chiark / gitweb /
Do not allow caller to specify arbitrary content-types
authorIan Jackson <ijackson@chiark.greenend.org.uk>
Wed, 23 Sep 2009 14:12:46 +0000 (15:12 +0100)
committerIan Jackson <ijackson@chiark.greenend.org.uk>
Wed, 23 Sep 2009 14:12:46 +0000 (15:12 +0100)
yarrg/web/qtextstringcheck

index 4fbfc54..9dce828 100755 (executable)
@@ -129,7 +129,10 @@ $emsg='' if !defined $emsg;
 $debugf->("QTSC EMSG='$emsg' RESULTS='@results'");
 
 if ($format =~ /json/) {
-       $r->content_type($ctype or $format);
+       $ctype ||= $format;
+       die unless grep { $_ eq $ctype }
+               qw(application/json text/plain text/xml);
+       $r->content_type($ctype);
        my $jobj= {
                success => 1*!length $emsg,
                show => (length $emsg      ? $emsg                       :