File Coverage

blib/lib/Plack/Middleware/BlockHeaderInjection.pm

Criterion	Covered	Total	%
statement	45	45	100.0
branch	6	6	100.0
condition	1	3	33.3
subroutine	11	11	100.0
pod	2	3	66.6
total	65	68	95.5

package Plack::Middleware::BlockHeaderInjection;

# ABSTRACT: block header injections in responses

use v5.24;
use warnings;

use parent qw( Plack::Middleware );

use Plack::Util;
use Plack::Util::Accessor qw( logger status );

use experimental qw( signatures );

our $VERSION = 'v1.2.0';


sub prepare_app($self) {

    $self->status(500) unless $self->status;

}

sub call( $self, $env ) {

    # cache the logger
    $self->logger( $env->{'psgix.logger'} || sub { } )
      unless defined $self->logger;

    my $res = $self->app->($env);

    Plack::Util::response_cb(
        $res,
        sub {
            my $res = shift;

            # Sanity check headers

            my $hdrs = $res->[1];

            my $i = 0;
            while ( $i < $hdrs->@* ) {
                my $val = $hdrs->[ $i + 1 ];
                if ( $val =~ /[\N{U+00}-\N{U+1f}]/ ) {
                    my $key = $hdrs->[$i];
                    $self->log( error => "possible header injection detected in ${key}" );
                    $res->[0] = $self->status;
                    Plack::Util::header_remove( $hdrs, $key );
                }
                $i += 2;
            }

        }
    );

}

# Note: ideas borrowed from XSRFBlock


sub log( $self, $level, $msg ) {
    $self->logger->(
        {
            level   => $level,
            message => "BlockHeaderInjection: ${msg}",
        }
    );
}


1;

__END__