<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 1 Sep 2010, at 19:46, Peter Karman wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Ton Voon wrote on 09/01/2010 05:24 AM:<br><br><blockquote type="cite">Instead, I've patched Catalyst::Action::Deserialize::Data::Serializer so<br></blockquote><blockquote type="cite">that if the serializer is Data::Dumper, pass it through a Safe<br></blockquote><blockquote type="cite">compartment instead. This limits the input to JSON-like input in perl<br></blockquote><blockquote type="cite">style which I guess is the most you would use REST input as.<br></blockquote><br>What if the serializer is Data::Dump, et al.? I.e., is the special check<br>for Data::Dumper echoing some other, similar test in the module or in<br>Catalyst core?<br><br></div></blockquote><div><br></div>I'm not sure what you mean.<br><br>Data::Serializer is a front end to other serializers: <a href="http://search.cpan.org/~neely/Data-Serializer-0.49/lib/Data/Serializer.pm">http://search.cpan.org/~neely/Data-Serializer-0.49/lib/Data/Serializer.pm</a><br><br>Data::Dump is not one of the serializers available, though I guess that doesn't preclude it from being included in future.<br><br>Data::Denter looks like some YAML type format, Data::Taxi is based on an XML like structure, FreezeThaw is some variable only structure, PHP::Serialization is PHP strings, Storable doesn't include code, XML::Dumper/XML::Simple are XML based and YAML is YAML<br><br>So I think Data::Dumper is the only serialization that could execute other code based on blindly eval'ing input.<br><br>Ton<br><br></div></body></html>