[GitHub] rawlinp closed pull request #2806: Add sub to validate user input when running postinstall script

[GitBox <gi...@apache.org>]

rawlinp closed pull request #2806: Add sub to validate user input when running postinstall script
URL: https://github.com/apache/trafficcontrol/pull/2806
 
 
   

This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:

As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):

diff --git a/traffic_ops/install/lib/InstallUtils.pm b/traffic_ops/install/lib/InstallUtils.pm
index a7df222ea..22545f225 100644
--- a/traffic_ops/install/lib/InstallUtils.pm
+++ b/traffic_ops/install/lib/InstallUtils.pm
@@ -23,9 +23,9 @@ package InstallUtils;
 # to you under the Apache License, Version 2.0 (the
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
-# 
+#
 #   http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing,
 # software distributed under the License is distributed on an
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
@@ -127,24 +127,40 @@ sub randomWord {
     return $secret;
 }
 
+# Any checks to user input configurations can be implemented in this functions.
+sub sanitize{
+    my ($promptString, $userInput) = @_;
+    if (index($promptString, "Human-readable CDN Name") != -1){
+        if ($userInput =~ m/[^-a-zA-Z0-9_.]/){
+            print "Invalid characters in user input. Try again.\n\n";
+            return false;
+        }
+    }
+    return true;
+}
+
 sub promptUser {
     my ( $promptString, $defaultValue, $noEcho ) = @_;
 
-    if ($defaultValue) {
-        print $promptString, " [", $defaultValue, "]: ";
-    }
-    else {
-        print $promptString, ": ";
-    }
-
     if ( defined $noEcho && $noEcho ) {
         # Set echo mode to off via ReadMode 2
         ReadMode 2;
     }
 
-    $| = 1;
-    $_ = <STDIN>;
-    chomp;
+    # Check user input for invalid characters
+    my $sanitized = false;
+    while ($sanitized eq false){
+        if ($defaultValue) {
+            print $promptString, " [", $defaultValue, "]: ";
+        }
+        else {
+            print $promptString, ": ";
+        }
+        $| = 1;
+        $_ = <STDIN>;
+        chomp;
+        $sanitized = sanitize($promptString, $_)
+    }
 
     if ( defined $noEcho && $noEcho ) {
         # Set echo mode to on via ReadMode 1


 

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services