[27469] in Perl-Users-Digest
Perl-Users Digest, Issue: 9082 Volume: 10
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Fri Mar 24 03:05:44 2006
Date: Fri, 24 Mar 2006 00:05:04 -0800 (PST)
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Perl-Users Digest Fri, 24 Mar 2006 Volume: 10 Number: 9082
Today's topics:
Re: Debugging with Speech: Issues and Work-arounds? <nospam-abuse@ilyaz.org>
Re: More help requested on permutation code. <someone@example.com>
Re: More help requested on permutation code. <someone@example.com>
Re: Parallel LWP callback doesn't terminate. <peter.hill@modulus.com.au>
Re: Security implications of taking a stylesheet URL fr <noreply@gunnar.cc>
Security implications of taking a stylesheet URL from a <gifford@umich.edu>
Would like to make a system call without displaying msg (desert.fox11@yahoo.com)
Re: Would like to make a system call without displaying (Anno Siegel)
Re: Would like to make a system call without displaying <someone@example.com>
Digest Administrivia (Last modified: 6 Apr 01) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: Fri, 24 Mar 2006 07:38:21 +0000 (UTC)
From: Ilya Zakharevich <nospam-abuse@ilyaz.org>
Subject: Re: Debugging with Speech: Issues and Work-arounds?
Message-Id: <e007ld$2pvl$1@agate.berkeley.edu>
[A complimentary Cc of this posting was sent to
Veli-Pekka Tätilä
<vtatila@mail.student.oulu.fi>], who wrote in article <dvvepe$4v6$1@news.oulu.fi>:
> main::(taskman.plx:4): focusToRunning();
> DB<1>
...
> So the above prompt would be read in its entirety with the package, script
> and line number pre-pended before the code , which I usually consider the
> most important. While the file and package info is great initially, it is
> mostly redundant after the first reading,
... unless it changes.
> reader that it should deal with the parts as separate words. The debugger
> prompt DB is slightly redundant, too
... unless you debug a program which shows its own prompt...
> However, the code must be cursored through in textual units like lines or
> words. Without the find command or good markers, you would also have to find
> the right line by listening to the beginning of the numbers until they match
> the one you are looking for.
Not clear: who is "without the find command or good markers"? What is
the problem with using DB's "/"?
> This is true of simple console readers or the
> kind of GUI readers in which the console is just another app. Even when you
> do find the line, you cannot easily skip the numbers in the beginning of
> lines or move the focus between the debugger output and the code listing,
> without some heavy marker trickery. Here I can see two underlying design
> considerations. Firstly, the screen reader sees only a single very small bit
> of the screen at a time which is commonly called the straw analogy (you can
> also think of it as a tiny viewport). The second is that unless you know
> hotkeys or the app in advance, most keyboard navigation is essentially
> sequential and text can only be navigated mechanically in simple
> units.
I do not understand what is your point here...
> Now that I've covered the issues
I do not think so. You got some "big picture" in, but it is too big.
I think a short summary of the problems as you see them would make
things much more grokable.
> The second option that occurred to me was to customize the debugger.
You will find that this should be very easy. I would hope that most
of the functionality you complain about is concentrated in about 3
lines of Perl - the debugger is not particularly smart...
[Unfortunately, at some moment in the past the debugger code got
peppered with wrong-or-trivial comments. Nowadays there is no way
to distinguish "old, cryptic, but trustworthy" from the "new
improved" one; the only solution I know is to disregard all the
comments, and read the code itself.]
Yours,
Ilya
------------------------------
Date: Fri, 24 Mar 2006 05:44:38 GMT
From: "John W. Krahn" <someone@example.com>
Subject: Re: More help requested on permutation code.
Message-Id: <aHLUf.1707$B_1.825@edtnps89>
Michael Press wrote:
> Thank you all for the help. Would you guys look at
> the rest of the code? First a disclaimer.
> The sort assumes numerical permutation elements.
> This is a limitation I can rectify.
>
> ________________CUT________________
> #! /usr/bin/perl
>
> use warnings;
> use strict;
>
> # Multiply permutation cycles, into a permutation map;
> # then turn the map into a cycle representation, and print.
> # Knuth ACP 1.3.3 Algorithm B.
>
> sub permutation_multiply
> {
> my $t;
> my $hold;
> my $prev;
>
> # Read in the cycles, and initialize the permutation array.
> my %permutation_map = map { /\w/ ? ( $_ => $_ ) : () } my @token_list = $_[0] =~ /\w+|[()]/g;
>
> # Multiply the cycles generating the permutation as a map.
> for (my $idx = $#token_list; $idx >= 0; --$idx)
> {
> my $it = $token_list[$idx];
In Perl that is usually written as:
for my $it ( reverse @token_list ) {
> if ($it eq ')' ) { $prev = $it }
> elsif ($it eq '(' ) { $permutation_map{$hold} = $prev }
> else
> {
> if ( $prev eq ')' ) { $hold = $it }
> $t = $prev, $prev = $permutation_map{$it}, $permutation_map{$it} = $t;
In Perl that is usually written as:
( $prev, $permutation_map{$it} ) = ( $permutation_map{$it}, $prev );
> }
> }
>
> # Generate the cycle representation from the permutation in %permutation_map
> my @cycles;
> for my $key (sort { $a <=> $b } keys %permutation_map)
> {
> my @element_list;
> next if $permutation_map{$key} =~ m/-$/ ;
It _may_ be better to use substr() there (YMMV):
next if substr( $permutation_map{$key}, -1 ) eq '-';
> do
> {
> push @element_list, $key;
> $t = $permutation_map{$key};
> $permutation_map{$key} .= '-';
> $key = $t;
> } while ($permutation_map{$key} !~ m/-$/ );
> push @cycles, [@element_list];
> }
> for my $key (keys %permutation_map) {$permutation_map{$key} =~ tr/-//d }
In Perl that is usually written as:
tr/-//d for values %permutation_map;
> # Print out the cycles:
> # Sort the cycles by length.
> # Put spaces between permutation elements.
> # Put in cycle delimiter parentheses.
> # Put spaces between permutation cycles.
> # Print.
> print join(' ', map { sprintf "(%s)", join ' ', @{$_}} sort {$#{$a} <=> $#{$b}} @cycles ), "\n";
Unless you have changed the value of the $" variable you could write that as:
print join( ' ', map "(@$_)", sort { @$a <=> @$b } @cycles ), "\n";
Or, to extend that to the next level: :-)
print "@{[ map "(@$_)", sort { @$a <=> @$b } @cycles ]}\n";
> }
>
> my $alpha = "(99)(0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22)";
> my $beta = "(99)(0)(3 6 12 1 2 4 8 16 9 18 13)(15 7 14 5 10 20 17 11 22 21 19)";
> my $gamma = "(99 0)(1 22)(2 11)(3 15)(4 17)(5 9)(6 19)(7 13)(8 20)(10 16)(12 21)(14 18)";
> my $delta = "(99)(0)(3)(15)(1 18 4 2 6)(5 21 20 10 7)(8 16 13 9 12)(11 19 22 14 17)";
> my $x;
>
> print "beta = alpha^5 gamma alpha^5 gamma alpha^14 gamma alpha^18 \n";
> $x = ($alpha x 5 . $gamma) x 2 . $alpha x 14 . $gamma . $alpha x 18;
> permutation_multiply $x;
> $x = $beta;
> permutation_multiply $x;
> print "\n";
>
> print "(alpha^13 gamma delta^2)^3 has shape 4^6\n";
> $x = (($alpha x 13) . $gamma . ($delta x 2)) x 3;
> permutation_multiply $x;
> print "\n";
>
> ________________END________________
John
--
use Perl;
program
fulfillment
------------------------------
Date: Fri, 24 Mar 2006 05:51:54 GMT
From: "John W. Krahn" <someone@example.com>
Subject: Re: More help requested on permutation code.
Message-Id: <_NLUf.1709$B_1.833@edtnps89>
John W. Krahn wrote:
> Michael Press wrote:
>>
>> print join(' ', map { sprintf "(%s)", join ' ', @{$_}} sort {$#{$a} <=> $#{$b}} @cycles ), "\n";
>
> Unless you have changed the value of the $" variable you could write that as:
>
> print join( ' ', map "(@$_)", sort { @$a <=> @$b } @cycles ), "\n";
>
> Or, to extend that to the next level: :-)
>
> print "@{[ map "(@$_)", sort { @$a <=> @$b } @cycles ]}\n";
Oops, correction: :-)
print "@{[ map qq[(@$_)], sort { @$a <=> @$b } @cycles ]}\n";
John
--
use Perl;
program
fulfillment
------------------------------
Date: Fri, 24 Mar 2006 02:53:44 GMT
From: "Peter Hill" <peter.hill@modulus.com.au>
Subject: Re: Parallel LWP callback doesn't terminate.
Message-Id: <YaJUf.15137$dy4.2566@news-server.bigpond.net.au>
<xhoster@gmail.com> wrote in message
news:<20060323110859.954$zU@newsreader.com>...
> "Peter Hill" <peter.hill@modulus.com.au> wrote:
[snip]
> > print "We never get here.\n";
> > return C_ENDCON;
> > }
> >
>
> As far as I can tell, the only error you are committing is in your
> expectations, not in your code. The only way "We never get here"
> should be printed is if you either get called with empty content (and why
> would that happen? If there is nothing to send to the callback, why
> call it?), or with an over-sized chunk. Otherwise, the
> "return length $content;" will be activated, by-passing the print.
>
> Xho
>
> --
> -------------------- http://NewsReader.Com/ --------------------
> Usenet Newsgroup Service $9.95/Month 30GB
Yes, thank you, that makes perfect sense. I was basing the callback function
on an article be Randal Shwartz ("Parallel Bad Links") but I can now see
that that doesn't work either; something must have changed since the article
was written. It appears that I need to do my analysis on each chunk as it is
returned rather than expecting to deal with a complete document.
Thanks,
Peter Hill.
------------------------------
Date: Fri, 24 Mar 2006 06:47:32 +0100
From: Gunnar Hjalmarsson <noreply@gunnar.cc>
Subject: Re: Security implications of taking a stylesheet URL from a CGI parameter
Message-Id: <48hffmFj5rueU1@individual.net>
Scott W Gifford wrote:
> We're considering allowing our users
> to host their own stylesheet, and just pass in its URL as a CGI
> parameter. Something like this:
>
> .../cgi-bin/script?stylesheet=http://example.com/style.css
>
> with corresponding code like this in the HTML page template:
>
> <link href="$STYLESHEET" rel="stylesheet" type="text/css" />
>
> Of course, we have no control over what gets passed in to the
> stylesheet parameter, so we have to be prepared for the possibility
> that a malicious person sets it to something nasty.
Better, maybe, to let your users upload their own stylesheets to your
server. Doing so would let you validate the stylesheet before it's used.
--
Gunnar Hjalmarsson
Email: http://www.gunnar.cc/cgi-bin/contact.pl
------------------------------
Date: Thu, 23 Mar 2006 22:44:03 -0500
From: Scott W Gifford <gifford@umich.edu>
Subject: Security implications of taking a stylesheet URL from a CGI parameter
Message-Id: <qszacbg7bi4.fsf@galaxian.gpcc.itd.umich.edu>
Hello,
We've got a Web-based application written in Perl that is designed to
integrate as a frame into many different Web sites. We currently have
several stylesheets available to allow the user to match the look and
feel to their existing Web site. We're considering allowing our users
to host their own stylesheet, and just pass in its URL as a CGI
parameter. Something like this:
.../cgi-bin/script?stylesheet=http://example.com/style.css
with corresponding code like this in the HTML page template:
<link href="$STYLESHEET" rel="stylesheet" type="text/css" />
Of course, we have no control over what gets passed in to the
stylesheet parameter, so we have to be prepared for the possibility
that a malicious person sets it to something nasty.
We will escape $stylesheet so it can only contain letters, numbers,
underscore, dash, slashes, colons, and dots (to avoid cross-site
scripting), ensure it starts with "http://" or "https://" and contains
no port specification after the host (to avoid tricking the client
into opening local files or connecting to arbitrary services), and
require the filename to end with ".css" (to make it more difficult to
cause a script to run). Something like this:
/^https?:\/\/[\w.-]+\/[\w\/:.-]+\.css$/
I only have a rough knowledge of the full power of cascading
stylesheets. Are there any other security concerns I should be
thinking about? In particular, is there any way to embed
client-executed code (like JavaScript) into a stylesheet, implement
some other kind of cross-site scripting attack, or otherwise cause the
stylesheet to do anything besides alter the display of the page?
Any other risks I may not have considered?
Thanks for any thoughts and advice!
----Scott.
------------------------------
Date: Fri, 24 Mar 2006 06:07:10 GMT
From: u55389404@spawnkill.ip-mobilphone.net (desert.fox11@yahoo.com)
Subject: Would like to make a system call without displaying msg to STD OUT
Message-Id: <l.1143180430.1149108886@dialup-4.249.141.219.Dial1.Washington2.Level3.net>
Hi,
I'll try to say this succinctly. I make a call using system "unzip -o",
"$filename" which calls a utility unzip that has 'status' messages
display to std out. This is fine, however, can I re-direct ( or at the
very least suppress ) these messages.
eg. " Inflating README.txt........"
Any suggestion is appreciated.
--
Sent by desert.fox11 from yahoo within field com
This is a spam protected message. Please answer with reference header.
Posted via http://www.usenet-replayer.com
------------------------------
Date: 24 Mar 2006 08:01:32 GMT
From: anno4000@lublin.zrz.tu-berlin.de (Anno Siegel)
Subject: Re: Would like to make a system call without displaying msg to STD OUT
Message-Id: <48hnasFj0eitU1@news.dfncis.de>
desert.fox11@yahoo.com <u55389404@spawnkill.ip-mobilphone.net> wrote in comp.lang.perl.misc:
> Hi,
> I'll try to say this succinctly. I make a call using system "unzip -o",
> "$filename" which calls a utility unzip that has 'status' messages
> display to std out. This is fine, however, can I re-direct ( or at the
> very least suppress ) these messages.
> eg. " Inflating README.txt........"
> Any suggestion is appreciated.
Look for -q in man zip.
Anno
--
If you want to post a followup via groups.google.com, don't use
the broken "Reply" link at the bottom of the article. Click on
"show options" at the top of the article, then click on the
"Reply" at the bottom of the article headers.
------------------------------
Date: Fri, 24 Mar 2006 06:52:55 GMT
From: "John W. Krahn" <someone@example.com>
Subject: Re: Would like to make a system call without displaying msg to STD OUT
Message-Id: <bHMUf.1720$B_1.1470@edtnps89>
desert.fox11@yahoo.com wrote:
> I'll try to say this succinctly. I make a call using system "unzip -o",
> "$filename" which calls a utility unzip that has 'status' messages
> display to std out. This is fine, however, can I re-direct ( or at the
> very least suppress ) these messages.
> eg. " Inflating README.txt........"
> Any suggestion is appreciated.
perldoc -q "How can I capture STDERR from an external command"
John
--
use Perl;
program
fulfillment
------------------------------
Date: 6 Apr 2001 21:33:47 GMT (Last modified)
From: Perl-Users-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 6 Apr 01)
Message-Id: <null>
Administrivia:
#The Perl-Users Digest is a retransmission of the USENET newsgroup
#comp.lang.perl.misc. For subscription or unsubscription requests, send
#the single line:
#
# subscribe perl-users
#or:
# unsubscribe perl-users
#
#to almanac@ruby.oce.orst.edu.
NOTE: due to the current flood of worm email banging on ruby, the smtp
server on ruby has been shut off until further notice.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
#To request back copies (available for a week or so), send your request
#to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
#where x is the volume number and y is the issue number.
#For other requests pertaining to the digest, send mail to
#perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
#sending perl questions to the -request address, I don't have time to
#answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V10 Issue 9082
***************************************
