CGI::Untaint::upload - receive a file upload
my $handler = CGI::Untaint->new( map { $_ => $cgi->param($_) } $cgi->param);
# NOT my $handler = CGI::Untaint->new( $cgi->Vars ); !
$file = $handler->extract(-as_upload => "uploaded");
print "File name was ", $file->{filename}, "\n";
print "File contents: \n";
print $file->{payload};
This CGI::Untaint handler receives a file from an upload field, returning its filename and contents. This may be used as a base class for validating that a file upload conforms to certain properties.
It's important that you use CGI->param rather than CGI->Vars as the latter only returns the uploaded file's name and not its contents.
By default, the class does no taint checking, blindly untainting both the filename and the contents; this may not be what you want. You can subclass this module and override the _untaint_filename_re and _untaint_payload_re methods to control the regular expression used to untaint these data. In addition, the usual CGI::Untaint::object is_valid method can be overriden to perform more checks on the data.
Simon Cozens, simon@kasei.com
