Ah, well, after a five hours of experimentation I thought up a working
workaround anyway.

This works with an unpatched version of mp1 ($substr is any perl code 
fetched from external source):

      my(@ops) = split(/\x0a/,$substr);
      my($cell,$reval);

      foreach $cell (@ops)
      {
        $cell =~ s/^[\x09\ ]+//g;
        $cell =~ s/^print\ /\$output\ \.\=\ /;
        if($cell)
        {
          $reval .= $cell . "\n";
        }
      }

      my($output);

      $reval .= "\$output;\n";

      my($compartment) = new Safe("Tempo");
      $compartment->permit(qw(:browse));
      $output = $compartment->reval($reval);
      if($@)
      {
        $self->{ERROR} = gettext("Security exception: " . $@);
        $self->{ERRORCODE} = 99;
      }

      print $output;

I just replace all print statements with "$output .= ", and then make 
sure that the reval results in the final contents of $output, which I then 
print outside the reval().

Works fine now. So far nothing else has crashed, although I'm somewhat
suspicious of a number of rather random events in the code. I'm almost
certain this is me having messed up something else though.

However, if I'm not supposed to use Safe in conjunction with mp, what *am* 
I supposed to use? 

I might be possible to convince to write a version of Safe specifically
for mp1, although I expect I shall have to experience more problems with
the existing Safe code to be bothered. :-)

  // Joel


On Thu, 24 Jul 2003, Stas Bekman wrote:

> Joel, I have reproduced the segfault using your test script.
> 
> It's handy to have p5p people sitting next to you. Just asked this question 
> Tim Bunce, and he replied:
> 
>    "Safe is a failed experiment. It works only for several cases. TIEHANDLE is
>    not one of them [print under mod_perl uses a tied STDOUT]. Do not use it if
>    it doesn't work for you."
> 
> I'm supposed to ask Dan Sugalsky whether perl6 will have this functionality 
> designed from the ground up.
> 
> We could prevent the segfault in mod_perl, but you still won't be able to use 
> Safe under it. So IMHO it's not worth the slowdown to do extra checks.
> 
> Should probably add it to the troubleshooting section.
> 
> __________________________________________________________________
> Stas Bekman            JAm_pH ------> Just Another mod_perl Hacker
> http://stason.org/     mod_perl Guide ---> http://perl.apache.org
> mailto:[EMAIL PROTECTED] http://use.perl.org http://apacheweek.com
> http://modperlbook.org http://apache.org   http://ticketmaster.com
> 
> 

Reply via email to