APR::Request::Param charset and UTF-8 flag

[John ORourke <jo...@o-rourke.org>]

Hi folks,

I'm not sure if this is a bug and I'm new to the list so please forgive 
any bad form.

I'm trying to use APR::Request::Param->charset(8) but it doesn't seem to 
be setting perl's UTF-8 flag as the documentation says it should.

Here's the code:

sub handler { my $r=shift;
    $query = Apache2::Request->new($r);
    $param_table = $query->param();
    $param_table->param_class( 'APR::Request::Param' );
    $_->charset(8) foreach values %$param_table;

    my $val = $param_table->{my_param};   # gives me a 
APR::Request::Param, OK so far
    print $val->charset();   # gives me '8', OK so far...
    print utf8::is_utf8( $val->value() ); # false!
    print utf8::is_utf8( $val ); # also false!
}

If this is correct behaviour then I can't see any purpose for the 
charset method - can someone enlighten me?

cheers
John

Re: APR::Request::Param charset and UTF-8 flag

[Joe Schaefer <jo...@sunstarsys.com>]

John ORourke <jo...@o-rourke.org> writes:

> I'm trying to use APR::Request::Param->charset(8) but it doesn't seem to be
> setting perl's UTF-8 flag as the documentation says it should.

Check the docs again- first you have to disable tainting by calling 

  $param->is_tainted(0);

for the utf-8 flag to be set on the $param.  It's a security risk
to set the charset to utf8 without first validating the input-
iow you should at least check that the reported charset is either 
0 or 8 before simply resetting it to 8.

-- 
Joe Schaefer