First steps at applying critic rules.

Exempt obviously fine stuff from sql injection catch.

.perlcriticrc

@@ -0,0 +1,55 @@
+# Troglodyne perlcritic policy
+severity  = 1
+only      = 1
+force     = 0
+verbose   = 1
+#theme     = 
+#include   =
+#exclude   =
+criticism-fatal = 1
+color     = 1
+allow-unsafe = 1
+# Usability
+[Modules::RequirePerlVersion]
+[Documentation::RequirePod]
+# Security
+[ValuesAndExpressions::PreventSQLInjection]
+[CodeLayout::RequireASCII]
+[RegularExpressions::RequireDefault]
+strict = 1
+# PEBCAK catches
+[BuiltinFunctions::ProhibitDeleteOnArrays]
+[Subroutines::ProhibitAmbiguousFunctionCalls]
+[ValuesAndExpressions::ProhibitSingleArgArraySlice]
+[Bangs::ProhibitUselessRegexModifiers]
+[Bangs::ProhibitCommentedOutCode]
+[Tics::ProhibitUseBase]
+[Plicease::ProhibitLeadingZeros]
+[RegularExpressions::ProhibitEmptyAlternatives]
+[ValuesAndExpressions::UnexpandedSpecialLiteral]
+[CodeLayout::ProhibitIfIfSameLine]
+[ValuesAndExpressions::ConstantBeforeLt]
+[ValuesAndExpressions::ProhibitDuplicateHashKeys]
+# any access checks are necessarily a TOCTOU waiting to happen
+[ValuesAndExpressions::ProhibitFiletest_f]
+[ValuesAndExpressions::ProhibitFiletest_rwxRWX]
+# Bikeshed
+[CognitiveComplexity::ProhibitExcessCognitiveComplexity]
+warn_level = 40
+info_level = 30
+[Variables::ProhibitUselessInitialization]
+[PreferredModules]
+config = .preferred_modules.ini
+[logicLAB::RequireSheBang]
+formats = #!/usr/bin/env perl
+# Performance
+[logicLAB::ProhibitShellDispatch]
+[Performance::ProhibitRegexForSimpleSubstring]
+# Extensions to perl -c
+[CompileTime]
+# Good idea, but module doesn't install due to bad testsuite...we'll have to fork
+#[Dynamic::ValidateAgainstSymbolTable]
+#at_inc_suffix=lib
+#inspect_required_modules=1
+#inspect_autoloaders=1
+#max_recursion=2

.preferred_modules.ini

@@ -0,0 +1,21 @@
+[JSON]
+prefer = Cpanel::JSON::XS
+reason = "Use a correct & fast JSON parser"
+
+[YAML]
+prefer = YAML::XS
+reason = "Use a correct & fast YAML parser"
+
+[Sereal]
+[Storable]
+prefer = Cpanel::JSON::XS
+reason = "JSON/YAML is preferred serialization format"
+
+[File::Slurper]
+prefer = File::Slurper::Temp
+for = write_binary write_text
+reason = "Avoid mangling files with concurrent writes"
+
+[perl/rand]
+prefer = Crypt::PRNG
+reason = builtin rand() insecure

lib/Trog/Auth.pm

@@ -420,6 +420,7 @@ sub audit_log (%opts) {
 
     my $where = @where ? 'WHERE ' . join( ' AND ', @where ) : '';
     my $rows = $dbh->selectall_arrayref(
+        ## no critic(ValuesAndExpressions::PreventSQLInjection)
         "SELECT id, event_time, username, session_id, ip_addr, event_type FROM audit_log $where ORDER BY event_time DESC LIMIT ?",
         { Slice => {} }, @bind, $limit
     );

lib/Trog/Log/Metrics.pm

@@ -59,6 +59,7 @@ sub requests_per ( $period, $num_periods, $before, @codes ) {
     }
     push( @input, $interval, $before, $num_periods );
 
+    ## no critic(ValuesAndExpressions::PreventSQLInjection)
     my $query = "SELECT count(*) FROM all_requests $whereclause GROUP BY date / ? HAVING date < ? LIMIT ?";
 
     my @results = map { $_->[0] } @{ Trog::Log::_dbh()->selectall_arrayref( $query, undef, @input ) };

lib/Trog/SQLite.pm

@@ -118,6 +118,7 @@ sub bulk_insert ( $dbh, $table, $keys, $ACTION = 'IGNORE', @values ) {
             while (@huh) {
                 push( @value_tuples, "(" . join( ',', ( splice( @huh, 0, $nkeys ) ) ) . ")" );
             }
+            ## no critic(ValuesAndExpressions::PreventSQLInjection)
             $query = "INSERT OR $ACTION INTO $table (" . join( ',', @$keys ) . ") VALUES " . join( ',', @value_tuples );
             $smt   = $dbh->prepare($query);
         }

lib/Trog/SQLite/TagIndex.pm

@@ -24,6 +24,7 @@ Also used to retrieve cached routes from posts.
 sub posts_for_tags (@tags) {
     my $dbh    = _dbh();
     my $clause = @tags ? "WHERE tag IN (" . join( ',', ( map { '?' } @tags ) ) . ")" : '';
+    ## no critic(ValuesAndExpressions::PreventSQLInjection)
     my $rows   = $dbh->selectall_arrayref( "SELECT DISTINCT id FROM posts $clause ORDER BY created DESC", { Slice => {} }, @tags );
     return () unless ref $rows eq 'ARRAY' && @$rows;
     return map { $_->{id} } @$rows;
@@ -110,6 +111,7 @@ sub build_index ( $data_obj, $posts = [] ) {
 sub _id_for_uuid ( $dbh, @uuids ) {
     my $bind = join( ',', ( map { '?' } @uuids ) );
     Trog::SQLite::bulk_insert( $dbh, 'post', ['uuid'], 'IGNORE', @uuids );
+    ## no critic(ValuesAndExpressions::PreventSQLInjection)
     return $dbh->selectall_hashref( "SELECT id,uuid FROM post WHERE uuid IN ($bind)", 'uuid', {}, @uuids );
 }