[25838] in Perl-Users-Digest
Perl-Users Digest, Issue: 8074 Volume: 10
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Thu May 12 14:05:20 2005
Date: Thu, 12 May 2005 11:05:05 -0700 (PDT)
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Perl-Users Digest Thu, 12 May 2005 Volume: 10 Number: 8074
Today's topics:
Re: almost correct <hackeras@gmail.com>
Alternatives to Safe.pm (not full of security holes)? <ignoramus18353@NOSPAM.18353.invalid>
Re: Alternatives to Safe.pm (not full of security holes <apeiron+usenet@coitusmentis.info>
Re: Alternatives to Safe.pm (not full of security holes <ignoramus18353@NOSPAM.18353.invalid>
Re: Alternatives to Safe.pm (not full of security holes <1usa@llenroc.ude.invalid>
Re: Alternatives to Safe.pm (not full of security holes <ignoramus18353@NOSPAM.18353.invalid>
Re: deamons and IPC <jgibson@mail.arc.nasa.gov>
Re: deamons and IPC <glex_nospam@qwest.invalid>
Re: Extracting strings delimited by other strings <usenet739_yahoo_com_au>
Re: sub in a package with parameters <kevin@vaildc.net>
Re: XS: SvUPGRADE and test for lvalue (Anno Siegel)
Re: XS: SvUPGRADE and test for lvalue <tassilo.von.parseval@rwth-aachen.de>
Digest Administrivia (Last modified: 6 Apr 01) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: Thu, 12 May 2005 18:42:20 +0300
From: Nikos <hackeras@gmail.com>
Subject: Re: almost correct
Message-Id: <d5vtgo$840$1@nic.grnet.gr>
In the top of my games.pl script i have
my $gamename = param('gamename');
and
print start_form(-action=>'games.pl');
print table( {class=>'games'} );
while( $row = $sth->fetchrow_hashref )
{
print Tr(
td( {-width=>'20%'}, submit( $row->{gamename} )),
td( {-width=>'75%'}, $row->{gamedesc} ),
td( {-width=>'5%'}, $row->{gamecounter} )
);
}
print end_table;
print end_form;
This is where the submit button is created and this is where i check if
the user click on a game
if( param('gamename') )
but it never returns true! Do you think there is a confilct with the
gamesnname as i have it in the submit button and expect the user to
click on the desired game to download by passign it as a parameter to
the script?
------------------------------
Date: 12 May 2005 16:05:42 GMT
From: Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid>
Subject: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <d5vusm$f1f$0@pita.alt.net>
I own website algebra.com, and am right now working on a feature where
my users can submit their own algebra solvers.
These solvers can either be written in a simple markup language (not
interesting), or in perl.
I first chose Safe.pm to run user submitted code in a safe
compartment. Now I realize that Safe.pm is so full of holes that it
is not funny.
Is there some other alternative to safe.pm that would let me run perl
code in a compartment?
i
------------------------------
Date: 12 May 2005 16:36:32 GMT
From: Christopher Nehren <apeiron+usenet@coitusmentis.info>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <slrnd871h9.17r.apeiron+usenet@prophecy.dyndns.org>
On 2005-05-12, Ignoramus18353 scribbled these
curious markings:
> I first chose Safe.pm to run user submitted code in a safe
> compartment. Now I realize that Safe.pm is so full of holes that it
> is not funny.
How about, instead of just whining about a situation that (considering
the popularity of Safe) is extremely serious and doing *absolutely
nothing* about it, you submit bug reports of these holes to the author
so that they can be fixed so that you *can* use it?
Best Regards,
Christopher Nehren
--
I abhor a system designed for the "user", if that word is a coded
pejorative meaning "stupid and unsophisticated". -- Ken Thompson
If you ask the wrong questions, you get answers like "42" and "God".
Unix is user friendly. However, it isn't idiot friendly.
------------------------------
Date: 12 May 2005 16:55:05 GMT
From: Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <d601p9$kf7$0@pita.alt.net>
On 12 May 2005 16:36:32 GMT, Christopher Nehren <apeiron+usenet@coitusmentis.info> wrote:
> On 2005-05-12, Ignoramus18353 scribbled these
> curious markings:
>> I first chose Safe.pm to run user submitted code in a safe
>> compartment. Now I realize that Safe.pm is so full of holes that it
>> is not funny.
>
> How about, instead of just whining about a situation that (considering
> the popularity of Safe) is extremely serious and doing *absolutely
> nothing* about it, you submit bug reports of these holes to the author
> so that they can be fixed so that you *can* use it?
I did not discover these bugs, I read about them from various bug list
archives. So they are all already known. Safe.pm is no longer
supported by its author due to all the holes. My understanding is that
it basically cannot be made to work right.
I am interested in real solutions. I am not a perl security expert and
I cannot expect to know all potential holes in safe.pm.
i
------------------------------
Date: Thu, 12 May 2005 16:59:54 GMT
From: "A. Sinan Unur" <1usa@llenroc.ude.invalid>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <Xns965484175B3A7asu1cornelledu@127.0.0.1>
Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid> wrote in news:d5vusm
$f1f$0@pita.alt.net:
> I own website algebra.com, and am right now working on a feature where
> my users can submit their own algebra solvers.
>
> These solvers can either be written in a simple markup language (not
> interesting), or in perl.
>
> I first chose Safe.pm to run user submitted code in a safe
> compartment. Now I realize that Safe.pm is so full of holes that it
> is not funny.
>
> Is there some other alternative to safe.pm that would let me run perl
> code in a compartment?
Why do you have X-No-Archive set?
Sinan
--
A. Sinan Unur <1usa@llenroc.ude.invalid>
(reverse each component and remove .invalid for email address)
comp.lang.perl.misc guidelines on the WWW:
http://mail.augustmail.com/~tadmc/clpmisc/clpmisc_guidelines.html
------------------------------
Date: 12 May 2005 17:03:21 GMT
From: Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <d6028p$ltm$0@pita.alt.net>
On Thu, 12 May 2005 16:59:54 GMT, A. Sinan Unur <1usa@llenroc.ude.invalid> wrote:
> Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid> wrote in news:d5vusm
> $f1f$0@pita.alt.net:
>
>> I own website algebra.com, and am right now working on a feature where
>> my users can submit their own algebra solvers.
>>
>> These solvers can either be written in a simple markup language (not
>> interesting), or in perl.
>>
>> I first chose Safe.pm to run user submitted code in a safe
>> compartment. Now I realize that Safe.pm is so full of holes that it
>> is not funny.
>>
>> Is there some other alternative to safe.pm that would let me run perl
>> code in a compartment?
>
> Why do you have X-No-Archive set?
Because I prefer my posts to be not archived.
Do you know is there some other alternative to safe.pm that would let
me run perl code in a compartment? Thanks.
i
------------------------------
Date: Thu, 12 May 2005 08:53:32 -0700
From: Jim Gibson <jgibson@mail.arc.nasa.gov>
Subject: Re: deamons and IPC
Message-Id: <120520050853328285%jgibson@mail.arc.nasa.gov>
In article <d5v5vs$3c5v0$1@claire.desy.de>, Moritz Karbach
<moritz.karbach@desy.de> wrote:
> Hi!
>
> I'm very new to inter process communication, maybe you have some suggestions
> or comments:
>
> I'm trying to write a deamon which basically launches some programs
> periodically, and I want to steer the deamon somehow. Eg like
>
> ./deamon.pl start
> ./deamon.pl stop
> ./deamon.pl something_interesting
>
> How can I send such messages to my deamon? I came to the conclusion, that
> sockets may be what I need. Maybe some of you have some very easy server
> and client scripts, using tcp and localhost?
Checkout "perldoc perlipc" in the documentation that comes with your
Perl installation.
----== Posted via Newsfeeds.Com - Unlimited-Uncensored-Secure Usenet News==----
http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
----= East and West-Coast Server Farms - Total Privacy via Encryption =----
------------------------------
Date: Thu, 12 May 2005 10:58:02 -0500
From: "J. Gleixner" <glex_nospam@qwest.invalid>
Subject: Re: deamons and IPC
Message-Id: <f2Lge.360$Te5.1577@news.uswest.net>
Moritz Karbach wrote:
> Hi!
>
> I'm very new to inter process communication, maybe you have some suggestions
> or comments:
>
> I'm trying to write a deamon which basically launches some programs
> periodically, and I want to steer the deamon somehow. Eg like
>
> ./deamon.pl start
> ./deamon.pl stop
> ./deamon.pl something_interesting
>
> How can I send such messages to my deamon? I came to the conclusion, that
> sockets may be what I need. Maybe some of you have some very easy server
> and client scripts, using tcp and localhost?
You'd think stuff like that would be available all over the place, yeah? :-)
Take a look at the documentation that comes with perl:
perldoc perlipc
Search CPAN for "Socket", which will give you a lot of possibly helpful
modules.
You may also find a lot of code or examples by using a search engine and
simply query on what you've already determined you need "perl daemon
socket".
Maybe this will help: http://www.stonehenge.com/merlyn/UnixReview/col47.html
Use the Internet, Luke... :-D
------------------------------
Date: Fri, 13 May 2005 02:12:05 +1000
From: "Scott Bass" <usenet739_yahoo_com_au>
Subject: Re: Extracting strings delimited by other strings
Message-Id: <42838055$0$16492$5a62ac22@per-qv1-newsreader-01.iinet.net.au>
"Tad McClellan" <tadmc@augustmail.com> wrote in message
news:slrnd7o9pu.i4j.tadmc@magna.augustmail.com...
> Scott Bass <> wrote:
<snip...>
>> Are there any modules that I could use as a starting point for this?
I didn't know if maybe one of the XML modules could be coaxed to parse this.
But, yes, I need to do my homework on CPAN...
> I dunno.
>
> Hardly seems worth modularization when it only takes about
> 20 lines of regular ol' Perl.
>
> Assuming the whole file is slurped into $_ :
>
> ------------------------------
> while ( m#<testcase>(.*?)</testcase>#gs ) {
> my $record = normalize($1);
> my(undef,@parts) = split /(?:TESTID|OBJECTIVE|PROCEDURE|RESULTS):\s+/,
> $record;
> chomp @parts;
> print join( ',', @parts), "\n";
> }
>
> sub normalize {
> my($r) = @_;
>
> $r =~ s#^\s*\*/##; # snip bits of comment delimiters
> $r =~ s#/\*\s*##;
>
> $r =~ s#^title\d+ ##gm; # remove title statement cruft
> $r =~ s#^(['"])(.*?)\1;#$2#gm;
>
> $r =~ s#\n\s\s+#\n#; # join continuation lines
>
> $r =~ s#^\s*##; # trim spaces
> $r =~ s#\s*$##;
> return $r;
> }
> ------------------------------
>
>
> --
> Tad McClellan SGML consulting
> tadmc@augustmail.com Perl programming
> Fort Worth, Texas
Tad, thanks a lot for the above code. Much and sincerely appreciated. I
was actually just wanting architectural ideas (which I now realize I didn't
make clear), so the above code was above and beyond...
And thank you too Sinan. Your chastisement is noted - I've read Tad's
posting guidelines, and will attempt to comply in the future. Thanks for
pointing me to CPAN and perldoc. Since I'm coding on Win32 and ActiveState
Perl, I'm just using the online (HTML) doc, which looks to be synonymous
with perldoc. As well as Googling and O'Reilly _Programming Perl_ and _Perl
Cookbook_ books.
Lastly, I have made good progress on my script. However, once finished, it
would be nice if someone could give pointers on tightening it up. I'm
tempted to post the entire script (about 100 lines) so it's all in context,
and identify key areas where I have questions. However, I do want to be a
good net citizen, and don't want to piss off the other readers of the list
by not asking specific questions.
I welcome any posting guidelines you may have for this situation.
Kind Regards,
Scott
------------------------------
Date: Thu, 12 May 2005 17:02:00 GMT
From: Kevin Michael Vail <kevin@vaildc.net>
Subject: Re: sub in a package with parameters
Message-Id: <kevin-ED16FD.13020112052005@news.verizon.net>
In article <42833229$0$30372$da0feed9@news.zen.co.uk>,
Dave Weaver <zen13097@zen.co.uk> wrote:
> If ReadParameter is a class method, rather than an instance method
> (i.e. it needs no direct reference to any object of the RWToDatasotre
> package, as it appears in your case), then you can define it like this:
>
> sub ReadParameter {
> my( $file, $categorie, $parameter) = @_;
> ...
>
> and call it like this:
>
> RWToDatasotre::ReadParameter( $MainApplicationfile,
> $testcategorie, $testparameter );
>
> ^^
Well, except that if RWToDatasotre (is that supposed to be "Datastore"
by any chance??) inherits ReadParameter from a superclass, you've just
messed things up. (I agree that this would be the simpler way if
ReadParameter is truly intended to be a subroutine, but then I'd make it
exportable on request.)
--
Bright eyes/burning like fire, | Kevin Michael Vail
Bright eyes/how can you close and fail? | kevin@vaildc.net
How can the light that shone so brightly | . . . . . . . . . .
Suddenly shine so pale?/Bright eyes | . . . . . . . . .
------------------------------
Date: 12 May 2005 15:19:58 GMT
From: anno4000@lublin.zrz.tu-berlin.de (Anno Siegel)
Subject: Re: XS: SvUPGRADE and test for lvalue
Message-Id: <d5vs6u$i3f$1@mamenchi.zrz.TU-Berlin.DE>
Tassilo v. Parseval <tassilo.von.parseval@rwth-aachen.de> wrote in comp.lang.perl.misc:
> Also sprach Wolfram Humann:
>
> > This XS code can be found in many CPAN modules (e.g. Zlib.xs):
> >
> > if (!SvUPGRADE(buf, SVt_PV))
> > croak("cannot use buf argument as lvalue");
> >
> > It is used before sending "SV * buf" to a C function that will fill buf
> > with some string. I wanted to use the same in my code but just could not
> > get it to "carp" even if I passed numeric or string constants to buf.
>
> The piece of code you quoted is nonsense in two ways. First of all,
> SvUPGRADE (although being a macro) is documented to have a return type
> of 'void', according to perlapi.pod.
>
> Secondly, SvUPGRADE() has nothing to do with the readonlyness of a
> variable. It merely turns one SV into a more complex SV, not touching
> the readonly-flag.
>
> > When I say
> >
> > if (SvREADONLY(buf))
> > croak("cannot use buf argument as lvalue");
> >
> > instead (and "SvUPGRADE" separately), the test works as expected. I
> > looked at sv_upgrade in sv.c and found two "return TRUE;" statements but
> > no way for the function to return FALSE.
[oliva:ports/perl/perl-5.8.6] anno% grep SvUPGRADE *.c | grep 'if '
toke.c: if (!SvUPGRADE(datasv, SVt_PVIO))
Squashed in bleadperl, AFAIK. :)
Anno
------------------------------
Date: Thu, 12 May 2005 18:54:50 +0200
From: "Tassilo v. Parseval" <tassilo.von.parseval@rwth-aachen.de>
Subject: Re: XS: SvUPGRADE and test for lvalue
Message-Id: <slrnd872iq.296.tassilo.von.parseval@localhost.localdomain>
Also sprach Anno Siegel:
> Tassilo v. Parseval <tassilo.von.parseval@rwth-aachen.de> wrote in comp.lang.perl.misc:
>> Also sprach Wolfram Humann:
>>
>> > This XS code can be found in many CPAN modules (e.g. Zlib.xs):
>> >
>> > if (!SvUPGRADE(buf, SVt_PV))
>> > croak("cannot use buf argument as lvalue");
>> >
>> > It is used before sending "SV * buf" to a C function that will fill buf
>> > with some string. I wanted to use the same in my code but just could not
>> > get it to "carp" even if I passed numeric or string constants to buf.
>>
>> The piece of code you quoted is nonsense in two ways. First of all,
>> SvUPGRADE (although being a macro) is documented to have a return type
>> of 'void', according to perlapi.pod.
>>
>> Secondly, SvUPGRADE() has nothing to do with the readonlyness of a
>> variable. It merely turns one SV into a more complex SV, not touching
>> the readonly-flag.
> [oliva:ports/perl/perl-5.8.6] anno% grep SvUPGRADE *.c | grep 'if '
> toke.c: if (!SvUPGRADE(datasv, SVt_PVIO))
You know, the spot with the highest density of cargo-cult Perl and
non-Perl is actually the perl source code itself. :-)
> Squashed in bleadperl, AFAIK. :)
Oh, indeed. I also did a grep similar to yours before my post (on a
bleadperl synced maybed two weeks ago) and your hit was still in. Now I
re-synced and this little rotter has vanished. :)
Tassilo
--
use bigint;
$n=71423350343770280161397026330337371139054411854220053437565440;
$m=-8,;;$_=$n&(0xff)<<$m,,$_>>=$m,,print+chr,,while(($m+=8)<=200);
------------------------------
Date: 6 Apr 2001 21:33:47 GMT (Last modified)
From: Perl-Users-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 6 Apr 01)
Message-Id: <null>
Administrivia:
#The Perl-Users Digest is a retransmission of the USENET newsgroup
#comp.lang.perl.misc. For subscription or unsubscription requests, send
#the single line:
#
# subscribe perl-users
#or:
# unsubscribe perl-users
#
#to almanac@ruby.oce.orst.edu.
NOTE: due to the current flood of worm email banging on ruby, the smtp
server on ruby has been shut off until further notice.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
#To request back copies (available for a week or so), send your request
#to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
#where x is the volume number and y is the issue number.
#For other requests pertaining to the digest, send mail to
#perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
#sending perl questions to the -request address, I don't have time to
#answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V10 Issue 8074
***************************************
