[13669] in Perl-Users-Digest
Perl-Users Digest, Issue: 1079 Volume: 9
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Fri Oct 15 16:03:18 1999
Date: Fri, 15 Oct 1999 13:02:29 -0700 (PDT)
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Message-Id: <940017749-v9-i1079@ruby.oce.orst.edu>
Content-Type: text
Perl-Users Digest Fri, 15 Oct 1999 Volume: 9 Number: 1079
Today's topics:
Special caracters <marco.cerqui@alcatel.ch>
Re: Special caracters (Abigail)
Re: Special caracters (Brett W. McCoy)
Re: Special caracters (Abigail)
Re: Special caracters <cassell@mail.cor.epa.gov>
Re: Special caracters <cassell@mail.cor.epa.gov>
Re: Special caracters (Martien Verbruggen)
Re: Special caracters (Brett W. McCoy)
Re: Special caracters <marco.cerqui@alcatel.ch>
Re: Special caracters (Brett W. McCoy)
Re: Special caracters (Abigail)
Re: Splash screen <aqumsieh@matrox.com>
strict, -wT problems <dwoods@ucalgary.ca>
Re: strict, -wT problems (Greg Bacon)
Re: strict, -wT problems <arthur.haas@westgeo.com>
Re: strict, -wT problems <JDAnderson@lbl.gov>
Re: strict, -wT problems <flavell@mail.cern.ch>
Re: strict, -wT problems <dwoods@ucalgary.ca>
Re: strict, -wT problems <dwoods@ucalgary.ca>
Re: strict, -wT problems <emschwar@rmi.net>
Re: strict, -wT problems (Tad McClellan)
Re: strict, -wT problems (Greg Bacon)
Digest Administrivia (Last modified: 16 Sep 99) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: Wed, 13 Oct 1999 09:13:49 +0200
From: "Marco Cerqui" <marco.cerqui@alcatel.ch>
Subject: Special caracters
Message-Id: <7u1bfe$pf3$1@pollux.ip-plus.net>
Hi
How can I count the special caracters in a string -> if ($string =~
tr/?????// >= 1 ).
Thanks
Marco
------------------------------
Date: 13 Oct 1999 15:19:34 -0500
From: abigail@delanet.com (Abigail)
Subject: Re: Special caracters
Message-Id: <slrn809qa6.nk2.abigail@alexandra.delanet.com>
Marco Cerqui (marco.cerqui@alcatel.ch) wrote on MMCCXXXIV September
MCMXCIII in <URL:news:7u1bfe$pf3$1@pollux.ip-plus.net>:
<> Hi
<>
<> How can I count the special caracters in a string -> if ($string =~
<> tr/?????// >= 1 ).
if ($string =~ tr/?????// >= 1) {
if ($string =~ tr/?????// >= 2) {
if ($string =~ tr/?????// >= 3) {
if ($string =~ tr/?????// >= 4) {
if ($string =~ tr/?????// >= 5) {
if ($string =~ tr/?????// >= 6) {
if ($string =~ tr/?????// >= 7) {
if ($string =~ tr/?????// >= 8) {
if ($string =~ tr/?????// >= 9) {
if ($string =~ tr/?????// >= 10) {
if ($string =~ tr/?????// >= 11) {
$amount = "Maybe I should look
what tr does";
}
else {
$amount = 10
}
}
else {
$amount = 9
}
}
else {
$amount = 8
}
}
else {
$amount = 7
}
}
else {
$amount = 6
}
}
else {
$amount = 5
}
}
else {
$amount = 4
}
}
else {
$amount = 3
}
}
else {
$amount = 2
}
}
else {
$amount = 1
}
}
else {
$amount = 0
}
Abigail
--
$_ = "\x3C\x3C\x45\x4F\x54";
print if s/<<EOT/<<EOT/e;
Just another Perl Hacker
EOT
-----------== Posted via Newsfeeds.Com, Uncensored Usenet News ==----------
http://www.newsfeeds.com The Largest Usenet Servers in the World!
------== Over 73,000 Newsgroups - Including Dedicated Binaries Servers ==-----
------------------------------
Date: Wed, 13 Oct 1999 20:32:55 GMT
From: bmccoy@foiservices.com (Brett W. McCoy)
Subject: Re: Special caracters
Message-Id: <slrn809rbl.v81.bmccoy@moebius.foiservices.com>
Also Sprach Abigail <abigail@delanet.com>:
><> How can I count the special caracters in a string -> if ($string =~
><> tr/?????// >= 1 ).
>
>if ($string =~ tr/?????// >= 1) {
<snipped>
Wonder what would take longer, to type that code by hand or to write a
program to generate it for you...
--
Brett W. McCoy bmccoy@foiservices.com
Computer Operations Manager (Alpha Geek) http://www.foiservices.com
FOI Services, Inc./DIOGENES 301-975-0110
---------------------------------------------------------------------------
------------------------------
Date: 13 Oct 1999 16:32:51 -0500
From: abigail@delanet.com (Abigail)
Subject: Re: Special caracters
Message-Id: <slrn809ujk.nk2.abigail@alexandra.delanet.com>
Brett W. McCoy (bmccoy@foiservices.com) wrote on MMCCXXXIV September
MCMXCIII in <URL:news:slrn809rbl.v81.bmccoy@moebius.foiservices.com>:
,, Also Sprach Abigail <abigail@delanet.com>:
,,
,, ><> How can I count the special caracters in a string -> if ($string =~
,, ><> tr/?????// >= 1 ).
,, >
,, >if ($string =~ tr/?????// >= 1) {
,, <snipped>
,,
,, Wonder what would take longer, to type that code by hand or to write a
,, program to generate it for you...
Oh, there's a third route. And that's the one I took.
Abigail
--
tie $" => A; $, = " "; $\ = "\n"; @a = ("") x 2; print map {"@a"} 1 .. 4;
sub A::TIESCALAR {bless \my $A => A} # Yet Another silly JAPH by Abigail
sub A::FETCH {@q = qw /Just Another Perl Hacker/ unless @q; shift @q}
-----------== Posted via Newsfeeds.Com, Uncensored Usenet News ==----------
http://www.newsfeeds.com The Largest Usenet Servers in the World!
------== Over 73,000 Newsgroups - Including Dedicated Binaries Servers ==-----
------------------------------
Date: Wed, 13 Oct 1999 15:02:25 -0700
From: David Cassell <cassell@mail.cor.epa.gov>
Subject: Re: Special caracters
Message-Id: <38050171.C61A8F98@mail.cor.epa.gov>
Marco Cerqui wrote:
>
> Hi
>
> How can I count the special caracters in a string -> if ($string =~
> tr/?????// >= 1 ).
Take a look at the docs [type 'perldoc perlop' to read about
tr///]. Then define what you mean by 'special characters'.
tr/// will take values other than 'a' to 'z' and 0 to 9.
David
--
David Cassell, OAO cassell@mail.cor.epa.gov
Senior computing specialist
mathematical statistician
------------------------------
Date: Wed, 13 Oct 1999 15:03:18 -0700
From: David Cassell <cassell@mail.cor.epa.gov>
Subject: Re: Special caracters
Message-Id: <380501A6.8B80169F@mail.cor.epa.gov>
Brett W. McCoy wrote:
>
> Also Sprach Abigail <abigail@delanet.com>:
>
> ><> How can I count the special caracters in a string -> if ($string =~
> ><> tr/?????// >= 1 ).
> >
> >if ($string =~ tr/?????// >= 1) {
> <snipped>
>
> Wonder what would take longer, to type that code by hand or to write a
> program to generate it for you...
Well, some people use an OS which passes itself off as a text
editor...
David
--
David Cassell, OAO cassell@mail.cor.epa.gov
Senior computing specialist
mathematical statistician
------------------------------
Date: Thu, 14 Oct 1999 02:02:09 GMT
From: mgjv@comdyn.com.au (Martien Verbruggen)
Subject: Re: Special caracters
Message-Id: <BQaN3.308$Bu4.5193@nsw.nnrp.telstra.net>
On 13 Oct 1999 16:32:51 -0500,
Abigail <abigail@delanet.com> wrote:
> Brett W. McCoy (bmccoy@foiservices.com) wrote on MMCCXXXIV September
> MCMXCIII in <URL:news:slrn809rbl.v81.bmccoy@moebius.foiservices.com>:
> ,, Also Sprach Abigail <abigail@delanet.com>:
> ,,
> ,, ><> How can I count the special caracters in a string -> if ($string =~
> ,, ><> tr/?????// >= 1 ).
> ,, >
> ,, >if ($string =~ tr/?????// >= 1) {
> ,, <snipped>
> ,,
> ,, Wonder what would take longer, to type that code by hand or to write a
> ,, program to generate it for you...
>
>
> Oh, there's a third route. And that's the one I took.
You mean you copied this from your production code?
:)
Martien
--
Martien Verbruggen |
Interactive Media Division | Useful Statistic: 75% of the people make up
Commercial Dynamics Pty. Ltd. | 3/4 of the population.
NSW, Australia |
------------------------------
Date: Thu, 14 Oct 1999 02:36:03 GMT
From: bmccoy@news.lan2wan.com (Brett W. McCoy)
Subject: Re: Special caracters
Message-Id: <slrn80agj3.4s6.bmccoy@dragosani.lan2wan.com>
On 13 Oct 1999 16:32:51 -0500, Abigail <abigail@delanet.com> wrote:
>,, Wonder what would take longer, to type that code by hand or to write a
>,, program to generate it for you...
>
>Oh, there's a third route. And that's the one I took.
Oh, it was in the FAQ! How silly of me! :+]
--
Brett W. McCoy
http://www.lan2wan.com/~bmccoy/
-----------------------------------------------------------------------
No matter how cynical you get, it's impossible to keep up.
------------------------------
Date: Thu, 14 Oct 1999 08:14:17 +0200
From: "Marco Cerqui" <marco.cerqui@alcatel.ch>
Subject: Re: Special caracters
Message-Id: <7u3sbs$n1n$1@pollux.ip-plus.net>
Sorry, but I'm a "Newbie" in Perl, so all your suggestions don't help me
very much. Sorry! Whit special caracters I mean, all the caracters who are
not A - Z and 0-9. I need this routine to check a passwort in a string befor
I will give this passwort to yppasswd and you all know, that special
caracters are allowed in passwords.
Please can someone help me ?
Thanks a lot
Marco
David Cassell wrote in message <38050171.C61A8F98@mail.cor.epa.gov>...
>Marco Cerqui wrote:
>>
>> Hi
>>
>> How can I count the special caracters in a string -> if ($string =~
>> tr/?????// >= 1 ).
>
>Take a look at the docs [type 'perldoc perlop' to read about
>tr///]. Then define what you mean by 'special characters'.
>tr/// will take values other than 'a' to 'z' and 0 to 9.
>
>David
>--
>David Cassell, OAO cassell@mail.cor.epa.gov
>Senior computing specialist
>mathematical statistician
------------------------------
Date: Thu, 14 Oct 1999 16:09:15 GMT
From: bmccoy@foiservices.com (Brett W. McCoy)
Subject: Re: Special caracters
Message-Id: <slrn80c09c.ng.bmccoy@moebius.foiservices.com>
Also Sprach Marco Cerqui <marco.cerqui@alcatel.ch>:
>Sorry, but I'm a "Newbie" in Perl, so all your suggestions don't help me
>very much. Sorry! Whit special caracters I mean, all the caracters who are
>not A - Z and 0-9. I need this routine to check a passwort in a string befor
>I will give this passwort to yppasswd and you all know, that special
>caracters are allowed in passwords.
\W is used to match any nonword character -- a word character being
alphanumeric characters plus _. Look at perdoc perlre. You can also
match against whitespace characters: \s ' ', \t, \n \r, \f.
--
Brett W. McCoy bmccoy@foiservices.com
Computer Operations Manager (Alpha Geek) http://www.foiservices.com
FOI Services, Inc./DIOGENES 301-975-0110
---------------------------------------------------------------------------
------------------------------
Date: 14 Oct 1999 16:47:09 -0500
From: abigail@delanet.com (Abigail)
Subject: Re: Special caracters
Message-Id: <slrn80cjqb.cso.abigail@alexandra.delanet.com>
Marco Cerqui (marco.cerqui@alcatel.ch) wrote on MMCCXXXV September
MCMXCIII in <URL:news:7u3sbs$n1n$1@pollux.ip-plus.net>:
// Sorry, but I'm a "Newbie" in Perl, so all your suggestions don't help me
// very much. Sorry! Whit special caracters I mean, all the caracters who are
// not A - Z and 0-9. I need this routine to check a passwort in a string befor
// I will give this passwort to yppasswd and you all know, that special
// caracters are allowed in passwords.
I assume both lowercase and uppercase are allowed?
$illegal = do {local $_ = $password; y/a-zA-Z0-9//cd};
Now, before you come back and complain you don't understand cause you're
a newbie, check the manual on those parts you do not understand.
Abigail
--
echo "==== ======= ==== ======"|perl -pes/=/J/|perl -pes/==/us/|perl -pes/=/t/\
|perl -pes/=/A/|perl -pes/=/n/|perl -pes/=/o/|perl -pes/==/th/|perl -pes/=/e/\
|perl -pes/=/r/|perl -pes/=/P/|perl -pes/=/e/|perl -pes/==/rl/|perl -pes/=/H/\
|perl -pes/=/a/|perl -pes/=/c/|perl -pes/=/k/|perl -pes/==/er/|perl -pes/=/./;
-----------== Posted via Newsfeeds.Com, Uncensored Usenet News ==----------
http://www.newsfeeds.com The Largest Usenet Servers in the World!
------== Over 73,000 Newsgroups - Including Dedicated Binaries Servers ==-----
------------------------------
Date: Tue, 12 Oct 1999 16:45:28 -0400
From: Ala Qumsieh <aqumsieh@matrox.com>
Subject: Re: Splash screen
Message-Id: <x3yg0zg71g8.fsf@tigre.matrox.com>
itsme9905@aol.comnojunk (ItsMe9905) writes:
> If by "visualize" you mean if you can have a Perl script write out
> an HTML page for you then the answer is yes.
I am really curious as to how you interpreted the post the way you
did. The original post, which I am including below since you didn't
include it, says nothing about HTML, or even CGI. Perl is much more
than just a CGI language, you know.
Apparently, Edo wants a Perl script to display some graphical splash
screen when a certain Perl program in executed. I suggest s/he looks
into the Tk module, which is available from CPAN.
--Ala
---------------------------------------------------------
From: Edo <edo@tin.it>
Subject: Splash screen
Newsgroups: comp.lang.perl.misc
Date: Fri, 8 Oct 1999 04:28:39 -0400
Path: news.Matrox.com!kleenex.spherenet.com!east1.newsfeed.sprint-canada.net!tor-nx1.netcom.ca!sunqbc.risq.qc.ca!bignews.mediaways.net!newsfeed.nettuno.it!server-b.cs.interbusiness.it!news.tin.it!not-for-mail
NNTP-Posting-Host: a-vi4-33.tin.it
Message-ID: <nv9kt7.5b.ln@scatolinux.it>
Lines: 8
User-Agent: tin/pre-1.4-981002 ("Phobia") (UNIX) (Linux/2.2.12 (i586
Hi!
First of all, sorry for my English!!!
I'd like to know if it is possible, inside a perl script, to visualize a
splash screen.
Thanks
Edo
------------------------------
Date: Wed, 13 Oct 1999 13:52:17 -0700
From: Dan Woods <dwoods@ucalgary.ca>
Subject: strict, -wT problems
Message-Id: <7u2o42$k6e@ds2.acs.ucalgary.ca>
Trying to be good, I turned on taint checking with warnings.
However I am getting unknown errors (that is I don't know
why they are bad)...
#!/usr/local/bin/perl -wT
use diagnostics;
use strict;
$ENV{'PATH'}="/bin:/usr/sbin:/usr/bin:/usr/local/bin"; # For safety
# my $sendmail = "/usr/sbin/sendmail -oi -t -n";
my $sendmail = "/usr/bin/cat"; # testing purposes
my $name = "Dan Woods";
my $contact = "dwoods\@ucalgary.ca";
my $sendto = "www\@4loops.com";
&send_request;
exit;
sub send_request {
open (SENDMAIL, "| $sendmail") or die "ERROR opening sendmail: $!\n";
print SENDMAIL <<mail_out;
From: $name <$contact>
To: $sendto
Subject: Testing taint mode
X-Remote-Host: $ENV{"REMOTE_ADDR"}
Hi Dan!
mail_out
close(SENDMAIL) or die "ERROR closing sendmail: $!\n";
}
####
I simplified the above script for this email. Why this error on "open" line ?
Uncaught exception from user code:
Insecure $ENV{ENV} while running with -T switch at xdan.cgi line 16.
main::send_request called at xdan.cgi line 12
If I remove the taint "-T" on the first line, I get this error on "print
SENDMAIL" line.
Use of uninitialized value at x2 line 18 (#1)
(W) An undefined value was used as if it were already defined. It was
interpreted as a "" or a 0, but maybe it was a mistake. To suppress this
warning assign an initial value to your variables.
I've spent 4 hours on this so far, and I'm pretty much going to give up using
the "-wT" or "use strict"... it's too frustrating :( Help please!
Thanks...Dan. (cc and posted appreciated)
www.4loops.com
------------------------------
Date: 13 Oct 1999 20:16:36 GMT
From: gbacon@ruby.itsc.uah.edu (Greg Bacon)
Subject: Re: strict, -wT problems
Message-Id: <7u2pb4$6u6$2@info2.uah.edu>
In article <7u2o42$k6e@ds2.acs.ucalgary.ca>,
Dan Woods <dwoods@ucalgary.ca> writes:
: I simplified the above script for this email. Why this error on "open" line ?
:
: Uncaught exception from user code:
: Insecure $ENV{ENV} while running with -T switch at xdan.cgi line 16.
: main::send_request called at xdan.cgi line 12
From the perlsec manpage:
The PATH isn't the only environment variable which can cause
problems. Because some shells may use the variables IFS, CDPATH,
ENV, and BASH_ENV, Perl checks that those are either empty or
untainted when starting subprocesses. You may wish to add something
like this to your setid and taint-checking scripts.
delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; # Make %ENV safer
: If I remove the taint "-T" on the first line, I get this error on "print
: SENDMAIL" line.
: Use of uninitialized value at x2 line 18 (#1)
That's just a warning. Is $ENV{REMOTE_ADDR} defined? You also need to
leave a blank line between the headers and body of your message.
Greg
--
It has been discovered that C++ provides a remarkable facility for concealing
the trival details of a program--such as where its bugs are.
-- David Keppel
------------------------------
Date: 13 Oct 1999 15:25:28 -0500
From: Art Haas <arthur.haas@westgeo.com>
Subject: Re: strict, -wT problems
Message-Id: <lr1zaz80uf.fsf@yoda.wg.waii.com>
Dan Woods <dwoods@ucalgary.ca> writes:
> Trying to be good, I turned on taint checking with warnings.
> However I am getting unknown errors (that is I don't know
> why they are bad)...
>
Stick to it - it will pay off in the end ...
> [ ... snip ... ]
>
> If I remove the taint "-T" on the first line, I get this error on "print
> SENDMAIL" line.
> Use of uninitialized value at x2 line 18 (#1)
>
> (W) An undefined value was used as if it were already defined. It was
> interpreted as a "" or a 0, but maybe it was a mistake. To suppress this
> warning assign an initial value to your variables.
>
The $ENV{"REMOTE_ADDR"} variable is probably empty - running your script
from the command line I got the same warning. Setting it to something
made the warning go away.
--
###############################
# Art Haas
# (713) 689-2417
###############################
------------------------------
Date: 13 Oct 1999 13:34:44 -0700
From: Jeffrey D Anderson <JDAnderson@lbl.gov>
Subject: Re: strict, -wT problems
Message-Id: <lqu2nvdmor.fsf@thwk23.lbl.gov>
Dan Woods <dwoods@ucalgary.ca> writes:
> Trying to be good, I turned on taint checking with warnings.
> However I am getting unknown errors (that is I don't know
> why they are bad)...
>
> #!/usr/local/bin/perl -wT
> use diagnostics;
> use strict;
> $ENV{'PATH'}="/bin:/usr/sbin:/usr/bin:/usr/local/bin"; # For safety
>
> # my $sendmail = "/usr/sbin/sendmail -oi -t -n";
> my $sendmail = "/usr/bin/cat"; # testing purposes
> my $name = "Dan Woods";
> my $contact = "dwoods\@ucalgary.ca";
> my $sendto = "www\@4loops.com";
>
> &send_request;
> exit;
>
> sub send_request {
> open (SENDMAIL, "| $sendmail") or die "ERROR opening sendmail: $!\n";
>
> print SENDMAIL <<mail_out;
> From: $name <$contact>
> To: $sendto
> Subject: Testing taint mode
> X-Remote-Host: $ENV{"REMOTE_ADDR"}
> Hi Dan!
> mail_out
>
> close(SENDMAIL) or die "ERROR closing sendmail: $!\n";
> }
> ####
>
> I simplified the above script for this email. Why this error on "open" line ?
>
> Uncaught exception from user code:
> Insecure $ENV{ENV} while running with -T switch at xdan.cgi line 16.
> main::send_request called at xdan.cgi line 12
This means that $ENV{'ENV'} has an insecure value. You've reset
$ENV{'PATH'}, but that's not enough for -T mode. Try adding the line
delete @ENV{'ENV'}
> If I remove the taint "-T" on the first line, I get this error on "print
> SENDMAIL" line.
> Use of uninitialized value at x2 line 18 (#1)
>
> (W) An undefined value was used as if it were already defined. It was
> interpreted as a "" or a 0, but maybe it was a mistake. To suppress this
> warning assign an initial value to your variables.
I suspect that the line numbers in your posted example don't exactly
line up with those in your script. My best guess is that line 18 in
your script is
X-Remote-Host: $ENV{"REMOTE_ADDR"}
and that $ENV{'REMOTE_ADDR'} is in fact undefined. This
is just a warning and shouldn't prevent the script from running, but
you can try testing for its existance before using it.
my $remote_addr = $ENV{'REMOTE_ADDR'} || 'None-given';
or something like that.
By the way, I think the standards specify that there should be a blank
line between the headers and the message body, and at the end of the
body. I can't quote the RFC off the top of my head though.
--
--------------------------------------------------------------
Jeffrey Anderson | JDAnderson@lbl.gov
Lawrence Berkeley National Laboratory | Mailstop 50a-5101
Phone: 510 486-4208 | Fax: 510 486-6808
------------------------------
Date: Wed, 13 Oct 1999 22:31:33 +0200
From: "Alan J. Flavell" <flavell@mail.cern.ch>
Subject: Re: strict, -wT problems
Message-Id: <Pine.HPP.3.95a.991013221056.1683A-100000@hpplus01.cern.ch>
On Wed, 13 Oct 1999, Dan Woods wrote:
> open (SENDMAIL, "| $sendmail") or die "ERROR opening sendmail: $!\n";
> Uncaught exception from user code:
> Insecure $ENV{ENV} while running with -T switch at xdan.cgi line 16.
> main::send_request called at xdan.cgi line 12
perldiag tells us:
Insecure $ENV{%s} while running %s
(F) You can't use system(), exec(), or a piped open in a setuid or
setgid script if any of $ENV{PATH}, $ENV{IFS}, $ENV{CDPATH},$ENV{ENV}
or $ENV{BASH_ENV} are derived from data supplied (or potentially
supplied) by the user. [...] See the perlsec manpage.
When concerned about an error message, perldiag is always the first
place to look. Unlike certain implementations where inscrutable
and undocumented messages emerge from obscure nooks and crannies of the
system, Perl seems to take a pride in documenting its messages.
Your message is worried about the ENV, you see. Next move would be
a look at perlsec.
> If I remove the taint "-T" on the first line, I get this error on "print
> SENDMAIL" line.
> Use of uninitialized value at x2 line 18 (#1)
[...]
> I've spent 4 hours on this so far, and I'm pretty much going to give up using
> the "-wT" or "use strict"... it's too frustrating :(
I don't think so! Perl is telling you that your program is doing
something that you don't understand. Instead of making it shut up,
surely it's better to understand what it's doing and correct it, no?
Randal uses sendmail in Webtechniques 38:
http://www.stonehenge.com/merlyn/WebTechniques/col38.html and I see that
it has the -T flag on in the first example. You might sneak a look at
what he's doing, and pick up ideas.
There are safe and unsafe ways of invoking sendmail. Take care.
good luck
------------------------------
Date: Wed, 13 Oct 1999 15:07:48 -0700
From: Dan Woods <dwoods@ucalgary.ca>
Subject: Re: strict, -wT problems
Message-Id: <7u2shl$qbo@ds2.acs.ucalgary.ca>
Greg Bacon wrote:
>
> In article <7u2o42$k6e@ds2.acs.ucalgary.ca>,
> Dan Woods <dwoods@ucalgary.ca> writes:
>
> : I simplified the above script for this email. Why this error on "open" line ?
> :
> : Uncaught exception from user code:
> : Insecure $ENV{ENV} while running with -T switch at xdan.cgi line 16.
> : main::send_request called at xdan.cgi line 12
>
> From the perlsec manpage:
>
> The PATH isn't the only environment variable which can cause
> problems. Because some shells may use the variables IFS, CDPATH,
> ENV, and BASH_ENV, Perl checks that those are either empty or
> untainted when starting subprocesses. You may wish to add something
> like this to your setid and taint-checking scripts.
>
> delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; # Make %ENV safer
>
> : If I remove the taint "-T" on the first line, I get this error on "print
> : SENDMAIL" line.
> : Use of uninitialized value at x2 line 18 (#1)
>
> That's just a warning. Is $ENV{REMOTE_ADDR} defined? You also need to
> leave a blank line between the headers and body of your message.
You're right about blank.
I hate that "uninitialized value" message since it should not occur, and
if there is something wrong, what is it ?
And now I'm going blind... (error on close() line at end). WHAT is it ?
syntax error at x2 line 29, near "close"
Execution of x2 aborted due to compilation errors.
#!/usr/local/bin/perl
# use diagnostics;
# use strict;
delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; # Make %ENV safer
$ENV{'PATH'}="/bin:/usr/sbin:/usr/bin:/usr/local/bin"; # For safety
# my $sendmail = "/usr/sbin/sendmail -oi -t -n";
my $sendmail = "/usr/bin/cat"; # testing purposes
my $name = "Dan Woods";
my $contact = "dwoods\@ucalgary.ca";
my $sendto = "www\@4loops.com";
&send_request;
exit;
sub send_request {
open(SENDMAIL, "| $sendmail") or die "ERROR opening sendmail: $!\n";
# X-Remote-Host: $ENV{"REMOTE_ADDR"}
print SENDMAIL <<mail_out
From: $name <$contact>
To: $sendto
Subject: Testing taint mode
Hi Dan!
mail_out
close(SENDMAIL) or die "ERROR closing sendmail: $!\n";
}
------------------------------
Date: Wed, 13 Oct 1999 15:24:30 -0700
From: Dan Woods <dwoods@ucalgary.ca>
Subject: Re: strict, -wT problems
Message-Id: <7u2tgv$tta@ds2.acs.ucalgary.ca>
> print SENDMAIL <<mail_out
> From: $name <$contact>
> To: $sendto
> Subject: Testing taint mode
>
> Hi Dan!
> mail_out
>
> close(SENDMAIL) or die "ERROR closing sendmail: $!\n";
> }
Got it! Left out the ';' after <<mail_out
The line got deleted, I retyped it but forgot the ';'.
You all know how it is when you stare and stare going
blind not able to see the answer, and then someone
looks over your shoulder and says "what's that?".
If my case, using diff against a backup gave me the answer.
Thanks...Dan.
------------------------------
Date: 13 Oct 1999 15:50:28 -0600
From: Eric The Read <emschwar@rmi.net>
Subject: Re: strict, -wT problems
Message-Id: <xkfemez53rv.fsf@valdemar.col.hp.com>
Dan Woods <dwoods@ucalgary.ca> writes:
> You're right about blank.
> I hate that "uninitialized value" message since it should not occur, and
> if there is something wrong, what is it ?
Um, isn't that the point of error messages... since they shouldn't occur,
you know that when they do, something's wrong? Also, the perldiag
manpage explains all the errors and warnings perl comes up with very
clearly.
> And now I'm going blind... (error on close() line at end). WHAT is it ?
> syntax error at x2 line 29, near "close"
> Execution of x2 aborted due to compilation errors.
The relevant subroutine:
> sub send_request {
> open(SENDMAIL, "| $sendmail") or die "ERROR opening sendmail: $!\n";
>
> # X-Remote-Host: $ENV{"REMOTE_ADDR"}
> print SENDMAIL <<mail_out
You're missing a semicolon here. See perldata, and search for
'here-doc'.
> From: $name <$contact>
> To: $sendto
> Subject: Testing taint mode
>
> Hi Dan!
> mail_out
Since the previous statement was missing its semicolon, the error appears
at the start of the next one, namely here.
> close(SENDMAIL) or die "ERROR closing sendmail: $!\n";
> }
-=Eric
--
"Cutting the space budget really restores my faith in humanity. It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
-- Johnny Hart
------------------------------
Date: Thu, 14 Oct 1999 05:11:22 -0400
From: tadmc@metronet.com (Tad McClellan)
Subject: Re: strict, -wT problems
Message-Id: <qn64u7.tp2.ln@magna.metronet.com>
Dan Woods (dwoods@ucalgary.ca) wrote:
: I retyped it but forgot the ';'.
So the lesson that you have learned here is to *never* type
in code, use cut/paste instead.
Else you get comments about your typo (which isn't even in
your code) instead of about your real problem.
Retyping is *asking* to have yours, and *thousands* of other people's,
time wasted.
Wasting time is not good.
--
Tad McClellan SGML Consulting
tadmc@metronet.com Perl programming
Fort Worth, Texas
------------------------------
Date: 14 Oct 1999 15:18:30 GMT
From: gbacon@ruby.itsc.uah.edu (Greg Bacon)
Subject: Re: strict, -wT problems
Message-Id: <7u4s86$r83$1@info2.uah.edu>
In article <qn64u7.tp2.ln@magna.metronet.com>,
tadmc@metronet.com (Tad McClellan) writes:
: Wasting time is not good.
Then why do we have Usenet? :-)
Greg
--
So far as I can remember, there is not one word in the Gospels in
praise of intelligence.
-- Bertrand Russell
------------------------------
Date: 16 Sep 99 21:33:47 GMT (Last modified)
From: Perl-Users-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 16 Sep 99)
Message-Id: <null>
Administrivia:
The Perl-Users Digest is a retransmission of the USENET newsgroup
comp.lang.perl.misc. For subscription or unsubscription requests, send
the single line:
subscribe perl-users
or:
unsubscribe perl-users
to almanac@ruby.oce.orst.edu.
| NOTE: The mail to news gateway, and thus the ability to submit articles
| through this service to the newsgroup, has been removed. I do not have
| time to individually vet each article to make sure that someone isn't
| abusing the service, and I no longer have any desire to waste my time
| dealing with the campus admins when some fool complains to them about an
| article that has come through the gateway instead of complaining
| to the source.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
To request back copies (available for a week or so), send your request
to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
where x is the volume number and y is the issue number.
For other requests pertaining to the digest, send mail to
perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
sending perl questions to the -request address, I don't have time to
answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V9 Issue 1079
**************************************
