[8248] in Perl-Users-Digest
Perl-Users Digest, Issue: 1865 Volume: 8
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Wed Feb 11 19:16:16 1998
Date: Wed, 11 Feb 98 16:00:25 -0800
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Perl-Users Digest Wed, 11 Feb 1998 Volume: 8 Number: 1865
Today's topics:
Annouce: PDF-1.04 <anface@yahoo.com>
ANNOUNCE: Tk::ObjScanner Beta version 0.1 <domi@marlis.grenoble.hp.com>
Annoying Message Whenever I Read From a File (Kevin M Simonson)
Re: Code Example Needed <rra@stanford.edu>
Re: Comparing timelocal() and parse_dir() <rra@stanford.edu>
COOKIES, PERL, and FASTCGI...how to cookies?????? <mshannon@lds.com>
Re: Downloading multiple files via CGI (Martien Verbruggen)
Re: FAQless Forays (was: Code Example Needed) <tchrist@mox.perl.com>
Re: FAQless Forays (was: Code Example Needed) <tchrist@mox.perl.com>
Re: Finding the last line in a list? (Mikael Skogstrom)
Re: Finding the last line in a list? (Martin Vorlaender)
Re: Finding the last line in a list? <tchrist@mox.perl.com>
Re: Forked, but do not know how to change a TTY <mb@cup.hp.com>
Re: Help with code.........!! (Martien Verbruggen)
Re: How to get disk's volume label under Win95? (Martien Verbruggen)
Re: how to properly interpret a '-?' command line optio <rra@stanford.edu>
Metacharacters and script security - advice please. (User)
Re: Newbie needs HELP (Steve Linberg)
Re: Perl Banner Rotation <tchrist@mox.perl.com>
Re: Possible bug in "or" operator <tchrist@mox.perl.com>
Search files seq. help <jsgines@uu.net>
SOURCE: using smtp's vrfy command <tchrist@mox.perl.com>
strange key behaviour and the Blue Camel <prl2@lehigh.edu>
Re: Tainting behavior from 5.004 to 5.004_04 <rra@stanford.edu>
Re: Tom wins flamer of the year award! <tchrist@mox.perl.com>
Re: Web page does not display all output of cgi !!!!! (Martien Verbruggen)
Re: Year 2000 Compliance: Lawyers, Liars, and Perl <rra@stanford.edu>
Digest Administrivia (Last modified: 8 Mar 97) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: 11 Feb 1998 22:53:12 GMT
From: Antonio Rosella <anface@yahoo.com>
Subject: Annouce: PDF-1.04
Message-Id: <6bta4o$7pi$1@news1.teleport.com>
New Release: 1.04
Name DSLI Description Info
----------- ---- -------------------------------------------- -----
PDF bdpO Access information in a PDF file ANTRO
The PDF library is a proposed library for access the information
contained inside a PDF file. PDF stands for Portable Document Format and
is
a standard proposed by Adobe ( See http://www.adobe.com/ for more
details ).
NEWS: The library is now splitted in several files:
PDF
PDF::Core
PDF::Pages
PDF::Parse
for a better developing.
The Info Dictionary is now accessible ( Author, Title, Creator, etc. )
--
The library is available at
<http://www.geocities.com/CapeCanaveral/Hangar/4794/>
and at all CPAN mirror
Enjoy
--
____ __ _ ___ ____ ____ Antonio "Antro" Rosella
|--| | \| | |--< [__] antro@technologist.com
Member of ANFACE anface@yahoo.com anface@geocities.com
http://www.geocities.com/CapeCanaveral/Hangar/4794/
------------------------------
Date: 11 Feb 1998 22:53:48 GMT
From: Dominique Dumont <domi@marlis.grenoble.hp.com>
Subject: ANNOUNCE: Tk::ObjScanner Beta version 0.1
Message-Id: <6bta5s$7pt$1@news1.teleport.com>
Hello
I'd like to announce the brand new beta version of the Tk::ObjScanner
ObjScanner is a composite widget made of a listbox and a test window
(actually a Multi::Text). This widget acts as a scanner to any perl object.
The scanner will retrieve all keys of the hash of the scanned object
and insert them in the listbox. Then a double click on the list item will
display its content in the text window.
I grant you that reading all the attributes of an object is generally
considered as bad manners. But I found that this widget is really handy
when debugging complex Tk applications which feature lot of independent
objects.
This module was written with perl5.004 and Tk 402.003
See the embedded documentation in the module for more details.
Comments and suggestions are always welcome.
Suggested module line :
Tk::ObjScanner bdpO Tk Object attributes scanner DDUMONT
Share and enjoy
--
Dominique_Dumont@grenoble.hp.com
------------------------------
Date: 11 Feb 1998 23:20:08 GMT
From: simonsen_nospam@skopen.dseg.ti.com (Kevin M Simonson)
Subject: Annoying Message Whenever I Read From a File
Message-Id: <6btbn8$snu@sf18.dseg.ti.com>
Keywords: annoy message
When I write a "perl" script that reads input from a file, and then
execute the script, I get this annoying message telling me my file handle
might be zero, and suggesting that I use the "defined()" command to test
for it. For example, when I executed program "Hmm" listed below I got the
message listed below, and it didn't go away until I had inserted my refer-
ence to the "defined ()" command inside my "while" condition, like I have
it in "Mdfd" below. Obviously that's going to slow me down and is unneces-
sary. But I also don't want users of my script to keep getting this annoy-
ing message.
Anybody out there had experience with this type of a message, and have
clue how to turn it off without sacrificing program performance? Feel free
to mail me at "smnsn@skopen.dseg.ti.com" or just post to this newsgroup.
Thanks in advance.
h46^h/simonson/Qp} cat Hmm
#!/usr/local/bin/perl54 -w
open (HMM, "Hmm.Hmm");
while ($SubBlock = <HMM>)
{ print "Read \"$SubBlock\".\n";
}
close HMM;
h46^h/simonson/Qp} cat Mdfd
#!/usr/local/bin/perl54 -w
open (HMM, "Hmm.Hmm");
while ((defined (HMM)) && ($SubBlock = <HMM>))
{ print "Read \"$SubBlock\".\n";
}
close HMM;
h46^h/simonson/Qp} Hmm
Value of <HANDLE> construct can be "0"; test with defined() at Hmm line 3.
h46^h/simonson/Qp} Mdfd
h46^h/simonson/Qp} perl54 -version
This is perl, version 5.004_01
Copyright 1987-1997, Larry Wall
Perl may be copied only under the terms of either the Artistic License or
GNU General Public License, which may be found in the Perl 5.0 source kit.
h46^h/simonson/Qp}
---Kevin Simonson
-------------------------------------------------------------------------
Reverence To send me mail, remove "_nospam" and
the eternal. all the vowels from my login name.
------------------------------
Date: 11 Feb 1998 15:05:49 -0800
From: Russ Allbery <rra@stanford.edu>
To: mystra@torilmud.com (Eileen Kortright)
Subject: Re: Code Example Needed
Message-Id: <m3d8gtzqr6.fsf@windlord.Stanford.EDU>
[ Posted and mailed. ]
Eileen Kortright <mystra@torilmud.com> writes:
> The keys are the range of numbers or Julian year dates that the FR month
> covers. The values are the FR months. Now, here's what is supposed to
> happen:
> Take value of the Julian year date (example: today is the 42nd day of
> 1998)
> Result: $Julian=42
> Go through the values field and locate the element equivilent of "42"
> Result: 32..61,"Alturiak"
> Get the key (month) from that pairing.
> Result: Alturiak
> Take the Julian date to the lowest value of the current key range and
> subtract the key from the Julian date
> Result: 42-32= 10
> The date is: the 10th day of Alturiak
Personally, I would simply brute-force this. Brute-force is quite often
the most elegant solution to a problem, and in this case you only *have*
365 days to worry about. So if you do something like this:
@fr_months = ([ 1, 30, 'Hammer'],
[ 31, 31, 'Midwinter'],
[ 32, 61, 'Alturiak'],
[ 62, 91, 'Ches'],
[ 92, 121, 'Tarsakh'],
[122, 122, 'Greengrass'],
[123, 152, 'Mirtul'],
[153, 182, 'Kythorn'],
[183, 212, 'Flamerule'],
[213, 213, 'Midsummer'],
[214, 243, 'Eleasias'],
[244, 273, 'Eleint'],
[274, 274, 'Higharvesttide'],
[275, 304, 'Marpenoth'],
[305, 334, 'Uktar'],
[335, 335, 'Moonfest'],
[336, 365, 'Nightal'],
[366, 366, 'Shieldmeet']);
Now you have an array of anonymous arrays, one per month, of the form
"start day", "end day", "month name". Now you can do magic to build a
hash:
foreach $month (@fr_months) {
foreach ($$month[0] .. $$month[1]) {
$fr_months{$_} = $$month[2];
$fr_months{$_} .= ' ' . ($_ - $$month[0] + 1)
if ($$month[0] != $$month[1]);
}
}
This builds a hash %fr_months, keyed on the calendar day, that contains
the name of the month and then a space and the day of the month (where the
space and the day of the month aren't present if the month has only one
day). That's pretty much precisely the data structure you want; you can
then get back the exact FR date for, say, day 120 as $fr_months{120}.
--
#!/usr/bin/perl -- Russ Allbery, Just Another Perl Hacker
$^=q;@!>~|{>krw>yn{u<$$<[~||<Juukn{=,<S~|}<Jwx}qn{<Yn{u<Qjltn{ > 0gFzD gD,
00Fz, 0,,( 0hF 0g)F/=, 0> "L$/GEIFewe{,$/ 0C$~> "@=,m,|,(e 0.), 01,pnn,y{
rw} >;,$0=q,$,,($_=$^)=~y,$/ C-~><@=\n\r,-~$:-u/ #y,d,s,(\$.),$1,gee,print
------------------------------
Date: 11 Feb 1998 15:39:36 -0800
From: Russ Allbery <rra@stanford.edu>
Subject: Re: Comparing timelocal() and parse_dir()
Message-Id: <m367mlzp6v.fsf@windlord.Stanford.EDU>
In comp.lang.perl.misc, Matt Couchman <Matthew.Couchman@bbsrc.ac.uk> writes:
> I'm trying to compare the value from Time::Local's timelocal() and the
> $mtime value returned from File::Listing's parse_dir() with some
> unexpected results. Are they compatible? I know that the $mtime value is
> the no. of seconds since Jan 1, 1970 but the documentation for
> timelocal() doesn't precisely what the returned integer represents.
I believe timelocal() returns seconds since epoch. Is there a reason why
you're using it rather than localtime() or just time(), though? There
aren't a lot of cases where Time::Local is going to buy you anything.
In any event, is it possible that you're having time zone problems?
--
#!/usr/bin/perl -- Russ Allbery, Just Another Perl Hacker
$^=q;@!>~|{>krw>yn{u<$$<[~||<Juukn{=,<S~|}<Jwx}qn{<Yn{u<Qjltn{ > 0gFzD gD,
00Fz, 0,,( 0hF 0g)F/=, 0> "L$/GEIFewe{,$/ 0C$~> "@=,m,|,(e 0.), 01,pnn,y{
rw} >;,$0=q,$,,($_=$^)=~y,$/ C-~><@=\n\r,-~$:-u/ #y,d,s,(\$.),$1,gee,print
------------------------------
Date: Wed, 11 Feb 1998 18:11:31 -0500
From: Michael Shannon <mshannon@lds.com>
Subject: COOKIES, PERL, and FASTCGI...how to cookies??????
Message-Id: <34E23023.AF6C6C01@lds.com>
Hi,
I ma currentlt attempting to convert a CGI environment written in Perl,
to a FASTCGI environment written in Perl 5.004. We are currently using
the CGI library CGI.pm to simplify the the interface to the CGI
enviroment variables. I have found that it is necessary to specifically
use CGI::Fast to get the same functionality in the FASTCGI enviroment.
The problem I am having is with the cookies. Here is a synopsis of the
code:
use CGI::Fast;
while($query = new CGI::Fast)
{
$page = $query->param('PAGE'); - Works fine!
$cookie = $query->cookie('names1');
}
Is there something that I am obviously not doing or doing that I am
overlooking?
Thanks for any insight.
Michael Shannon
mshannon@lds.com
------------------------------
Date: 11 Feb 1998 22:21:44 GMT
From: mgjv@comdyn.com.au (Martien Verbruggen)
Subject: Re: Downloading multiple files via CGI
Message-Id: <6bt89o$3s6$4@comdyn.comdyn.com.au>
In article <34E16FA5.1699BE81@sni.de>,
Jochen Luig <eggbert.pad@sni.de> writes:
> I'm trying to download multiple files with a perl script. The files are
> supposed to be specified by a checklist in an HTML-form.
> I have in mind something like this:
First you should read up on CGI and that file download thingie. If it
is possible at all to get multiple files via that, which I doubt (ask
on a CGI programming newsgroup), the module CGI.pm should have
implemented it. It comes with every recent version of perl.
Martien
--
Martien Verbruggen |
Webmaster www.tradingpost.com.au |
Commercial Dynamics Pty. Ltd. | Curiouser and curiouser, said Alice.
NSW, Australia |
------------------------------
Date: 11 Feb 1998 22:58:56 GMT
From: Tom Christiansen <tchrist@mox.perl.com>
Subject: Re: FAQless Forays (was: Code Example Needed)
Message-Id: <6btafg$2c4$1@csnews.cs.colorado.edu>
[courtesy cc of this posting sent to cited author via email]
In comp.lang.perl.misc, an obfuscated version of the address
pjach@erac.com wrote using the dubious newsreader Microsoft Outlook
Express 4.72.2106.4:
:Those 3 times I posted, I didn't bother to read the FAQ or check to see
:if someone else had already posted the question and received an answer.
Then you will of course understand if *we* ``don't bother'' to give
you KLBs an answer, or at least berate you for sloth and selfishness if
we do. KLBs (`Known Lazy Bastards') are a serious problem, and we must
extirpate them. They are anti-Perl, anti-Usenet, and anti-hackerdom.
These non-FAQ reader are persons who would rather make someone else take
their time to explain something basic than look it up in the documents.
We don't have to answer them. And we shouldn't.
This sorry state of affairs seems particularly prevalent, nay, virtually
endemic, amongst the suffering victims of Microsoft. These folks, to
paint with what shall doubtless prove too broad a brush, cannot lift a
finger look things up for themselves. Instead, they selfishly waste
other people's time instead. Why must they make others work so hard
and them so little?
I'm sorry, but this whole "I don't have time to look it up on my own
system, just tell me the quick answer" a really terrible attitude,
and we cannot support it here. Why do you think they receive so much
documentation standard with every distribution? Not reading the documents
that so many of us worked so hard to create TO AVOID THIS messy state of
affairs is simply not acceptable behaviour. It is insulting behaviour
which is nothing short of pure selfishness, and is imprudent in the
extreme when soliciting aid: it manages only to piss off the people
whom they most need.
Every time a FAQ or other question in the standard docs is posted, it is
important that the user not be told the exact answer to their question,
but rather nothing more than the fact this has been answered already
and in what document, which they already have.
When we have a moderated newsgroup, this will get much better. I hope.
--tom
--
Tom Christiansen tchrist@jhereg.perl.com
Never hit a man with glasses. Hit him with a baseball bat.
------------------------------
Date: 11 Feb 1998 23:09:12 GMT
From: Tom Christiansen <tchrist@mox.perl.com>
Subject: Re: FAQless Forays (was: Code Example Needed)
Message-Id: <6btb2o$2c4$3@csnews.cs.colorado.edu>
[courtesy cc of this posting sent to cited author via email]
In comp.lang.perl.misc, mystra@torilmud.com (Eileen Kortright) writes:
:Horror! I'm using Windows! Horror! Flee! Run! It's FREE AGENT, too!
It's not the tool. It's the culture.
:Now THIS is hilarious. Months? That's it? A few months? Untold months?
I have used Perl virtually every day of my life for the last ten years,
and spent a great deal of my free helping people. More than you can
imagine.
:Guess what? It's human nature! As a rule, most people do NOT read help
:files or FAQs.
Then they have no business here. That's not how Usenet works.
--tom
--
Tom Christiansen tchrist@jhereg.perl.com
"Debugging is anticipated with distaste, performed with reluctance, and bragged
about forever."
--button at the Boston Computer Museum
------------------------------
Date: Thu, 12 Feb 1998 00:20:12 +0100
From: mikael@techtalk.se (Mikael Skogstrom)
Subject: Re: Finding the last line in a list?
Message-Id: <B107F0BC9668711C3@du107-250.ppp.algonet.se>
In article <6bslcq$q0g$1@bashir.ici.net>,
burt@ici.net (Burt Lewis) wrote:
>I have a text file that might look something like this:
>
>1:apples:pears:peaches
>2:pears:peaches:pears
>3:peaches:apples:plums
>
>
>I need to always be able to read the last line and grab the first field, in
>this case the 3.
You could try this:
open (FILE, "filename");
@a = <FILE>;
$b = pop @a;
($FirstField) = split /:/ $b;
close FILE;
I'm not sure the second last line will do -- I don't know what happens when
you try to put a number of items in a list that only contains one slot
(what should happen is that the first item is put there while the rest is
garbage collected) -- but the rest works marvellously.
Mikael
------------------------------
Date: Wed, 11 Feb 1998 23:02:15 +0100
From: martin@RADIOGAGA.HARZ.DE (Martin Vorlaender)
Subject: Re: Finding the last line in a list?
Message-Id: <34e21fe7.524144494f47414741@radiogaga.harz.de>
Burt Lewis (burt@ici.net) wrote:
: I have a text file that might look something like this:
: 1:apples:pears:peaches
: 2:pears:peaches:pears
: 3:peaches:apples:plums
: I need to always be able to read the last line and grab the first field, in
: this case the 3.
: tried this and many variations many times without luck:
: open(READFILE, "/files/WWW/vhtdocs/eastonmass/database2/data.txt");
Even when your script is "just an example" (and perhaps especially in that
case!) you should _always_ check the return value after opening a file.
: while (<READFILE>)
: {
: chop;
Nowadays the chomp() function is generally preferred.
: @fields = (split(/:/,$_,4));
: }
: $last = "$fields[0]";
No need for quotes here.
: $next = ++$last;
: print "the last number is:$last";
: print "the next number is:$next";
I'd expect both numbers to be the same, because in the above statement,
$last is incremented, before its new value is assigned to $next.
So, what are you getting with the above sample data?
- if it's 4, everything's alright;
- if it's 1, you have at least one empty line behind the last data line
(@fields becomes an empty array; $last gets assigned to undef;
++$last becomes 1 - though I'm not quite sure why)
cu,
Martin
--
| Martin Vorlaender | VMS & WNT programmer
Ceterum censeo | work: mv@pdv-systeme.de
Redmondem delendam esse. | http://www.pdv-systeme.de/users/martinv/
| home: martin@radiogaga.harz.de
------------------------------
Date: 11 Feb 1998 23:49:32 GMT
From: Tom Christiansen <tchrist@mox.perl.com>
Subject: Re: Finding the last line in a list?
Message-Id: <6btdec$2c4$8@csnews.cs.colorado.edu>
[courtesy cc of this posting sent to cited author via email]
In comp.lang.perl.misc, burt@ici.net (Burt Lewis) writes
about finding the first field in the last line. Everyone
keeps posting slow solutions.
Here's one:
local *FILE; # for demo purposes only
$FILE = "/files/WWW/vhtdocs/eastonmass/database2/data.txt";
open (FILE) || die "can't open $FILE for reading: $!";
do { $line = <FILE> } until eof(FILE);
($field) = $line =~ /([^:]*)/;
print "First field on last line is $field\n";
That one doesn't read in all the lines at once.
Much faster is to just skip forward until close to the
end. Let's assume we know that no line exceeds 100 bytes.
local *FILE; # for demo purposes only
$FILE = shift || '/usr/dict/words';
open (FILE) || die "can't open $FILE for reading: $!";
if (($size = -s FILE) > 100) {
seek(FILE, $size - 100, 0) || die "can't seek in $FILE: $!";
}
do { $line = <FILE> } until eof(FILE);
print $line;
You would be amazed at what a difference that makes on a big file.
--tom
--
Tom Christiansen tchrist@jhereg.perl.com
Installing unix fixes the [VMS] bug.
-Barry Shein
------------------------------
Date: Wed, 11 Feb 1998 15:02:04 -0800
From: Marc Bernstein <mb@cup.hp.com>
Subject: Re: Forked, but do not know how to change a TTY
Message-Id: <34E22DEB.C3BAD89@cup.hp.com>
Marc Bernstein wrote:
> Define $DB::fork_TTY or get_fork_TTY().
> ..................
>
> I am trying to create a well behaved daemon but cant find a good
> discussion explaining how to manage the TTY from Perl or a good module
> to use that will provide generic daemon friendly startup - disconnect
> from the TTY, etc.
>
> I want to run this from inittab with a respawn attribute.
>
> Could someone explain why I got the above message when in the debugger
> but not when running the script separately? Can someone recommend a
> Daemon module to use? The script will open a socket connection and
> exchange information with yet another Daemon running on another machine.
>
> Any suggestions welcome.
>
> Thanks in advance,
>
> Marc
PS
where would one find a description of the above recommendations from the
debugger namely:
$DB::fork_TTY or get_fork_TTY
There is no mention of a DB module in the Perl Module References from the
Resource Kit manuals.
I find exactly one index reference in Programming Perl to the DB package
(when talking about the caller function).
I assume DB has something to do with DBD or DB_file???
So where and what is the 'DB' package?
------------------------------
Date: 11 Feb 1998 22:23:22 GMT
From: mgjv@comdyn.com.au (Martien Verbruggen)
Subject: Re: Help with code.........!!
Message-Id: <6bt8cq$3s6$5@comdyn.comdyn.com.au>
In article <6brrtp$pkv@argentina.earthlink.net>,
you@somehost.somedomain (asdf) writes:
> I am having problems understanding the mechanics of the following code:
[snipped crap]
Try posting this again, with some different wordings. You might get
some response then. (Not from me, you're killfiled).
Martien
--
Martien Verbruggen |
Webmaster www.tradingpost.com.au | Inside every anarchy lurks an old boy
Commercial Dynamics Pty. Ltd. | network - Mitchell Kapor
NSW, Australia |
------------------------------
Date: 11 Feb 1998 22:30:52 GMT
From: mgjv@comdyn.com.au (Martien Verbruggen)
Subject: Re: How to get disk's volume label under Win95?
Message-Id: <6bt8qs$3s6$7@comdyn.comdyn.com.au>
In article <34E198F8.B40556D1@patriot.net>,
Jim <spam@patriot.net> writes:
> Q: How can I get a Win95 (DOS or NT) disk volume label in a Perl
> script?
Hmm, since this is a windows specific thing, you could have a look at
one of the Win32 modules on CPAN (http://www.perl.com/CPAN/modules/).
If you can't find anythign there, I'm afraid you'll have to do some
system call to some DOS function that will give you that information,
and parse its ooutput.
Martien
--
Martien Verbruggen |
Webmaster www.tradingpost.com.au | You can't have everything, where would
Commercial Dynamics Pty. Ltd. | you put it?
NSW, Australia |
------------------------------
Date: 11 Feb 1998 15:44:28 -0800
From: Russ Allbery <rra@stanford.edu>
To: Hugh Williams <hughw@sr.hp.com>
Subject: Re: how to properly interpret a '-?' command line option
Message-Id: <m3yazhyaeb.fsf@windlord.Stanford.EDU>
[ Posted and mailed. ]
Hugh Williams <hughw@sr.hp.com> writes:
> I am using the Getopt::Std module to grab a number of command line
> options; I'd like to be able to allow the user to type
> progname -?
Perl variables, for the most part, aren't allowed to contain special
characters; use the two-argument form of getopts() instead so that the
options will be stored in a hash. There are no such limits on hash keys.
--
#!/usr/bin/perl -- Russ Allbery, Just Another Perl Hacker
$^=q;@!>~|{>krw>yn{u<$$<[~||<Juukn{=,<S~|}<Jwx}qn{<Yn{u<Qjltn{ > 0gFzD gD,
00Fz, 0,,( 0hF 0g)F/=, 0> "L$/GEIFewe{,$/ 0C$~> "@=,m,|,(e 0.), 01,pnn,y{
rw} >;,$0=q,$,,($_=$^)=~y,$/ C-~><@=\n\r,-~$:-u/ #y,d,s,(\$.),$1,gee,print
------------------------------
Date: Wed, 11 Feb 1998 22:40:16 GMT
From: networks@skynet.co.uk (User)
Subject: Metacharacters and script security - advice please.
Message-Id: <34e2280b.26848213@news.skynet.co.uk>
Metacharacters and script security - advice please.
Hi,
I feel I need to explain a little bit about the advice I'm after.
I've read in several CGI/Perl books that state that any data entered
into and online html form should be checked for certain metacharacters
in case a malicious user enters shell commands by using shell command
notation.
Here's what I'd like to know:
1. Is it necessary to check for these characters if no other program
is to be executed? Eg. a simple search script.
2. Which characters if any should be checked for when using sendmail?
3. Is it necessary to check for these characters if the -t parameter
is used with sendmail?
4. Can anyone recommend a good CGI/Perl book or web site which covers
this 'script security' issue in depth?
Thanks to all those who offered help previously.
------------------------------
Date: Wed, 11 Feb 1998 18:12:41 -0500
From: linberg@literacy.upenn.edu (Steve Linberg)
Subject: Re: Newbie needs HELP
Message-Id: <linberg-1102981812410001@projdirc.literacy.upenn.edu>
In article <34E22510.5755@tidalwave.net>, davidsmith@tidalwave.net wrote:
> All,
>
> I am new to PERL and need to get up to speed. I bought the Teach
> Yourself PERL in 21 Days book.
NOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO!!!
Ahrm. Sorry. That concept has been a testy one in here recently. :)
> I should have checked here first as I
> see a number of postings regarding errors.
Always a good idea.
> chdir ("c:\newdir");
> mkdir ("newroot", 0755);
> chdir (c:\newdir\newroot");
> mkdir ("newsubdirectory", 0755);
Lose the parenthesis, and watch the typos in your code. Also be aware
that your permissions numbers are UNIX, not NT. And remember to check for
return codes. Any of those calls may be failing.
My advice is to also lose both "TYPI21D" and the idea that you can learn
Perl in 21 days, and get Learning Perl by Randal Schwartz, and then
Programming Perl by Tom Christiansen et al. And please, please, please
read the FAQs, cover to cover. They answer nearly everything. There is a
lot to get up to speed with, but it's worth it.
Good luck.
--
Steve Linberg | National Center on Adult Literacy
Systems Programmer etc. | University of Pennsylvania
linberg@literacy.upenn.edu | http://www.literacyonline.org
------------------------------
Date: 11 Feb 1998 23:01:40 GMT
From: Tom Christiansen <tchrist@mox.perl.com>
Subject: Re: Perl Banner Rotation
Message-Id: <6btakk$2c4$2@csnews.cs.colorado.edu>
:I was wondering is there is any really good banner rotation software
:(similar to the kind LinkExchange uses) available for a small price (free is
:always better :). This software needs to be in perl because I want to
:integrate parts of my existing code into the codebase. Any ideas?
The best idea I have is posting your request to a newsgroup devoted to
CGI programming, especially once you've done an Alta Vista and a Deja
News hunt. Can you imagine posting "Hey, I need a spreadsheet program
in C++" to the comp.lang.c++ newsgroup?
--tom
--
Tom Christiansen tchrist@jhereg.perl.com
"A good messenger expects to get shot." --Larry Wall
------------------------------
Date: 11 Feb 1998 23:41:28 GMT
From: Tom Christiansen <tchrist@mox.perl.com>
Subject: Re: Possible bug in "or" operator
Message-Id: <6btcv8$2c4$7@csnews.cs.colorado.edu>
[courtesy cc of this posting sent to cited author via email]
In comp.lang.perl.misc, ehood@medusa.acs.uci.edu (Earl Hood) writes:
:Take the following code example:
:
: $x = 0 || 5;
: $y = 0 or 5;
Whoa, there. What is that? "or" is not what you think it is.
And you didn't use -w! Earl, how could you? :-)
Let me repeat something I said recently:
I think this one (creating "or") was something we didn't think
through. Consider:
unlink $a, $b, $c || die;
$a = $b || $c;
unlink $a, $b, $c or die;
$a = $b or $c;
In both cases, one is wrong. But it's a different one. Also, the
"or" doesn't stand out very well. I'm starting to learn back toward
having people learn precedence. You can't use either one without
knowing precedence, so making another operator with another precedence
just changes where the problem shows up and makes everything harder.
Let me put in parens for you where Perl found them:
unlink $a, $b, ($c || die);
$a = ($b || $c);
(unlink $a, $b, $c) or die;
($a = $b) or $c;
I've pretty stopped using "and" and "or", since they don't stand
out and people keep making the mistake you cite.
--tom
--
Tom Christiansen tchrist@jhereg.perl.com
``I do quarrel with logic that says, `Stupid people are associated with X,
therefore X is stupid.' Stupid people are associated with everything.''
--Larry Wall in <1992Dec31.203724.26018@netlabs.com>
------------------------------
Date: Wed, 11 Feb 1998 18:48:49 -0500
From: "Jonathan S. Gines" <jsgines@uu.net>
Subject: Search files seq. help
Message-Id: <34E238E1.41C67EA6@uu.net>
I am new to the PERL language (im a network systems guy who is facing
the reality that he will have to code to fix something, nuff said) but
am clueful enough to stumble and make work if I can get some advice. I
would like to know if anyone has a solution for my following task. I am
currently using PERL 5.003 for Win32 (ActiveState distribution) and am
programming in an NT workstation environment. OK, because PERL is such
a rich language, Im not sure how to apply PERL to solve something that
can be automated.
I would like to write a script that will accept input from the keyboard,
and use that input as a reg. expression to search a file. I was using
the $variable = <STDIN> scalar value to be used in the search, but I am
unsuccessful. The log files I need searched has 2 left columns
indicating the date and time in this format:
YYMMDD HR:MM:Sec
The regular expression is located in the fifth column, and I would like
to capture the Date, Time, and the regular expression as parameters to
search for another log file. The logic I was using was this:
Enter regular expression
chomp ($Search = <STDIN>);
unless(open (filehandle, '//share/logfilename')) {
die "cant open logfile error message";
search the logfile using the info. captured in <STDIN> in the 5th column
if <STDIN> is found in 5th column of logfile
capture the left 2 columns (ie. DATE TIME)
print those lines in the logfile that contain <STDIN>
look for another string if <STDIN> was found
2nd <STDIN>
print those lines that contain the 2nd <STDIN> expression
close filehandle
open another logfile
search for the DATE TIME and reg. expression
capture the left 2 columns (ie, DATE TIME)
print those lines in the logfile that contain the <STDIN>
if the search fails
increment the TIME by 1 minute
search for the reg. expression in 5th column
print those lines in the logfile that contain the <STDIN>
close filehandle
open another logfile
search for DATE TIME and <STDIN> from last logfile
print those lines in the logfile that contain the <STDIN>
look for the 2nd <STDIN> (from first log)
if the search fails
increment the TIME by 1 minute
search for the reg. expression in 5th column
print those lines in the logfile that contain the <STDIN>
else
search for any "error message" found in the log file
print the error messages
close filehandle
Create a summary report for the search from above.
Im sorry that the above pseudocode (terrible and sloppy I know, sorry),
but if there are any PERL gurus that have faced a similiar task in
solving anything close to this and can point in the right direction, I
would greatly appreciate it. Thanks in advance to the PERL masters.
Jonathan Gines
Sr. Engineer
UUNET Technologies
------------------------------
Date: 11 Feb 1998 23:24:24 GMT
From: Tom Christiansen <tchrist@mox.perl.com>
Subject: SOURCE: using smtp's vrfy command
Message-Id: <6btbv8$2c4$5@csnews.cs.colorado.edu>
Keywords: source smpt dns
Here's my "expn" and "vrfy" program (it checks its name -- make two
links to the same file) that tries to use the EXPN or VRFY command to
figure out whether an address is going to work. It's of limited use,
but may be illustrative of coolness. It will run with the standard
distribution alone, but prefers to have Net::DNS handy.
--tom
#!/usr/bin/perl
#
# expn -- convince smtp to divulge an alias expansion
# tchrist@perl.com 25-Jan-93
# updated for 5.004, 10-Sep-97
# updated for Net::DNS 3-Feb-98
#
# invoked as vrfy, will use VRFY, else use EXPN
use strict;
my $fetch_mx = 0;
eval {
require Net::DNS;
Net::DNS->import('mx');
$fetch_mx = 1;
};
use IO::Socket;
use Sys::Hostname;
my $selfname = hostname();
die "usage: $0 address\@host ...\n" unless @ARGV;
my $VERB = ($0 =~ /ve?ri?fy$/i) ? 'VRFY' : 'EXPN';
my $multi = @ARGV > 1;
my $remote;
ADDR: foreach my $combo (@ARGV) {
my ($name, $host) = split(/\@/, $combo);
my @hosts;
$host ||= 'localhost';
@hosts = map { $_->exchange } mx($host) if $fetch_mx;
@hosts = ($host) unless @hosts;
foreach my $host (@hosts) {
print $VERB eq 'VRFY' ? "Verify" : "Expand", "ing $name at $host ($combo):";
$remote = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => $host,
PeerPort => "smtp(25)",
);
unless ($remote) {
warn "cannot connect to $host\n";
next;
}
print "\n";
$remote->autoflush(1);
$remote->print("HELO $selfname\r\n");
$remote->print("$VERB $name\r\nquit\r\n");
while ($_ = $remote->getline) {
/^220\b/ && next;
/^221\b/ && last;
s/250\b[\-\s]+//;
print;
}
close($remote) || die "can't close socket: $!";
print "\n"; # if @ARGV;
}
}
__END__
--
Tom Christiansen tchrist@jhereg.perl.com
"Espousing the eponymous /cgi-bin/perl.exe?FMH.pl execution model is like
reading a suicide note -- three days too late."
--Tom Christiansen <tchrist@mox.perl.com>
------------------------------
Date: Wed, 11 Feb 1998 17:12:22 -0500
From: "Phil R Lawrence" <prl2@lehigh.edu>
Subject: strange key behaviour and the Blue Camel
Message-Id: <6bt7o7$ml6@fidoii.cc.Lehigh.EDU>
At the bottom of this mssg there is an example script that that illustrates
this issue.
Blue Camel pp. 50 says, "The => identifier is just a synonym for a comma,
but its visually more distinctive, and it also quotes any bare identifiers
to the left of it..."
However, I find that in
my %hash = (
"0" => "Quoted One Zero",
"00" => "Quoted Two Zeros",
0 => "One Zero",
00 => "Two Zeros",
000 => "Three Zeros",
);
there are in fact only 2 keys being assinged to: '0' and '00'. Why?
Doesn't this go against what the Camel said?
Also, why does
$key = "000";
print "$hash{$key}\n";
print something different than
print "$hash{000}\n";
In fact,
$key = "000";
print "$hash{$key}\n";
prints the same thing as
print "$hash{\"000\"}\n";
Check it out yourself, and let me know what can explain this behaviour!
_______________________________________
#!/usr/local/bin/perl -w
use diagnostics;
use strict;
sub get_key {
my $key = "";
while ($key !~ /^[1-5]$|^(0|00|A|B)$/i) {
print "Enter the key you want: \n";
print "1. 0 - One Zero\n";
print "2. 00 - Two Zeros\n";
print "3. 000 - Three Zeros\n";
print "4. A - Eigh\n";
print "5. B - Bee\n";
print "Enter Selection: ";
chomp($key = <STDIN>);
}
CASE: {
if ($key =~ /^(1|0)$/i) { $key = "0"; last CASE; }
if ($key =~ /^(2|00)$/i) { $key = "00"; last CASE; }
if ($key =~ /^(3|000)$/i) { $key = "000"; last CASE; }
if ($key =~ /^(4|A)$/i) { $key = "A"; last CASE; }
if ($key =~ /^(5|B)$/i) { $key = "B"; last CASE; }
}
return($key);
}
my %hash = (
"0" => "Quoted One Zero",
"00" => "Quoted Two Zeros",
"000" => "Quoted Three Zeros",
"A" => "Quoted Eigh",
"B" => "Quoted Bee",
0 => "One Zero",
00 => "Two Zeros",
000 => "Three Zeros",
A => "Eigh",
B => "Bee",
);
my $key = get_key();
print "key = $key value = $hash{$key}\n";
print "\n";
print "key = 0 value = $hash{0} \n";
print "key = 00 value = $hash{00} \n";
print "key = 000 value = $hash{000} \n";
print "\n";
print "key = \\\"0\\\" value = $hash{\"0\"} \n";
print "key = \\\"00\\\" value = $hash{\"00\"} \n";
print "key = \\\"000\\\" value = $hash{\"000\"} \n";
__________________________________________
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Phil R Lawrence phone: 610-758-3051
Programmer / Analyst e-mail: prl2@lehigh.edu
194 Lehigh University Computing Center
E.W. Fairchild - Martindale, Bldg. 8B
Bethlehem, PA 18018
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"I have had to learn the simplest things
last..." -- Charles Olson
(I'm still on the hard things...)
------------------------------
Date: 11 Feb 1998 15:42:56 -0800
From: Russ Allbery <rra@stanford.edu>
To: Lee Shakespeare <lee@mbtuk.demon.co.uk>
Subject: Re: Tainting behavior from 5.004 to 5.004_04
Message-Id: <m33ehpzp1b.fsf@windlord.Stanford.EDU>
[ Posted and mailed. ]
Lee Shakespeare <lee@mbtuk.demon.co.uk> writes:
> I've just encountered a tainting problem when moving a set of scripts
> from machine to another. The code to untaint the variable would run
> fine on the one machine, running Perl 5.004, but failed on the other
> machine running 5.004_04. I've checked the change log and haven't
> spotted anything which would have caused the behavior.
> The offending code and regular expression :
> if ($var =~ /^([-\@\w.]+)$/) {
> $var = $1;
> }
Are you using locales? \w is unsafe in the presence of a locale; you need
to change that to A-Za-z0-9_ to explicitly specify the characters.
--
#!/usr/bin/perl -- Russ Allbery, Just Another Perl Hacker
$^=q;@!>~|{>krw>yn{u<$$<[~||<Juukn{=,<S~|}<Jwx}qn{<Yn{u<Qjltn{ > 0gFzD gD,
00Fz, 0,,( 0hF 0g)F/=, 0> "L$/GEIFewe{,$/ 0C$~> "@=,m,|,(e 0.), 01,pnn,y{
rw} >;,$0=q,$,,($_=$^)=~y,$/ C-~><@=\n\r,-~$:-u/ #y,d,s,(\$.),$1,gee,print
------------------------------
Date: 11 Feb 1998 23:12:08 GMT
From: Tom Christiansen <tchrist@mox.perl.com>
Subject: Re: Tom wins flamer of the year award!
Message-Id: <6btb88$2c4$4@csnews.cs.colorado.edu>
[courtesy cc of this posting sent to cited author via email]
In comp.lang.perl.misc, Douglas Clifton <doug@weboneinc.com>
writes a smiley face. I'm trying to figure out just what business
"We Bone, Inc." might be in. :-)
--tom
--
Tom Christiansen tchrist@jhereg.perl.com
"If you think Emacs is such a great editor, just look what it did for
Richard Stallman's typing skills!"
------------------------------
Date: 11 Feb 1998 22:28:49 GMT
From: mgjv@comdyn.com.au (Martien Verbruggen)
Subject: Re: Web page does not display all output of cgi !!!!!
Message-Id: <6bt8n1$3s6$6@comdyn.comdyn.com.au>
[please, next time try formatting your text correctly.]
In article <34E1846C.D8CF9993@etlxdmx.ericsson.se.not>,
Nick Djurovich <etlndh@etlxdmx.ericsson.se.not> writes:
> Hi,
> I've written a cgi script to format a file and output it line by
> line. Only a *fixed* amount
> of output appears in the web. I have test procedures, which output
> useful debugging information
> to a logfile, to mirror what's output to the web, and that shows the
> data is complete, so the
> browser is being sent the information but it's not displaying it.
>
> Sounds to me like some bufffer's full somewhere, and it's not being
> flushed ?
> Is there a limit on Netscape's input buffer or something like that ?
Look at the $| variable, perldoc perlvar
Is your script sending a content type of text/html? If so, is your
script outputting valid HTML? Try sending text/plain. That way you
don't have to worry about html stuff.
> --
[snipped incredibly large .sig, do you really need it that large?]
Martien
--
Martien Verbruggen |
Webmaster www.tradingpost.com.au | If at first you don't succeed, try
Commercial Dynamics Pty. Ltd. | again. Then quit; there's no use being
NSW, Australia | a damn fool about it.
------------------------------
Date: 11 Feb 1998 15:35:05 -0800
From: Russ Allbery <rra@stanford.edu>
Subject: Re: Year 2000 Compliance: Lawyers, Liars, and Perl
Message-Id: <m390rhzpee.fsf@windlord.Stanford.EDU>
In comp.lang.perl.misc, Derek Balling <dballing@speedchoice.com> writes:
> Bart Lateur wrote:
>> Perl's functions should always have returned 4 digit years.
> But, as we all know, they've returned "years since 1900", which is an
> interesting way of saying "we WEREN'T compliant, but the values you get
> in 2000 will be 'x', and not just 00's."
This has nothing to do with Perl. Perl is not responsible for the
implementation of struct tm in libc except insofar that a decision was
made to make Perl compatible with C in this regard. I'll wager that
tm_year has been defined as years since 1900 since before there *was* a
Perl.
--
#!/usr/bin/perl -- Russ Allbery, Just Another Perl Hacker
$^=q;@!>~|{>krw>yn{u<$$<[~||<Juukn{=,<S~|}<Jwx}qn{<Yn{u<Qjltn{ > 0gFzD gD,
00Fz, 0,,( 0hF 0g)F/=, 0> "L$/GEIFewe{,$/ 0C$~> "@=,m,|,(e 0.), 01,pnn,y{
rw} >;,$0=q,$,,($_=$^)=~y,$/ C-~><@=\n\r,-~$:-u/ #y,d,s,(\$.),$1,gee,print
------------------------------
Date: 8 Mar 97 21:33:47 GMT (Last modified)
From: Perl-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 8 Mar 97)
Message-Id: <null>
Administrivia:
The Perl-Users Digest is a retransmission of the USENET newsgroup
comp.lang.perl.misc. For subscription or unsubscription requests, send
the single line:
subscribe perl-users
or:
unsubscribe perl-users
to almanac@ruby.oce.orst.edu.
To submit articles to comp.lang.perl.misc (and this Digest), send your
article to perl-users@ruby.oce.orst.edu.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
To request back copies (available for a week or so), send your request
to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
where x is the volume number and y is the issue number.
The Meta-FAQ, an article containing information about the FAQ, is
available by requesting "send perl-users meta-faq". The real FAQ, as it
appeared last in the newsgroup, can be retrieved with the request "send
perl-users FAQ". Due to their sizes, neither the Meta-FAQ nor the FAQ
are included in the digest.
The "mini-FAQ", which is an updated version of the Meta-FAQ, is
available by requesting "send perl-users mini-faq". It appears twice
weekly in the group, but is not distributed in the digest.
For other requests pertaining to the digest, send mail to
perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
sending perl questions to the -request address, I don't have time to
answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V8 Issue 1865
**************************************
