diff options
Diffstat (limited to 'lib/TUWF')
-rw-r--r-- | lib/TUWF/Request.pm | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/TUWF/Request.pm b/lib/TUWF/Request.pm index 394d950..f7d67b4 100644 --- a/lib/TUWF/Request.pm +++ b/lib/TUWF/Request.pm @@ -77,6 +77,9 @@ sub _parse_urlencoded { decode_utf8($s, 1); #eg; s/%u([0-9a-fA-F]{4})/chr hex($1)/eg; + # Disallow any control codes, except for x09 (tab), x0a (newline) and x0d (carriage return) + # The error message is a hack to trigger the 'utf8' error code. + die "Illegal control code (does not map to Unicode)" if /[\x00-\x08\x0b\x0c\x0e-\x1f]/; } push @{$dat{$key}}, $val; } |