From 9e3a4e27db5caf665bfd115e0f5b1e9d763adf93 Mon Sep 17 00:00:00 2001 From: Relevance Pair Date: Tue, 12 Mar 2013 10:55:00 -0400 Subject: [PATCH 1/2] update to clojure 1.5.1 and fix read-string vulnerability --- project.clj | 4 ++-- src/noir/fetch/remotes.clj | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/project.clj b/project.clj index 8b02886..0926e9d 100644 --- a/project.clj +++ b/project.clj @@ -1,4 +1,4 @@ -(defproject fetch "0.1.0-alpha2" +(defproject fetch "0.1.0-alpha3" :description "A ClojureScript and Noir library to make client-server interaction painless." - :dependencies [[clojure "1.3.0"] + :dependencies [[org.clojure/clojure "1.5.1"] [noir "1.2.2"]]) diff --git a/src/noir/fetch/remotes.clj b/src/noir/fetch/remotes.clj index ca13af9..1b4cc04 100644 --- a/src/noir/fetch/remotes.clj +++ b/src/noir/fetch/remotes.clj @@ -1,4 +1,5 @@ (ns noir.fetch.remotes + (:require [clojure.edn :as edn]) (:use [noir.core :only [defpage]])) (def remotes (atom {})) @@ -10,8 +11,7 @@ (swap! remotes assoc remote func)) (defn safe-read [s] - (binding [*read-eval* false] - (read-string s))) + (edn/read-string s)) (defmacro defremote [remote params & body] `(do From 33c04494c42b39a27b9521abcdca789cb084c98a Mon Sep 17 00:00:00 2001 From: Dave Della Costa Date: Sat, 16 Mar 2013 17:13:26 +0900 Subject: [PATCH 2/2] removes old Noir dependencies, replaces defpage with compojure route. --- src/noir/fetch/remotes.clj | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/src/noir/fetch/remotes.clj b/src/noir/fetch/remotes.clj index 1b4cc04..b5da19c 100644 --- a/src/noir/fetch/remotes.clj +++ b/src/noir/fetch/remotes.clj @@ -1,6 +1,6 @@ (ns noir.fetch.remotes - (:require [clojure.edn :as edn]) - (:use [noir.core :only [defpage]])) + (:require [clojure.edn :as edn] + [compojure.core :refer :all])) (def remotes (atom {})) @@ -30,7 +30,8 @@ (println "*** fetch/wrap-remotes is no longer needed. Please remove it ***") handler) -(defpage [:any "/_fetch"] {:keys [remote params]} - (let [params (safe-read params) - remote (keyword remote)] - (call-remote remote params))) +(defroutes fetch-routes + (ANY "/_fetch" [remote params] + (let [params (safe-read params) + remote (keyword remote)] + (call-remote remote params))))