p, scalar @values > 1 ? \@values : $values[0]);
        }
        %validated = validate_with(
            params      => \@vars_array,
            spec        => $query_props,
            allow_extra => $allow_extra
        );
    };
    if ($@) {
        my $log_msg = "Query Validation Failed: $@";
        $self->log->$log_level($log_msg) if $log_level;
        $self->error_mode($self->{__CAP_VALQUERY_ERROR_MODE});

        croak $log_msg;
    }

    # Account for default values, and use the expanded -name / -value
    # syntax for CGI to ensure proper handling of multivalued fields.
    my $sub = $app_params
        ? sub { my $p = shift; $param_obj->param($p, $validated{$p}) }
        : sub { my $p = shift; $param_obj->param(-name=>$p, -value=>$validated{$p}) };

    map { $sub->($_) } keys %validated;

    return %validated;
}

sub validate_query_error_mode {
    my $self  = shift;
    return "Request not understoodThe
            request submitted could not be understood.";
}

1;

__END__