[open-ils-commits] r14032 - trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger (miker)

[svn at svn.open-ils.org]

Author: miker
Date: 2009-09-16 21:54:21 -0400 (Wed, 16 Sep 2009)
New Revision: 14032

Modified:
   trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger/Event.pm
Log:
use Safe to protect against EVIL evals coming in from the outside world -- we share the environment into the Safe compartment using the name $current_environment

Modified: trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger/Event.pm
===================================================================
--- trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger/Event.pm	2009-09-16 03:38:25 UTC (rev 14031)
+++ trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger/Event.pm	2009-09-17 01:54:21 UTC (rev 14032)
@@ -8,6 +8,8 @@
 use OpenILS::Utils::CStoreEditor q/:funcs/;
 use OpenILS::Application::Trigger::ModRunner;
 
+use Safe;
+
 my $log = 'OpenSRF::Utils::Logger';
 
 sub new {
@@ -348,6 +350,8 @@
     return $ok || undef;
 }
 
+my $current_environment;
+
 sub build_environment {
     my $self = shift;
     return $self if ($self->environment->{complete});
@@ -356,12 +360,18 @@
 
     try {
    
+        my $compartment = new Safe;
+        $compartment->permit(':default',':load');
+        $compartment->share('$current_environment');
+
         $self->environment->{EventProcessor} = $self;
         $self->environment->{target} = $self->target;
         $self->environment->{event} = $self->event;
         $self->environment->{template} = $self->event->event_def->template;
 
-        $self->environment->{params}{ $_->param } = eval $_->value for ( @{$self->event->event_def->params} );
+	$current_environment = $self->environment;
+
+        $self->environment->{params}{ $_->param } = $compartment->reval($_->value) for ( @{$self->event->event_def->params} );
     
         for my $e ( @{$self->event->event_def->env} ) {
             my (@label, @path);