File Coverage

blib/lib/Plack/Middleware/BlockHeaderInjection.pm

Criterion	Covered	Total	%
statement	47	47	100.0
branch	8	8	100.0
condition	4	6	66.6
subroutine	11	11	100.0
pod	2	3	66.6
total	72	75	96.0

package Plack::Middleware::BlockHeaderInjection;

# ABSTRACT: block header injections in responses

use v5.24;
use warnings;

use parent qw( Plack::Middleware );

use Plack::Util;
use Plack::Util::Accessor qw( logger status clean );

use experimental qw( signatures );

our $VERSION = 'v1.3.0';


sub prepare_app($self) {

    $self->status(500) unless $self->status;
    $self->clean( !!$self->clean );
}

sub call( $self, $env ) {

    # cache the logger
    $self->logger( $env->{'psgix.logger'} || sub { } )
      unless defined $self->logger;

    my $res = $self->app->($env);

    Plack::Util::response_cb(
        $res,
        sub {
            my $res = shift;

            # Sanity check headers

            my $hdrs = $res->[1];

            my $i = 0;
            while ( $i < $hdrs->@* ) {
                my ( $key, $val ) = ( $hdrs->[$i], $hdrs->[ $i + 1 ] );
                if ( $self->clean && $val =~ s/[\N{U+00}\n\r]+/ /gm ) {
                    Plack::Util::header_set( $hdrs, $key, $val );
                }
                if ( $val =~ /[\N{U+00}-\N{U+1f}]/ ) {
                    $self->log( error => "possible header injection detected in ${key}" );
                    $res->[0] = $self->status;
                    Plack::Util::header_remove( $hdrs, $key );
                }
                $i += 2;
            }
        }
    );

}

# Note: ideas borrowed from XSRFBlock


sub log( $self, $level, $msg ) {
    $self->logger->(
        {
            level   => $level,
            message => "BlockHeaderInjection: ${msg}",
        }
    );
}


1;

__END__