[24731] in Perl-Users-Digest
Perl-Users Digest, Issue: 6886 Volume: 10
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Fri Aug 20 00:06:08 2004
Date: Thu, 19 Aug 2004 21:05:05 -0700 (PDT)
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Perl-Users Digest Thu, 19 Aug 2004 Volume: 10 Number: 6886
Today's topics:
[OT: alias/address] (was Re: how to run dos command in <tadmc@augustmail.com>
Any YahooPop/fetchyahoo Like For NNTP on Google? <SaveWorldFromAids@alexa.com>
Re: Any YahooPop/fetchyahoo Like For NNTP on Google? <usenet200408@tobyinkster.co.uk>
Re: Any YahooPop/fetchyahoo Like For NNTP on Google? <SaveWorldFromAids@alexa.com>
Re: Any YahooPop/fetchyahoo Like For NNTP on Google? <webmaster@clarkecomputers.com.au>
Re: capture scoping <tadmc@augustmail.com>
Re: Database vs Text for text search ctcgag@hotmail.com
Re: Database vs Text for text search <invalid-email@rochester.rr.com>
Re: Earthquake forecasting program Aug. 16, 2004 <billsmith@ispwest.com>
Re: editing perl script through TEXTAREA <noreply@gunnar.cc>
Re: editing perl script through TEXTAREA <flavell@ph.gla.ac.uk>
Re: How Should I Check for Directory existance in a ser <wherrera@lynxview.com>
Re: how to run dos command in perl <me@privacy.net>
Re: how to run dos command in perl <lv@aol.com>
Re: How to upload a file from a local pc to a web serv <tadmc@augustmail.com>
Re: How to upload a file from a local pc to a web serv (srini)
Re: How to upload a file from a local pc to a web serv <postmaster@castleamber.com>
Re: How to upload a file from a local pc to a web serv <flavell@ph.gla.ac.uk>
Image::Magick problem after (failed?) install <krism@ccvcorp.com>
no re 'eval' not secure enough <mb@uq.net.au.invalid>
Re: trim code for mimic ls -tr <noemail@#$&&!.net>
Re: trim code for mimic ls -tr <noemail@#$&&!.net>
Re: trim code for mimic ls -tr <miknrene@drizzle.com>
Digest Administrivia (Last modified: 6 Apr 01) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: Thu, 19 Aug 2004 19:01:19 -0500
From: Tad McClellan <tadmc@augustmail.com>
Subject: [OT: alias/address] (was Re: how to run dos command in perl)
Message-Id: <slrnciafqf.iti.tadmc@magna.augustmail.com>
Tintin <me@privacy.net> wrote:
^^^^^^^^^^^^^^
^^^^^^^^^^^^^^
Please consider using something else there.
With that address, your posts become nearly invisible due to
others who've used it previously (with "X-No-Archive: yes",
so it can't be googled but I've saved the post in my "cemetery" :-).
If this really is tintin, I'd like to not have you scored into oblivion...
--
Tad McClellan SGML consulting
tadmc@augustmail.com Perl programming
Fort Worth, Texas
------------------------------
Date: Thu, 19 Aug 2004 22:20:28 GMT
From: "http://links.i6networks.com" <SaveWorldFromAids@alexa.com>
Subject: Any YahooPop/fetchyahoo Like For NNTP on Google?
Message-Id: <MI9Vc.1821704$Ar.1422137@twister01.bloor.is.net.cable.rogers.com>
YahooPOP is based on fetchyahoo, a Perl program to pop emails out of Yahoo.
Is there something to do the same so for NNTP on GOOGLE?
It should act like a NNTP server, but it translate the request via HTTP/WEB
to groups.google.com for reading and posting.
Anyone seen similar projects?
------------------------------
Date: Fri, 20 Aug 2004 00:29:24 +0100
From: Toby Inkster <usenet200408@tobyinkster.co.uk>
Subject: Re: Any YahooPop/fetchyahoo Like For NNTP on Google?
Message-Id: <pan.2004.08.19.23.29.22.87124@tobyinkster.co.uk>
http://links.i6networks.com wrote:
> It should act like a NNTP server, but it translate the request via HTTP/WEB
> to groups.google.com for reading and posting.
Why not just use a normal news server?
--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact
------------------------------
Date: Fri, 20 Aug 2004 00:10:08 GMT
From: "http://links.i6networks.com" <SaveWorldFromAids@alexa.com>
Subject: Re: Any YahooPop/fetchyahoo Like For NNTP on Google?
Message-Id: <AjbVc.1822548$Ar.1398935@twister01.bloor.is.net.cable.rogers.com>
> http://links.i6networks.com wrote:
>
> > It should act like a NNTP server, but it translate the request via
HTTP/WEB
> > to groups.google.com for reading and posting.
>
> Why not just use a normal news server?
>
> --
> Toby A Inkster BSc (Hons) ARCS
> Contact Me ~ http://tobyinkster.co.uk/contact
>
The normal one is NOT FREE. Very few ISP provides free NNTP, and it has many
restrictions. Juno, Netscape, NetZero, People's PC don't have NNTP. Many
foreign ISPs don't have NNTP. groups.google.com is almost the only free one
allowing posting and reading.
------------------------------
Date: Fri, 20 Aug 2004 10:13:02 +1000
From: Mark Parnell <webmaster@clarkecomputers.com.au>
Subject: Re: Any YahooPop/fetchyahoo Like For NNTP on Google?
Message-Id: <8rqyxiax0u3v.8urwbbm7cnrs$.dlg@40tude.net>
On Fri, 20 Aug 2004 00:10:08 GMT, "http://links.i6networks.com"
<SaveWorldFromAids@alexa.com> declared in
alt.php,alt.www.webmaster,comp.lang.perl.misc:
> Very few ISP provides free NNTP, and it has many restrictions.
Really? Most here do.
> groups.google.com is almost the only free one allowing posting and reading.
http://news.individual.net/
--
Mark Parnell
http://www.clarkecomputers.com.au
------------------------------
Date: Thu, 19 Aug 2004 18:37:15 -0500
From: Tad McClellan <tadmc@augustmail.com>
Subject: Re: capture scoping
Message-Id: <slrnciaedb.iti.tadmc@magna.augustmail.com>
Jeff Thies <jeff@spamalanadingong.com> wrote:
> Tad McClellan wrote:
>> Have you seen the Posting Guidelines that are posted here frequently?
> if you wish, you
> can point me at that.
http://mail.augustmail.com/~tadmc/clpmisc.shtml
Or, Google for "Posting Guidelines Perl"...
--
Tad McClellan SGML consulting
tadmc@augustmail.com Perl programming
Fort Worth, Texas
------------------------------
Date: 20 Aug 2004 02:19:58 GMT
From: ctcgag@hotmail.com
Subject: Re: Database vs Text for text search
Message-Id: <20040819221958.304$oP@newsreader.com>
"http://links.i6networks.com" <SaveWorldFromAids@alexa.com> wrote:
> At what level a database will be better for a read only text search?
What kind of searching? What kind of joins?
> I have some records, each has 6 fields. Each record has a pararent
> record.
>
> Each parent has less than 100 childs.
>
> Total records is about 1000-1500.
>
> I want to put everthing in one single file, or put each parent and their
> children in a file so I can have 20-30 files.
>
> I am afraid to go to the database route, because the limitation of
> concurent connections and the overhead of database search.
Databases are designed to handle concurrent connections, and are designed
to do searches efficiently. That is what they are for.
> Is there a cut-off number of records, below that line, text is better,
> above it, database is better?
No. I have database tables with as few as 5 row, and as many 100,000,000.
I have text file schemas with as few as few as 1 records, and as many as
50,000,000,000.
Which one you choose depends on the concurrency, the data model, the
algorithmic and indexing schemes necessary to achieve acceptable
performance under the access conditions, etc.
Xho
--
-------------------- http://NewsReader.Com/ --------------------
Usenet Newsgroup Service $9.95/Month 30GB
------------------------------
Date: Fri, 20 Aug 2004 02:33:18 GMT
From: Bob Walton <invalid-email@rochester.rr.com>
Subject: Re: Database vs Text for text search
Message-Id: <412562EA.5040603@rochester.rr.com>
http://links.i6networks.com wrote:
> At what level a database will be better for a read only text search?
>
> I have some records, each has 6 fields. Each record has a pararent record.
>
> Each parent has less than 100 childs.
>
> Total records is about 1000-1500.
>
> I want to put everthing in one single file, or put each parent and their
> children in a file so I can have 20-30 files.
>
> I am afraid to go to the database route, because the limitation of concurent
> connections and the overhead of database search.
>
> Is there a cut-off number of records, below that line, text is better, above
> it, database is better?
Well, you don't provide nearly enough information to make such a
decision. Is this a CGI app? Batch lookup? Something else? What
response time is required? You mention concurrent connections. How
many? You also mention the "overhead" of a "database search". That
would be a lot less than the overhead of a brute-force search of a
flat-file text file (assuming a decent database). The overhead of
establishing a database connection, however, may well exceed that of a
brute force text file search. Your file seems quite small -- will it
ever be bigger, or is that it? How complicated are the lookups?
Assuming your app is CGI with less than a large number of hits, it seems
like the brute force text file search would be reasonable, given the
indicated size of the file. Since it is read-only, you don't have to
worry about file locking, or adding/deleting/changing data, all of which
dramatically simplifies things.
--
Bob Walton
Email: http://bwalton.com/cgi-bin/emailbob.pl
------------------------------
Date: Thu, 19 Aug 2004 17:24:17 -0700
From: "Bill Smith" <billsmith@ispwest.com>
Subject: Re: Earthquake forecasting program Aug. 16, 2004
Message-Id: <cg3gcl01aul@enews2.newsguy.com>
Lessee......
>
> >He is partly correct about one thing though. I really don't know why
that
> >Perl program works.
Translation: It doesn't work.
> It is based on a geophysics theory picture which I
> >developed and which appears to be accurate as far as it goes.
What is a "geophysics theory picture?" And what appears to be accurate, oh,
that must be the "geophics theory picture." One can't see software.
Translated: "It" (take yoiur choice) isn't very accurate. In fact, it is
likely wrong in most instances.
> But no one
> >that I know of can explain exactly what it is telling us about the true
> >nature of earthquake triggering processes.
Translation: It isn't telling "us" anything.
> >
>
>
> --
> Ak'toh'di
why>?
------------------------------
Date: Fri, 20 Aug 2004 01:00:48 +0200
From: Gunnar Hjalmarsson <noreply@gunnar.cc>
Subject: Re: editing perl script through TEXTAREA
Message-Id: <2okpluFbj584U1@uni-berlin.de>
Alan J. Flavell wrote:
> While the CGI.pm user is learning the details, CGI.pm is taking
> care of the basic blunders that they're likely to make. Whereas
> those who insist on hand-knitting their own code (which is
> commendable enough as a learning experience) and then making the
> mistake of actually using it in production in a WWW environnment,
> are doomed to producing open mail relays, web proxies, and heaven
> knows what else before they get a proper feeling for web security.
>
> In that sense, those who know *enough* to be able to write their
> own code safely have no need of our advice here - but those who
> need to ask would be better steered towards peer-reviewed modules
> such as CGI.pm unti such time as they're ready to take their own
> decisions.
I don't believe it: You did it again!! In effect you just said that as
long as you use CGI.pm, you don't need to know about web security,
since CGI.pm takes care of it for you. Still you know much better than
most of us that nothing could be more wrong than just that.
- Using CGI.pm does *not* prevent anybody from unintentionally create
open mail relays.
- Using CGI.pm does *not* make it less important to validate incoming
data.
- Using CGI.pm does *not* (automatically) protect you from DoS
attacks.
- CGI.pm is *not* a generic cure against stupidity.
Instead of making such statements, and with that lull the beginners
into a false security, why don't you point people to documents such as
http://www.faqs.org/faqs/www/cgi-faq/preamble.html
http://www.w3.org/Security/Faq/www-security-faq.html
Then you would help them prepare their defense "in the hostile light
of a WWW situation" as you put it in a part of your message that I
just snipped...
P.S. CGI.pm is a convenient tool-box when creating CGI apps. I'm not
arguing against the use of it. It does take care of some "basic
blunders" with respect to functionality, but only to a very limited
extent with respect to security.
--
Gunnar Hjalmarsson
Email: http://www.gunnar.cc/cgi-bin/contact.pl
------------------------------
Date: Fri, 20 Aug 2004 00:47:52 +0100
From: "Alan J. Flavell" <flavell@ph.gla.ac.uk>
Subject: Re: editing perl script through TEXTAREA
Message-Id: <Pine.LNX.4.61.0408200036470.4989@ppepc56.ph.gla.ac.uk>
On Fri, 20 Aug 2004, Gunnar Hjalmarsson wrote:
> Alan J. Flavell wrote:
> > While the CGI.pm user is learning the details, CGI.pm is taking
> > care of the basic blunders that they're likely to make.
[...]
> I don't believe it: You did it again!! In effect you just said that as
> long as you use CGI.pm, you don't need to know about web security,
That wasn't my intention.
> - CGI.pm is *not* a generic cure against stupidity.
Correct. But refusing to use CGI.pm is even less a cure against
stupidity.
> into a false security, why don't you point people to documents such as
>
> http://www.faqs.org/faqs/www/cgi-faq/preamble.html
Well recommended, from a well-respected author in the field
> http://www.w3.org/Security/Faq/www-security-faq.html
whose author is - guess who...
Yes, I fully support that part of your campaign.
> P.S. CGI.pm is a convenient tool-box when creating CGI apps. I'm not
> arguing against the use of it. It does take care of some "basic
> blunders" with respect to functionality,
Indeed.
> but only to a very limited extent with respect to security.
On the one hand it's certainly possible to use it to implement some
blatantly insecure applications (e.g as open relay, as you mentioned).
On the other hand it internally protects against some rather obscure
and non-obvious exposures (for example that rather complex field
discussed in CERT CA-2000-02) before the naive beginner even starts to
grasp their implications.
------------------------------
Date: Thu, 19 Aug 2004 20:09:30 -0600
From: Bill <wherrera@lynxview.com>
Subject: Re: How Should I Check for Directory existance in a server
Message-Id: <-c2dneK8c978wLjcRVn-tQ@adelphia.com>
sunilkumar_1480@yahoo.com wrote:
> I have to create a directory in a FTP server but before I create i
> should check for the existance of the directory. If the directory does
> exist then I should not create the directory. The following is the
> code which I have written and I am unsuccessful with reading a
> directory in a server
>
> my $dir_name = $ARGV[0];
> my $basepath = "c:\\Inetpub\\wwwroot\\$dir_name\\test";
> my $count = 0;
> my $server="casr.com";
> my $user="slb";
> my $password="bigfiles";
> my $dir="iDistrict/incoming/baselines/TestReports/";
> my $success="true";
> my $filetran="true";
> my $reason;
> my $test="true";
> my @file_list;
> my $ret;
> my $ftp=Net::FTP->new($server) or $success="false";
> $ftp->login($user, $password) or $success="false";
> $ftp->pasv() or $success="false";
> $ftp->binary() or $success="false";
> $ftp->cwd($dir) or $success='false';
> print $ftp->cwd($dir);
> # I am unable to open the directory that exists in the server which I
> have
> # mentioned with $dir name.
> opendir(SRC, $dir);
> my @dir_files = readdir(SRC);
> foreach my $file (@dir_files)
> {
> if($file eq $dir_name)
> {
> $ret = 0;
> closedir(SRC);
> last;
> }
> }
>
> if($ret ne 0)
> {
> $ftp->mkdir($folder_name) or $success='false';
> }
> $ftp->cwd($dir."/".$folder_name) or $success='false';
>
>
> Can anybody help me how to read the contents of a directory in the
> server.
I think you perhaps are confusing local directories woth the Net::FTP
directories. Read the docs on Net::FTP, and try
my @fnames = $ftp->ls($dir) or (maybe) my @fnames = $ftp->ls;
------------------------------
Date: Fri, 20 Aug 2004 10:37:55 +1200
From: "Tintin" <me@privacy.net>
Subject: Re: how to run dos command in perl
Message-Id: <2okodpFbl8f1U1@uni-berlin.de>
"jenson" <sms1@pctc.com> wrote in message
news:L48Vc.1478$KF.11582@tor-nn1.netcom.ca...
> I want to return the output and a dos command to a scalar variable and
> display it.
>
> The following code did not work. I think I made a mistake in using the `
> sign. Please advise what needs to be changed to make the following code
work
> in window xp.
>
> Any help is much appreciated.
>
> open (DATE, `echo %date%`);
> $theDate = <DATE>;
> close(DATE);
> print "This is $theDate \n";
print "This is " . localtime() . "\n";
------------------------------
Date: Thu, 19 Aug 2004 19:32:24 -0500
From: l v <lv@aol.com>
Subject: Re: how to run dos command in perl
Message-Id: <41254693$1_8@corp.newsgroups.com>
jenson wrote:
> I want to return the output and a dos command to a scalar variable and
> display it.
>
> The following code did not work. I think I made a mistake in using the `
> sign. Please advise what needs to be changed to make the following code work
> in window xp.
>
> Any help is much appreciated.
>
> open (DATE, `echo %date%`);
> $theDate = <DATE>;
> close(DATE);
> print "This is $theDate \n";
>
>
instead try single quotes vs backtics and add a pipe at the end.
open (DATE, 'echo %date% |');
Len
-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----
------------------------------
Date: Thu, 19 Aug 2004 18:48:49 -0500
From: Tad McClellan <tadmc@augustmail.com>
Subject: Re: How to upload a file from a local pc to a web server from a html page????
Message-Id: <slrnciaf31.iti.tadmc@magna.augustmail.com>
srini <schimata2@yahoo.com> wrote:
> OK.. Iam tired of two two things:
> 2. to hear the useless and sarcastic answers from some people.
So long.
--
Tad McClellan SGML consulting
tadmc@augustmail.com Perl programming
Fort Worth, Texas
------------------------------
Date: 19 Aug 2004 19:57:56 -0700
From: schimata2@yahoo.com (srini)
Subject: Re: How to upload a file from a local pc to a web server from a html page????
Message-Id: <5fc50f33.0408191857.30056e40@posting.google.com>
"Alan J. Flavell" <flavell@ph.gla.ac.uk> wrote in message news:<Pine.LNX.4.61.0408192253040.4886@ppepc56.ph.gla.ac.uk>...
> On Thu, 19 Aug 2004, srini blurted out atop a fullquote:
>
> > OK.. Iam tired of two two things:
> > 1. to look around in this group for a way to upload a file to the web
> > server
> > 2. to hear the useless and sarcastic answers from some people.
>
> Your request for fast-track entry to the killfile has been
> enthusiastically approved by the cabal. (TINC).
>
> > Can some gentlemen pl. tell me
>
> There's no need to be sexist either.
>
> > HTML part:
> > ---------------
> > <tr><td colspan="2"> <FONT color=black>Attachment (if any):</FONT><BR>
>
> WTF do you suppose that piece of excrement has got to do with any
> Perl-related problem?
>
> The key to successful problem solving is to divide the problem up into
> manageable pieces, recognise what is relevant to each, and get each to
> work separately before assembling the resulting working components
> into a working whole. That's what I'd recommend to you, and - based
> on what you chose to post - you're nowhere near there yet.
>
> > <INPUT type="file" size=50 name="attachedfile"
>
> Where's your <form> element and its attributes? Haven't you realised
> yet that they are far more important than your <font> and <br> crap?
>
> > ALLOW="text/*">
>
> Eh? As the saying goes, "you can't just make shit up and expect it to
> work".
>
> Why don't you toddle off to Lincoln Stein's worked examples, which
> include file uploading, and take it from there?
>
> bye now
Thanks Allen for your time..
I just gave a snippet of HTML code from where the type ="file" to make
sure that I am taking the file upload variable from the html form and
to differentiate from the CGI funciton filefield(), which throws
another browse component and I don' the latter.
Coming ot the point, can you find some bug and tell me how to rectify
it in the perl script or not? Otherwise, why do you waste your energy?
Thanks,
Srini
------------------------------
Date: 20 Aug 2004 03:09:39 GMT
From: John Bokma <postmaster@castleamber.com>
Subject: Re: How to upload a file from a local pc to a web server from a html page????
Message-Id: <Xns954AE16E135F8castleamber@130.133.1.4>
schimata2@yahoo.com (srini) wrote in
news:5fc50f33.0408191857.30056e40@posting.google.com:
> Coming ot the point, can you find some bug and tell me how to rectify
> it in the perl script or not? Otherwise, why do you waste your energy?
To stop you and others from wasting more time of others :-D. Usenet is not
a free helpdesk.
--
John MexIT: http://johnbokma.com/mexit/
personal page: http://johnbokma.com/
Experienced programmer available: http://castleamber.com/
Happy Customers: http://castleamber.com/testimonials.html
------------------------------
Date: Thu, 19 Aug 2004 23:03:56 +0100
From: "Alan J. Flavell" <flavell@ph.gla.ac.uk>
Subject: Re: How to upload a file from a local pc to a web server from a html page????
Message-Id: <Pine.LNX.4.61.0408192253040.4886@ppepc56.ph.gla.ac.uk>
On Thu, 19 Aug 2004, srini blurted out atop a fullquote:
> OK.. Iam tired of two two things:
> 1. to look around in this group for a way to upload a file to the web
> server
> 2. to hear the useless and sarcastic answers from some people.
Your request for fast-track entry to the killfile has been
enthusiastically approved by the cabal. (TINC).
> Can some gentlemen pl. tell me
There's no need to be sexist either.
> HTML part:
> ---------------
> <tr><td colspan="2"> <FONT color=black>Attachment (if any):</FONT><BR>
WTF do you suppose that piece of excrement has got to do with any
Perl-related problem?
The key to successful problem solving is to divide the problem up into
manageable pieces, recognise what is relevant to each, and get each to
work separately before assembling the resulting working components
into a working whole. That's what I'd recommend to you, and - based
on what you chose to post - you're nowhere near there yet.
> <INPUT type="file" size=50 name="attachedfile"
Where's your <form> element and its attributes? Haven't you realised
yet that they are far more important than your <font> and <br> crap?
> ALLOW="text/*">
Eh? As the saying goes, "you can't just make shit up and expect it to
work".
Why don't you toddle off to Lincoln Stein's worked examples, which
include file uploading, and take it from there?
bye now
------------------------------
Date: Thu, 19 Aug 2004 16:16:20 -0700
From: Kris Munroe <krism@ccvcorp.com>
Subject: Image::Magick problem after (failed?) install
Message-Id: <10iad89219dgma5@corp.supernews.com>
Does any one have any idea what is wrong here? When ever I try to run
any of my scripts that use Image::Magick I get the following error.
/usr/bin/perl: error while loading shared libraries:
/usr/lib/perl5/site_perl/5.
8.3/i386-linux-thread-multi/auto/Image/Magick/Magick.so: undefined
symbol: AcquireMagickMemory
I don't think that it is installed correctly (obviosly). Here is the
error I get when I try to test this with cpan.
rm -f blib/arch/auto/Image/Magick/Magick.so
gcc -L/usr/local/lib -shared -L/usr/local/lib Magick.o -o
blib/arch/auto/Image
/Magick/Magick.so -L/usr/local/lib -lMagick -L/usr/X11R6/lib
-lfreetype -lz -L
/usr/lib -ltiff -lfreetype -ljpeg -lpng -ldpstk -ldps -lXext -lXt -lSM
-lICE -lX
11 -lbz2 -lxml2 -lz -lpthread -lm -lpthread
/usr/bin/ld: cannot find -lfreetype
collect2: ld returned 1 exit status
make: *** [blib/arch/auto/Image/Magick/Magick.so] Error 1
/usr/bin/make -- NOT OK
Running make test
Can't test without successful make
If I try to install will cpan it says everything is ok. If I try the
test is says that it cannot continue.
BTW I have tried to install this from binary too.
I am running on Fedora Core 2 Kernel 2.6.7-1.494.2.2
Perl v5.8.3 built for i386-linux-thread-multi
Thanks,
Kris
------------------------------
Date: Fri, 20 Aug 2004 11:08:34 +1000
From: Matthew Braid <mb@uq.net.au.invalid>
Subject: no re 'eval' not secure enough
Message-Id: <cg3iui$jos$1@bunyip.cc.uq.edu.au>
Hi all,
Not really a question, more of a pointer....
Now that RE's can contain executable code (via the experimental (?{...}) and a
few others) it is no longer safe to accept an RE as an argument (either to a
program or to a subroutine), since it could, for instance, have:
(?{system("rm -rf /")})
buried in it.
"no re 'eval'" is supposed to stop this, as it disallows use of these constructs
in an RE using variable interpolation at run-time, ie this:
no re 'eval';
chomp(my $chk = <STDIN>);
chomp(my $re = <STDIN>);
print "OK!\n" if eval { $chk =~ $re };
will result in (if the STDIN is "123\n(?{print "UHOH!\n"})123\n"):
Eval-group not allowed at runtime, use re 'eval' in regex m/(?{print
"UHOH!\n"})123/ at test.pl line 4, <STDIN> line 2.
This is good, as long as the data stays raw like that.
Unfortunately, no re 'eval' allows a backdoor - if the re variable was created
with qr//, all is deemed good.
In a contrived example:
no re 'eval';
chomp(my $chk = <STDIN>);
chomp(my $re = <STDIN>);
{
use re 'eval';
$re = qr/$re/;
}
test($chk, $re);
sub test {
my ($chk, $re) = @_;
no re 'eval';
print "OK!\n" if $chk =~ $re;
}
results in (with the same input as before):
UHOH!
OK!
Now while this can't happen in raw data from outside the program (because it
can't be qr'd by the external person), it does mean any subroutine that accepts
an RE as an argument can't rely on no re 'eval' as the supplied RE might have
been created using qr// in a block that had had use re 'eval' turned on.
The only way around this I have found is to use stringy eval and a dummy
variable. To use the test program again:
no re 'eval';
chomp(my $chk = <STDIN>);
chomp(my $re = <STDIN>);
{
use re 'eval';
$re = qr/$re/;
}
test($chk, $re);
sub test {
my ($chk, $re) = @_;
no re 'eval';
my $null = ''; # DUMMY VARIABLE
print "OK!\n" if eval "\$chk =~ /\${null}$re/";
print "ERROR IS $@\n";
}
With the same input as before this results in:
ERROR IS Eval-group not allowed at runtime, use re 'eval' in regex
m/(?-xism:(?{print "UHOH!\n"})123)/ at (eval 2) line 1, <STDIN> line 2.
This is because of the $null variable - it hasn't been made by qr//, so it
triggers the no re 'eval' for you (its in the ${null} form because $re, which is
interpolated, may start with an alphanumeric and cause an unrelated error). no
re 'eval' was also included in the test sub so someone can't just use re 'eval'
before the sub is called.
It has to be a stringy eval because the no re 'eval' check is done at compile
time rather than run time (despite what the error message says....).
Its a very ugly kludge, but as I said its the only thing I've ever got to work
in a secure fashion. It would be fantastic if there was a pragma like no re
'eval_strict' or something that would stop embedded code entirely - I have
never, ever seen a need for it in everyday use.
MB
------------------------------
Date: Thu, 19 Aug 2004 17:56:56 -0500
From: Fred <noemail@#$&&!.net>
Subject: Re: trim code for mimic ls -tr
Message-Id: <pan.2004.08.19.22.56.55.780328@#$&&!.net>
>
> Why reinvent the wheel? Why not simply read the output of ls -t?
>
> Greg
I *wish* windows had a set of command tools like UNIX. I'm stuck with
windows. I'm not one of those "Windows Sucks!" kind of people, but after 6
years with the Bourne shell on Unix , using windows 2003 server is rather
trying. perl, however, has made it much nicer. Don't know why I never
learned it before. Very very nice.
------------------------------
Date: Thu, 19 Aug 2004 18:35:13 -0500
From: Fred <noemail@#$&&!.net>
Subject: Re: trim code for mimic ls -tr
Message-Id: <pan.2004.08.19.23.35.08.886103@#$&&!.net>
On Thu, 19 Aug 2004 08:30:53 +0000, Anno Siegel wrote:
> Fred <noemail@#$&&!.net> wrote in comp.lang.perl.misc:
>> I was wanting to de-bloat this code. The objective was to mimic the ls
>> âtr UNIX command and store those files, sorted by time, into a
>> list. I found bits and pieces of code here, and added my own, and the
>> result given below does work, but Iâm afraid itâs very
>> inefficient.
>
> It looks to me that all you want is the youngest file (of a certain
> type) in a directory. That can be done in a linear pass over the files
> without sorting.
>
>> #!/usr/local/bin/perl -w
>> use strict;
>> use warnings;
>> my($dir) = $ARGV[0] ? $ARGV[0] : '.'; opendir(DIR, $dir) or die("Cannot
>> open directory '$dir': $!");
>
> From this point, continue like this:
>
> my ( $youngest, @files) = grep /LOG/, grep !/^\.\.?$/, readdir( DIR)
> or
> die "No LOG files in $dir";
> -M $youngest < -M $_ or $youngest = $_ for @files; print "The
> youngest LOG file in $dir is: $youngest\n";
>
> Anno
I was hoping it could be done in linear fashion, nested foreach loops are nasty, I
know. My issue with your generous response to my post is this line:
-M $youngest < -M $_ or $youngest = $_ for @files;
gives me an error of (don't quote me we don't have nntp at work,
I am working out of poor
memory. ie; non ecc human memory) 'uninitialized variable' on that line.
However ignoring that allow me to implore you to expound on that line of
code. The entire line had me baffled to some degree.
I have never seen such code. To duplicate the error I mention, use a
windows box with $dir set to the windows temp directory.
At any rate many thanks.
Fred
------------------------------
Date: Thu, 19 Aug 2004 19:04:14 -0700
From: Michael Slass <miknrene@drizzle.com>
Subject: Re: trim code for mimic ls -tr
Message-Id: <m38ycamuox.fsf@eric.rossnet.com>
Fred <noemail@#$&&!.net> writes:
>>
>> Why reinvent the wheel? Why not simply read the output of ls -t?
>>
>> Greg
>
>I *wish* windows had a set of command tools like UNIX. I'm stuck with
>windows. I'm not one of those "Windows Sucks!" kind of people, but after 6
>years with the Bourne shell on Unix , using windows 2003 server is rather
>trying.
The Cygwin project has ported most of GNU to Windows (well, more
accurately, they've written a shim library that maps the UNIX
system calls onto Windows), and the recent versions work quite
nicely. I use the Cygwin Bash shell all day long on Windows XP, and
I can't imagine working without it.
You can find out all about it and get the free downloads here:
http://cygwin.com
--
Mike Slass
------------------------------
Date: 6 Apr 2001 21:33:47 GMT (Last modified)
From: Perl-Users-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 6 Apr 01)
Message-Id: <null>
Administrivia:
#The Perl-Users Digest is a retransmission of the USENET newsgroup
#comp.lang.perl.misc. For subscription or unsubscription requests, send
#the single line:
#
# subscribe perl-users
#or:
# unsubscribe perl-users
#
#to almanac@ruby.oce.orst.edu.
NOTE: due to the current flood of worm email banging on ruby, the smtp
server on ruby has been shut off until further notice.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
#To request back copies (available for a week or so), send your request
#to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
#where x is the volume number and y is the issue number.
#For other requests pertaining to the digest, send mail to
#perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
#sending perl questions to the -request address, I don't have time to
#answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V10 Issue 6886
***************************************
