The London Perl and Raku Workshop takes place on 26th Oct 2024. If your company depends on Perl, please consider sponsoring and/or attending.
 / 
Dancer-Plugin-EscapeHTML-0.02
River stage one • 1 direct dependent • 1 total dependent
4 ++
/ Dancer::Plugin::EscapeHTML

NAME

Dancer::Plugin::EscapeHTML - Escape HTML entities to avoid XSS vulnerabilities

SYNOPSIS

The plugin provides convenience keywords escape_html and unescape_html which are simply quick shortcuts to encode_entities and decode_entities from HTML::Entities.

    use Dancer::Plugin::EscapeHTML;

    my $encoded = escape_html($some_html);

It also provides optional automatic escaping of all HTML (see below.)

DESCRIPTION

This plugin is intended to provide a quick and simple way to ensure that HTML passed in the tokens hashref to the template is safely escaped (encoded), thereby helping to avoid XSS/cross-site scripting vulnerabilities.

You can encode specific bits of data yourself using the escape_html and unescape_html keywords, or you can enable automatic escaping of all values passed to the template.

In a future version, it is likely that this automatic escaping can be bypassed for certain values - probably by providing parameter names/patterns in the configuration to indicate parameters which should be left alone.

KEYWORDS

When the plugin is loaded, the following keywords are exported to your app:

escape_html

Encodes HTML entities; shortcut to encode_entities from HTML::Entities

unescape_html

Decodes HTML entities; shortcut to decode_entities from HTML::Entities

Automatic HTML encoding

If desired, you can also enable automatic HTML encoding of all params passed to templates.

To do so, enable the automatic_encoding option in your app's config - for instance, add the following to your config.yml:

    plugins:
        EscapeHTML:
            automatic_escaping: 1

Now, all values passed to the template will be automatically encoded, so you should be protected from potential XSS vulnerabilities.

Of course, this has the drawback that you cannot provide pre-prepared HTML in template params to be used "as is". It is planned that a future version of this module will allow you to configure exceptions, naming params / param name patterns which should be left alone.

SEE ALSO

Dancer

HTML::Entities

AUTHOR

David Precious, <davidp at preshweb.co.uk>

LICENSE AND COPYRIGHT

Copyright 2011 David Precious.

This program is free software; you can redistribute it and/or modify it under the terms of either: the GNU General Public License as published by the Free Software Foundation; or the Artistic License.

See http://dev.perl.org/licenses/ for more information.