mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-12 07:27:57 +00:00
Code Issues Releases Activity

FormCanary will examine your outgoing HTML and add a canary value to

Browse Source 
each form.  When the form is submitted, the value of the canary is com-
pared against one saved in the session at page generation time.  If the
canary that's sent doesn't match the one in the session (or there is no
canary at all), the request is halted.

There is no way to get params into your application without a correct
canary.  This is good for preventing "cross-site request attacks".

This module is compatible with FormBuilder.  Just drop it into your use
line and have secure submit-once-only forms.  Yay.

Inspired by:
http://www.25hoursaday.com/weblog/2007/06/05/WhatRubyOnRailsCanLearnFromASPNET.a
spx
This commit is contained in:
Lars Balker Rasmussen 2007-06-19 12:34:00 +00:00
parent 32ef91436e
commit 2e1c819690
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=193874
5 changed files with 59 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
www/Makefile
View File

@ -620,6 +620,7 @@
SUBDIR += p5-Catalyst-Plugin-DefaultEnd
SUBDIR += p5-Catalyst-Plugin-FillInForm
SUBDIR += p5-Catalyst-Plugin-FormBuilder
SUBDIR += p5-Catalyst-Plugin-FormCanary
SUBDIR += p5-Catalyst-Plugin-FormValidator
SUBDIR += p5-Catalyst-Plugin-FormValidator-Simple
SUBDIR += p5-Catalyst-Plugin-HTML-Widget

32
www/p5-Catalyst-Plugin-FormCanary/Makefile Normal file
View File

@ -0,0 +1,32 @@
# Ports collection makefile for: p5-Catalyst-Plugin-FormCanary
# Date created: Jun 19, 2007
# Whom: Lars Balker Rasmussen <lbr@FreeBSD.org>
#
# $FreeBSD$
#
PORTNAME= Catalyst-Plugin-FormCanary
PORTVERSION= 0.01
CATEGORIES= www perl5
MASTER_SITES= CPAN
PKGNAMEPREFIX= p5-
MAINTAINER= lbr@FreeBSD.org
COMMENT= Check that forms are submitted from your site
BUILD_DEPENDS= ${RUN_DEPENDS}
RUN_DEPENDS= p5-Catalyst-Runtime>=0:${PORTSDIR}/www/p5-Catalyst-Runtime \
p5-Catalyst-Plugin-Session>=0:${PORTSDIR}/www/p5-Catalyst-Plugin-Session
PERL_CONFIGURE= yes
MAN3= Catalyst::Plugin::FormCanary.3
post-extract:
@${PERL} -i.bak -ne 'print unless m,build_requires,' ${WRKSRC}/Makefile.PL
.include <bsd.port.pre.mk>
.if ${PERL_LEVEL} < 500801
IGNORE= requires at least Perl 5.8.1. Install lang/perl5.8, and try again
.endif
.include <bsd.port.post.mk>

3
www/p5-Catalyst-Plugin-FormCanary/distinfo Normal file
View File

@ -0,0 +1,3 @@
MD5 (Catalyst-Plugin-FormCanary-0.01.tar.gz) = b117620e80e2d4e4b6f9d04b07adef46
SHA256 (Catalyst-Plugin-FormCanary-0.01.tar.gz) = 9e4ff6a82b152b87ee0cb72ded9acfe2a7052918b7ce9caa068676f262421169
SIZE (Catalyst-Plugin-FormCanary-0.01.tar.gz) = 27084

16
www/p5-Catalyst-Plugin-FormCanary/pkg-descr Normal file
View File

@ -0,0 +1,16 @@
FormCanary will examine your outgoing HTML and add a canary value to
each form. When the form is submitted, the value of the canary is com-
pared against one saved in the session at page generation time. If the
canary that's sent doesn't match the one in the session (or there is no
canary at all), the request is halted.
There is no way to get params into your application without a correct
canary. This is good for preventing "cross-site request attacks".
This module is compatible with FormBuilder. Just drop it into your use
line and have secure submit-once-only forms. Yay.
Inspired by:
http://www.25hoursaday.com/weblog/2007/06/05/WhatRubyOnRailsCanLearnFromASPNET.aspx
WWW: http://search.cpan.org/dist/Catalyst-Plugin-FormCanary/

7
www/p5-Catalyst-Plugin-FormCanary/pkg-plist Normal file
View File

@ -0,0 +1,7 @@
%%SITE_PERL%%/Catalyst/Plugin/FormCanary.pm
%%SITE_PERL%%/%%PERL_ARCH%%/auto/Catalyst/Plugin/FormCanary/.packlist
@dirrmtry %%SITE_PERL%%/Catalyst/Plugin
@dirrmtry %%SITE_PERL%%/Catalyst
@dirrmtry %%SITE_PERL%%/%%PERL_ARCH%%/auto/Catalyst/Plugin/FormCanary
@dirrmtry %%SITE_PERL%%/%%PERL_ARCH%%/auto/Catalyst/Plugin
@dirrmtry %%SITE_PERL%%/%%PERL_ARCH%%/auto/Catalyst