class Police::Rack::Middleware

Rack middleware that labels the HTTP input with UnsafeString.

Public Class Methods

new(app, options = {}) click to toggle source
# File lib/police/rack/middleware.rb, line 7
def initialize(app, options = {})
  @app = app
  @unsafe_string = Police::Labels::UnsafeString.new
  @unsafe_stream = Police::Labels::UnsafeStream.new @unsafe_string
end

Public Instance Methods

call(env) click to toggle source
# File lib/police/rack/middleware.rb, line 13
def call(env)
  label_env env
  @app.call env
  # TODO(pwnall): filter output
end
label_env(env) click to toggle source
# File lib/police/rack/middleware.rb, line 19
def label_env(env)
  env['rack.input'] = Police::DataFlow.label env['rack.input'], @unsafe_stream
  env['QUERY_STRING'] = Police::DataFlow.label env['QUERY_STRING'],
      @unsafe_string
end