From dan at linder.org  Fri Jan  1 16:09:41 2010
From: dan at linder.org (Dan Linder)
Date: Fri, 1 Jan 2010 18:09:41 -0600
Subject: [Omaha.pm] [OT] Need a DVI cable...
Message-ID: <3e2be51001011609r11e1f7e8x673c24e35985b66f@mail.gmail.com>

We purchased a new computer for the family for Christmas.  Even though
the video card and LCD monitor both have DVI ports, the monitor only
included a plain VGA cable.  I borrowed one from my desktop machine
and I need to replace it.  Best Buy wants $20 for one, DIT wants $15.
Is there a cheaper one in the area, or anyone have one gathering dust
they want to get rid of?

Dan

-- 
***************** ************* *********** ******* ***** *** **
"Quis custodiet ipsos custodes?"
    (Who can watch the watchmen?)
    -- from the Satires of Juvenal
"I do not fear computers, I fear the lack of them."
    -- Isaac Asimov (Author)
** *** ***** ******* *********** ************* *****************

From jhannah at omnihotels.com  Tue Jan  5 13:15:06 2010
From: jhannah at omnihotels.com (Jay Hannah)
Date: Tue, 5 Jan 2010 15:15:06 -0600
Subject: [Omaha.pm] Modern Perl: the book
Message-ID: <396CEDAA86B38646ACE2FEAA22C3FBF102C8C9BB@l3exchange.omnihotels.net>

Well, I'll be...

 

http://github.com/chromatic/modern_perl_book

 

j

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.pm.org/pipermail/omaha-pm/attachments/20100105/38a8403a/attachment.html>

From jay at jays.net  Thu Jan  7 09:45:13 2010
From: jay at jays.net (Jay Hannah)
Date: Thu, 7 Jan 2010 11:45:13 -0600
Subject: [Omaha.pm] Next mtg: Tue Jan 12, 7pm: PLT-Scheme mini hackathon
Message-ID: <B1B4AE76-96D2-405F-8C72-5DF0D303791A@jays.net>

http://jays.net/wiki/Odlug 

Tuesday January 12 2010, 7pm 
PLT-Scheme mini hackathon, spearheaded by Scott Hickey.

I'll bring pizza or a party sub depending on which mood strikes me.  :)

See you there!

j


From dan at linder.org  Fri Jan  8 12:32:44 2010
From: dan at linder.org (Dan Linder)
Date: Fri, 8 Jan 2010 14:32:44 -0600
Subject: [Omaha.pm] Perl CGI, start_form(), and alt tags...
Message-ID: <3e2be51001081232j7a1be08cg6eea0c697aa968a1@mail.gmail.com>

I'm working on a simple Perl CGI script that displays some data in a
table, and allows the user to click on a button to drill down into
that specific data.  The code presents the drill-down links as
submit-type buttons in the table, and that seems to be my issue.

The table data is useful in itself as something that might be
cut-n-past'ed into an e-mail.  Unfortunately, the data that is used
for the submit button text isn't captured when the user tries to copy
the table.  Here's a bit of HTML that shows this behavior:
======= begin HTML =======
<table border=1>
<td>Omaha</td>
<td>
<form method="post" action="drilldown.cgi" alt="111">
  <input type=submit value='111' alt='111'></input>
</form>
</td>

<td>
<form method="post" action="drilldown.cgi" alt="222">
  <input type=submit value='222' alt='222'></input>
</form>
</td>

<td align=center>33.3%</td>
</tr>
</table>
======= end HTML =======

If you view that with Firefox, the first and last columns are simple
text, and the middle two columns are buttons with alternative text.
When a user copies-and-pastes this into a text editor, only the
"Omaha" and "33.3%" fields are copied, the "111" and "222" are copied
as blank cells.

I tried adding "alt=" values to the submit buttons but that didn't help.

Anyone have other ideas?

Thanks,

Dan

-- 
***************** ************* *********** ******* ***** *** **
"Quis custodiet ipsos custodes?"
    (Who can watch the watchmen?)
    -- from the Satires of Juvenal
"I do not fear computers, I fear the lack of them."
    -- Isaac Asimov (Author)
** *** ***** ******* *********** ************* *****************

From rob.townley at gmail.com  Sat Jan  9 12:37:07 2010
From: rob.townley at gmail.com (Rob Townley)
Date: Sat, 9 Jan 2010 14:37:07 -0600
Subject: [Omaha.pm] Perl CGI, start_form(), and alt tags...
In-Reply-To: <3e2be51001081232j7a1be08cg6eea0c697aa968a1@mail.gmail.com>
References: <3e2be51001081232j7a1be08cg6eea0c697aa968a1@mail.gmail.com>
Message-ID: <7e84ed61001091237j34a2b696v8edc6ed2c264a8e8@mail.gmail.com>

On Fri, Jan 8, 2010 at 2:32 PM, Dan Linder <dan at linder.org> wrote:
> I'm working on a simple Perl CGI script that displays some data in a
> table, and allows the user to click on a button to drill down into
> that specific data. ?The code presents the drill-down links as
> submit-type buttons in the table, and that seems to be my issue.
>
> The table data is useful in itself as something that might be
> cut-n-past'ed into an e-mail. ?Unfortunately, the data that is used
> for the submit button text isn't captured when the user tries to copy
> the table. ?Here's a bit of HTML that shows this behavior:
> ======= begin HTML =======
> <table border=1>
> <td>Omaha</td>
> <td>
> <form method="post" action="drilldown.cgi" alt="111">
> ?<input type=submit value='111' alt='111'></input>
> </form>
> </td>
>
> <td>
> <form method="post" action="drilldown.cgi" alt="222">
> ?<input type=submit value='222' alt='222'></input>
> </form>
> </td>
>
> <td align=center>33.3%</td>
> </tr>
> </table>
> ======= end HTML =======
>
> If you view that with Firefox, the first and last columns are simple
> text, and the middle two columns are buttons with alternative text.
> When a user copies-and-pastes this into a text editor, only the
> "Omaha" and "33.3%" fields are copied, the "111" and "222" are copied
> as blank cells.
>
> I tried adding "alt=" values to the submit buttons but that didn't help.
>
> Anyone have other ideas?
>
> Thanks,
>
> Dan
>
> --
> ***************** ************* *********** ******* ***** *** **
> "Quis custodiet ipsos custodes?"
> ? ?(Who can watch the watchmen?)
> ? ?-- from the Satires of Juvenal
> "I do not fear computers, I fear the lack of them."
> ? ?-- Isaac Asimov (Author)
> ** *** ***** ******* *********** ************* *****************
> _______________________________________________
> Omaha-pm mailing list
> Omaha-pm at pm.org
> http://mail.pm.org/mailman/listinfo/omaha-pm
>

Adds another set of clicks but print.css may be converted to do what you want.

JavaScript onselect?

From dan at linder.org  Sat Jan  9 14:00:03 2010
From: dan at linder.org (Dan Linder)
Date: Sat, 9 Jan 2010 16:00:03 -0600
Subject: [Omaha.pm] Perl CGI, start_form(), and alt tags...
In-Reply-To: <7e84ed61001091237j34a2b696v8edc6ed2c264a8e8@mail.gmail.com>
References: <3e2be51001081232j7a1be08cg6eea0c697aa968a1@mail.gmail.com> 
	<7e84ed61001091237j34a2b696v8edc6ed2c264a8e8@mail.gmail.com>
Message-ID: <3e2be51001091400y3d25a519xca63552ea0b01fc8@mail.gmail.com>

On Sat, Jan 9, 2010 at 14:37, Rob Townley <rob.townley at gmail.com> wrote:
> Adds another set of clicks but print.css may be converted to do what you want.

Interesting idea.  A quick Google of "print.css" yields a lot of
examples I'll try looking at.

What's the CSS tag to reference the "submit" button look and feel?

Thanks,

Dan

-- 
***************** ************* *********** ******* ***** *** **
"Quis custodiet ipsos custodes?"
    (Who can watch the watchmen?)
    -- from the Satires of Juvenal
"I do not fear computers, I fear the lack of them."
    -- Isaac Asimov (Author)
** *** ***** ******* *********** ************* *****************

From eric.kennedy at reformationtechnology.com  Sat Jan  9 18:59:37 2010
From: eric.kennedy at reformationtechnology.com (Eric Kennedy)
Date: Sat, 9 Jan 2010 20:59:37 -0600
Subject: [Omaha.pm] Omaha-pm Digest, Vol 69, Issue 4
In-Reply-To: <mailman.1.1263067230.29808.omaha-pm@pm.org>
References: <mailman.1.1263067230.29808.omaha-pm@pm.org>
Message-ID: <a924fbf61001091859t584a335clb6c1e41247bf6691@mail.gmail.com>

I might not be tracking with you but is there a reason you can't use a
normal link and pass a parameter via the link rather than use an embedded
form?

Eric

On Sat, Jan 9, 2010 at 2:00 PM, <omaha-pm-request at pm.org> wrote:

>
> I'm working on a simple Perl CGI script that displays some data in a
> table, and allows the user to click on a button to drill down into
> that specific data.  The code presents the drill-down links as
> submit-type buttons in the table, and that seems to be my issue.
>
> The table data is useful in itself as something that might be
> cut-n-past'ed into an e-mail.  Unfortunately, the data that is used
> for the submit button text isn't captured when the user tries to copy
> the table.  Here's a bit of HTML that shows this behavior:
>
-- 
Eric Kennedy
Owner
Reformation Technology, LLC

phone: (402) 871-9297
e-mail: eric at reformationtechnology.com
website: http://www.reformationtechnology.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.pm.org/pipermail/omaha-pm/attachments/20100109/ab24fad3/attachment.html>

From dan at linder.org  Sun Jan 10 18:50:43 2010
From: dan at linder.org (Dan Linder)
Date: Sun, 10 Jan 2010 20:50:43 -0600
Subject: [Omaha.pm] Omaha-pm Digest, Vol 69, Issue 4
In-Reply-To: <a924fbf61001091859t584a335clb6c1e41247bf6691@mail.gmail.com>
References: <mailman.1.1263067230.29808.omaha-pm@pm.org>
	<a924fbf61001091859t584a335clb6c1e41247bf6691@mail.gmail.com>
Message-ID: <3e2be51001101850x660a46ctb17d6e9e3e8973e9@mail.gmail.com>

2010/1/9 Eric Kennedy <eric.kennedy at reformationtechnology.com>:
> I might not be tracking with you but is there a reason you can't use a
> normal link and pass a parameter via the link rather than use an embedded
> form?

Mostly so I didn't draw attention to the change. :-)  Changing from a
"button" to a simple HTML "link" would work but the look-and-feel
would change too.

I will probably leave it alone for now and wait until I get an
official complaint about the copy-and-paste then offer the solutions.

Thanks for the input!

Dan

-- 
***************** ************* *********** ******* ***** *** **
"Quis custodiet ipsos custodes?"
    (Who can watch the watchmen?)
    -- from the Satires of Juvenal
"I do not fear computers, I fear the lack of them."
    -- Isaac Asimov (Author)
** *** ***** ******* *********** ************* *****************

From dan at linder.org  Sun Jan 10 19:06:38 2010
From: dan at linder.org (Dan Linder)
Date: Sun, 10 Jan 2010 21:06:38 -0600
Subject: [Omaha.pm] Perl CGI, start_form(), and alt tags...
In-Reply-To: <3e2be51001091400y3d25a519xca63552ea0b01fc8@mail.gmail.com>
References: <3e2be51001081232j7a1be08cg6eea0c697aa968a1@mail.gmail.com> 
	<7e84ed61001091237j34a2b696v8edc6ed2c264a8e8@mail.gmail.com> 
	<3e2be51001091400y3d25a519xca63552ea0b01fc8@mail.gmail.com>
Message-ID: <3e2be51001101906i49e224e1x26f4e074d79428d2@mail.gmail.com>

I may have found something that keeps the "button" appearance, but
allows the text to be copied and pasted:  <button type=submit>Button
Name</button>
When that button is part of the copy-and-paste selection, the "Button
Name" is part of the text that is printed.

So, when my sample code is changed to this:
======= begin HTML =======
<table border=1>
<td>Omaha</td>
<td>
<form method="post" action="drilldown.cgi" alt="111">
 <button type=submit>111</button>
</form>
</td>

<td>
<form method="post" action="drilldown.cgi" alt="222">
 <button type=submit>222</button>
</form>
</td>

<td align=center>33.3%</td>
</tr>
</table>
======= end HTML =======

The resulting text that is copied is this:
Omaha 	111	222	33.3%

Thanks for all the pointers!

Dan
-- 
***************** ************* *********** ******* ***** *** **
"Quis custodiet ipsos custodes?"
    (Who can watch the watchmen?)
    -- from the Satires of Juvenal
"I do not fear computers, I fear the lack of them."
    -- Isaac Asimov (Author)
** *** ***** ******* *********** ************* *****************

From jay at jays.net  Tue Jan 12 00:52:48 2010
From: jay at jays.net (Jay Hannah)
Date: Tue, 12 Jan 2010 02:52:48 -0600
Subject: [Omaha.pm] Next mtg: Tue Jan 12, 7pm: PLT-Scheme mini hackathon
In-Reply-To: <B1B4AE76-96D2-405F-8C72-5DF0D303791A@jays.net>
References: <B1B4AE76-96D2-405F-8C72-5DF0D303791A@jays.net>
Message-ID: <2E3EAEC7-A80C-4D06-8619-AEFA6FBE52E2@jays.net>

On Jan 7, 2010, at 11:45 AM, Jay Hannah wrote:
> http://jays.net/wiki/Odlug 
> 
> Tuesday January 12 2010, 7pm 
> PLT-Scheme mini hackathon, spearheaded by Scott Hickey.

Scott's sick, so probably won't make it.

So we'll be winging it tonight. Been working on anything cool lately? Bring it and present!

j



From jhannah at omnihotels.com  Tue Jan 12 09:46:21 2010
From: jhannah at omnihotels.com (Jay Hannah)
Date: Tue, 12 Jan 2010 11:46:21 -0600
Subject: [Omaha.pm] 874
In-Reply-To: <OF3B23509E.31FE23F9-ON862576A9.00403FF9-862576A9.00406292@unomaha.edu>
References: <C770BBC8.267C5%jhannah@omnihotels.com>
	<OF3B23509E.31FE23F9-ON862576A9.00403FF9-862576A9.00406292@unomaha.edu>
Message-ID: <396CEDAA86B38646ACE2FEAA22C3FBF102DA07F6@l3exchange.omnihotels.net>

Is the file tab delimited? This seems to work:

 

perl -alnF'\t' -e 'print if ($F[6] == 1)' inputfile.txt

 

HTH,

 

j

 

 

 

________________________________

From: Dhundy Kiran Bastola [mailto:dkbastola at mail.unomaha.edu] 
Sent: Tuesday, January 12, 2010 5:43 AM
To: Jay Hannah
Subject: Re: 874

 


The file has too many rows for xls to open :) 
How do I do the following? 

I have 7 column in a row 
A file has say millions of rows 
I would like to do a grep, based on the content of 6th or 7th column. 
e.g. say the 7th column has either a 0 or 1 
I would like to grep those rows that has a value of 1 
====================================
Dhundy (Kiran) Bastola, Ph.D.
Assistant Professor, Bioinformatics
Department of Computer Science
College of Information Science and Technology
Peter Kiewit Institute # 177D
University of Nebraska, Omaha, NE 68182

Phone: (402) 554-4899
Fax   :  (402) 554-3284
email : dkbastola at mail.unomaha.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.pm.org/pipermail/omaha-pm/attachments/20100112/91bc021f/attachment.html>

From jay at jays.net  Tue Jan 12 15:26:04 2010
From: jay at jays.net (Jay Hannah)
Date: Tue, 12 Jan 2010 17:26:04 -0600
Subject: [Omaha.pm] Next mtg: Tue Jan 12, 7pm: PLT-Scheme mini hackathon
In-Reply-To: <2E3EAEC7-A80C-4D06-8619-AEFA6FBE52E2@jays.net>
References: <B1B4AE76-96D2-405F-8C72-5DF0D303791A@jays.net>
	<2E3EAEC7-A80C-4D06-8619-AEFA6FBE52E2@jays.net>
Message-ID: <70CC8448-EF8F-4E12-A81C-881F02FC8400@jays.net>

Pizza pick up at 6:20, should have the room open by 6:40.

mmmm... Mama's Pizza...

j



From jay at jays.net  Wed Jan 13 03:00:33 2010
From: jay at jays.net (Jay Hannah)
Date: Wed, 13 Jan 2010 05:00:33 -0600
Subject: [Omaha.pm] New challenge: check the check
Message-ID: <906BEA77-64E7-440E-A812-8FFCEAC02FAC@jays.net>

From our meeting last night. Several of us started hacking on Ruby.

   http://github.com/jhannah/odynug
      check_the_check

I got the classes and Board class flushed out a little. Bishop.rb has a basic search routine in it.

Send me your github.com username and I'll add you as a repository collaborator.  :)

j





From netarttodd at gmail.com  Wed Jan 13 07:58:32 2010
From: netarttodd at gmail.com (Todd Christopher Hamilton)
Date: Wed, 13 Jan 2010 09:58:32 -0600
Subject: [Omaha.pm] PerlTidy and Critic for other languages
Message-ID: <4B4DEDA8.9000008@Gmail.com>

I would like to get/use/write a program that works like perlTidy and 
PerlCritic but for for other languages.  Has anyone written one before? 
  Do you have any advise?  I use this obscure language called Arden 
Syntax.  It is used in health care.

-- 
Todd Hamilton
(402) 881-0438

From evaddnomaid at gmail.com  Wed Jan 13 09:05:39 2010
From: evaddnomaid at gmail.com (Dave Burchell)
Date: Wed, 13 Jan 2010 11:05:39 -0600
Subject: [Omaha.pm] PerlTidy and Critic for other languages
In-Reply-To: <4B4DEDA8.9000008@Gmail.com>
References: <4B4DEDA8.9000008@Gmail.com>
Message-ID: <6e25cf311001130905u6c7aa819v69e4faee769c177b@mail.gmail.com>

Hmmm... Lex and yacc?

On Wed, Jan 13, 2010 at 9:58 AM, Todd Christopher Hamilton <
netarttodd at gmail.com> wrote:

> I would like to get/use/write a program that works like perlTidy and
> PerlCritic but for for other languages.  Has anyone written one before?  Do
> you have any advise?  I use this obscure language called Arden Syntax.  It
> is used in health care.
>
> --
> Todd Hamilton
> (402) 881-0438
> _______________________________________________
> Omaha-pm mailing list
> Omaha-pm at pm.org
> http://mail.pm.org/mailman/listinfo/omaha-pm
>



-- 
Dave Burchell
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.pm.org/pipermail/omaha-pm/attachments/20100113/2740caa1/attachment.html>

From netarttodd at gmail.com  Fri Jan 22 14:50:53 2010
From: netarttodd at gmail.com (Todd Christopher Hamilton)
Date: Fri, 22 Jan 2010 16:50:53 -0600
Subject: [Omaha.pm] [olug] Command Line App Helper
In-Reply-To: <0FA613DF-2FA5-44F3-8E76-176C644FD30F@jays.net>
References: <7a714d960912172258v1bbc9d04n8c03856be4f9e249@mail.gmail.com>	<6083383B-2879-4302-9DAC-5E13DE26F266@jays.net>	<c480cccc0912180825g7f8e49cfp57ea966094c6aedf@mail.gmail.com>	<4B2FF6FF.90004@Gmail.com>
	<0FA613DF-2FA5-44F3-8E76-176C644FD30F@jays.net>
Message-ID: <4B5A2BCD.5050800@Gmail.com>

I am diving into App::Framework.  I will let you all know how it goes.



On 12/21/2009 5:01 PM, Jay Hannah wrote:
> On Dec 21, 2009, at 4:30 PM, Todd Christopher Hamilton wrote:
>> I am looking for a perl module that helps me easily create good command line applications.  Has anyone tried using any of the ones out there?
>>
>> Something like:
>>
>> App::Rad
>> App::Cmd
>
> If you're doing really complex menus, you'll probably want one of the many curses modules (http://search.cpan.org is your friend). I haven't built any big ones.
>
> j
> Omaha Perl Mongers: http://omaha.pm.org
>
> _______________________________________________
> Omaha-pm mailing list
> Omaha-pm at pm.org
> http://mail.pm.org/mailman/listinfo/omaha-pm

-- 
Todd Hamilton
(402) 881-0438

From dan at linder.org  Fri Jan 22 14:55:33 2010
From: dan at linder.org (Dan Linder)
Date: Fri, 22 Jan 2010 16:55:33 -0600
Subject: [Omaha.pm] Sanitizing user input to use in a regexp search.
Message-ID: <3e2be51001221455i5727be1eu277bf9cf6a7137e5@mail.gmail.com>

I'm working on my inherited project trying to fix the various "search"
fields that have been added over the years.  Some fields perform a
strict search for the text, others do the search but ignore case, some
allow basic ^$ regexp modifiers, others treat them as the characters
themselves.   *sigh*

Since the search string being supplied is coming straight from a text
field on a web page, I don't think I should use that text directly
inside a regexp query like this, should I:

    $mycgi = CGI->new();
    $search_string = $mycgi->param('SEARCHSTRING);
    if ($data =~ /$search_string/io) {
        # Do something if we match...
    }

My understanding is that it is/might be possible to get bad data
pushed into the $search_string and cause the /regexp/ call execute it
or perform something not intended.  But if I

Or am I/we being overly cautious?  I've tried stuffing a number of bad
things into the field and they don't seem to have any bad effect.

Thanks,
Dan

-- 
***************** ************* *********** ******* ***** *** **
"Quis custodiet ipsos custodes?"
    (Who can watch the watchmen?)
    -- from the Satires of Juvenal
"I do not fear computers, I fear the lack of them."
    -- Isaac Asimov (Author)
** *** ***** ******* *********** ************* *****************

From sterling at hanenkamp.com  Fri Jan 22 15:23:58 2010
From: sterling at hanenkamp.com (Sterling Hanenkamp)
Date: Fri, 22 Jan 2010 17:23:58 -0600
Subject: [Omaha.pm] Sanitizing user input to use in a regexp search.
In-Reply-To: <3e2be51001221455i5727be1eu277bf9cf6a7137e5@mail.gmail.com>
References: <3e2be51001221455i5727be1eu277bf9cf6a7137e5@mail.gmail.com>
Message-ID: <c185b40e1001221523n604231fev2538a80e8dceafd3@mail.gmail.com>

On Fri, Jan 22, 2010 at 4:55 PM, Dan Linder <dan at linder.org> wrote:

> I'm working on my inherited project trying to fix the various "search"
> fields that have been added over the years.  Some fields perform a
> strict search for the text, others do the search but ignore case, some
> allow basic ^$ regexp modifiers, others treat them as the characters
> themselves.   *sigh*
>
> Since the search string being supplied is coming straight from a text
> field on a web page, I don't think I should use that text directly
> inside a regexp query like this, should I:
>
>    $mycgi = CGI->new();
>    $search_string = $mycgi->param('SEARCHSTRING);
>    if ($data =~ /$search_string/io) {
>        # Do something if we match...
>    }
>
> My understanding is that it is/might be possible to get bad data
> pushed into the $search_string and cause the /regexp/ call execute it
> or perform something not intended.  But if I
>
> Or am I/we being overly cautious?  I've tried stuffing a number of bad
> things into the field and they don't seem to have any bad effect.
>

You are definitely not being overcautious. Try searching for:

(?{open FH,"/etc/passwd";local $/;print <FH>})

I'd recommend running anything through quotemeta() before using it in your
regexp.


>
> Thanks,
> Dan
>
> --
> ***************** ************* *********** ******* ***** *** **
> "Quis custodiet ipsos custodes?"
>    (Who can watch the watchmen?)
>    -- from the Satires of Juvenal
> "I do not fear computers, I fear the lack of them."
>    -- Isaac Asimov (Author)
> ** *** ***** ******* *********** ************* *****************
> _______________________________________________
> Omaha-pm mailing list
> Omaha-pm at pm.org
> http://mail.pm.org/mailman/listinfo/omaha-pm
>



-- 
Andrew Sterling Hanenkamp
sterling at hanenkamp.com
785.370.4454
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.pm.org/pipermail/omaha-pm/attachments/20100122/ce46dbdb/attachment.html>

From jay at jays.net  Fri Jan 22 16:58:02 2010
From: jay at jays.net (Jay Hannah)
Date: Fri, 22 Jan 2010 18:58:02 -0600
Subject: [Omaha.pm] Sanitizing user input to use in a regexp search.
In-Reply-To: <c185b40e1001221523n604231fev2538a80e8dceafd3@mail.gmail.com>
References: <3e2be51001221455i5727be1eu277bf9cf6a7137e5@mail.gmail.com>
	<c185b40e1001221523n604231fev2538a80e8dceafd3@mail.gmail.com>
Message-ID: <4B5A499A.4030501@jays.net>

On 1/22/2010 5:23 PM, Sterling Hanenkamp wrote:
> On Fri, Jan 22, 2010 at 4:55 PM, Dan Linder <dan at linder.orgwrote:
>         $mycgi = CGI->new();
>         $search_string = $mycgi->param('SEARCHSTRING);
>         if ($data =~ /$search_string/io) {
>             # Do something if we match...
>         }
>
>     My understanding is that it is/might be possible to get bad data
>     pushed into the $search_string and cause the /regexp/ call execute it
>     or perform something not intended.  But if I
>
>     Or am I/we being overly cautious?  I've tried stuffing a number of bad
>     things into the field and they don't seem to have any bad effect.
>
> You are definitely not being overcautious. Try searching for:
>
> (?{open FH,"/etc/passwd";local $/;print <FH>})
>
> I'd recommend running anything through quotemeta() before using it in
> your regexp.

I like the quotemeta() suggestion. I wonder if that's foolproof.

I can't get the exploit to run. I keep getting this:

    Eval-group not allowed at runtime, use re 'eval' in regex m/(?{open 
FH,"/etc/passwd";local $/;print <FH>})/ at j.pl line 6.

I guess that makes me a bad cracker.  :)

Does taint mode help here? It's one of those things I should probably 
use/learn, but never have:

    http://perldoc.perl.org/perlsec.html#Taint-mode

If people are only supposed to be able to search for alphanumerics, you 
could filter their input.

    $search_string = $mycgi->param('SEARCHSTRING);
    $search_string =~ s/\W//g;

or be more specific/lenient...

    $search_string =~ s/[^a-z0-9 ]//g;

or similar. Perhaps \Q \E makes you safe?  (perldoc perlre)

    if ($data =~ /\Q$search_string\E/io) {
         # Do something if we match...
    }

$search_string is still interpolated, but any regex fanciness is disabled.

HTH,

j


From jay at jays.net  Fri Jan 22 16:58:55 2010
From: jay at jays.net (Jay Hannah)
Date: Fri, 22 Jan 2010 18:58:55 -0600
Subject: [Omaha.pm] [olug] Command Line App Helper
In-Reply-To: <4B5A2BCD.5050800@Gmail.com>
References: <7a714d960912172258v1bbc9d04n8c03856be4f9e249@mail.gmail.com>	<6083383B-2879-4302-9DAC-5E13DE26F266@jays.net>	<c480cccc0912180825g7f8e49cfp57ea966094c6aedf@mail.gmail.com>	<4B2FF6FF.90004@Gmail.com>	<0FA613DF-2FA5-44F3-8E76-176C644FD30F@jays.net>
	<4B5A2BCD.5050800@Gmail.com>
Message-ID: <4B5A49CF.6080604@jays.net>

On 1/22/2010 4:50 PM, Todd Christopher Hamilton wrote:
> I am diving into App::Framework.  I will let you all know how it goes.

You should present it at an upcoming meeting! -nudge, nudge-   :)

j

From jay at jays.net  Fri Jan 29 13:50:32 2010
From: jay at jays.net (Jay Hannah)
Date: Fri, 29 Jan 2010 15:50:32 -0600
Subject: [Omaha.pm] Local Open source projects?
In-Reply-To: <1264280687.14360.69.camel@kauff-peach>
References: <1264280687.14360.69.camel@kauff-peach>
Message-ID: <CD6FE17B-EF61-428F-88E2-1404C56077C6@jays.net>

On Jan 23, 2010, at 3:04 PM, Don Kauffman wrote:
> Does any one know of any local open source projects or have an idea for
> one? I'd like to volunteer some time to a project that is GNU/Linux
> based.  Preferably coded with Java or Python although I'm flexible
> there. Just don't ask me to code with vb (ie. virus basic)! ;-)

Here's everything I know about. It's a wiki, so everyone please add more.  :)

   http://jays.net/wiki/Omaha_open_source

j