Release 2.4.

bungle · bungle · commit d892db9003cc · 2016-09-16T12:05:02.000+03:00
diff --git a/CHANGES b/CHANGES
@@ -1,3 +1,9 @@
+Changes with lua-resty-validation 2.4                            16 Sep 2016
+
+    *) Feature: added support for custom (inline) validatiors
+    *) Feature: added resty.validation.injection extension
+                (uses libinjection)
+
 Changes with lua-resty-validation 2.3                            22 Mar 2016
 
     *) Feature: added resty.validation.utf8 extension (uses utf8rewind)
diff --git a/README.md b/README.md
@@ -198,6 +198,7 @@ Validation factory consist of different validators and filters used to validate
 * `reverse`, reverses the value (string or number) (UTF-8)
 * `coalesce(...)`, if the value is nil, returns first non-nil value passed as arguments
 * `email()`, validates that the value is email address
+* `call(function)`, validates / filters the value against custom inline validator / filter
 * `optional([default])`, stops validation if the value is empty string `""` or `nil` and returns `true`, and either, `default` or `value`
 
 #### Conditional Validation Factory Validators
@@ -299,6 +300,20 @@ function()
 end
 ```
 
+### Custom (Inline) Validators and Filters
+
+Sometimes you may just have one-off validators / filters that you are not using elsewhere, or that you just
+want to supply quickly an additional validator / filter for a specific case. To make that easy and straight
+forward, we introduced `call` factory method with `lua-resty-validation` 2.4. Here is an example:
+
+```lua
+validation:call(function(value)
+    -- now validate / filter the value, and return the results
+    -- here we just return false (aka making validation to fail) 
+    return false
+end)("Check this value"))
+```
+
 ### Built-in Validator Extensions
 
 Currently `lua-resty-validation` has support for two extensions or plugins that you can enable:
@@ -307,7 +322,6 @@ Currently `lua-resty-validation` has support for two extensions or plugins that
 * `resty.validation.tz`
 * `resty.validation.utf8`
 
-
 These are something you can look at if you want to build your own validator extension. If you do
 so, and think that it would be usable for others as well, mind you to send your extension as a pull-request
 for inclusion in this project, thank you very much, ;-).
@@ -471,6 +485,31 @@ local validation = require "resty.validation"
 local valid, ts = validation:utf8category("LETTER_UPPERCASE")("TEST")
 ```
 
+#### resty.validation.injection extension
+
+This set of validators and filters is based on the great [`libinjection`](https://github.com/client9/libinjection)
+library by Nick Galbreath - a SQL / SQLI / XSS tokenizer parser analyzer. It needs my LuaJIT FFI wrapper
+[`lua-resty-injection`](https://github.com/bungle/lua-resty-injection) to work. When the mentioned requirements
+are installed, the rest is easy. To use this extension, all you need to do is:
+
+```lua
+require "resty.validation.injection"
+```
+
+It will monkey patch the adapters that it will provide in `resty.validation`, and those are currently:
+
+* `sqli`, returns `false` if SQL injection was detected, otherwise returns `true`
+* `xss`, returns `false` if Cross-Site Scripting injection was detected, otherwise returns `true`
+
+##### Example
+
+```lua
+require "resty.validation.injection"
+local validation = require "resty.validation"
+local valid, ts = validation.sqli("test'; DELETE FROM users;")
+local valid, ts = validation.xss("test <script>alert('XSS');</script>")
+```
+
 ## API
 
 I'm not going here for details for all the different validators and filters there is because they all follow the
diff --git a/lib/resty/validation.lua b/lib/resty/validation.lua
@@ -415,6 +415,11 @@ function factory.email()
         return match(value, "%w*%p*@+%w*%.?%w*") ~= nil
     end
 end
+function factory.call(func)
+    return function(value)
+        return func(value)
+    end
+end
 function factory.optional(default)
     return function(value)
         if value == nil or value == "" then
diff --git a/lib/resty/validation/injection.lua b/lib/resty/validation/injection.lua
@@ -0,0 +1,13 @@
+local i          = require "resty.injection"
+local validation = require "resty.validation"
+local validators = validation.validators
+function validators.sqli(value)
+    return not i.sql(value)
+end
+function validators.xss(value)
+    return not i.xss(value)
+end
+return {
+    sqli = validators.sqli,
+    xss  = validators.xss
+}
