Re: PerlWarn/AxKit - insecure dependency

2002-05-29 Thread Per Einar Ellefsen

At 16:00 29.05.2002, Arnold van Kampen wrote:


>Hi
>
>I have been going through the code example on www.perl.com
>(XSP, Taglibs and Pipelines)
>
>I  noticed I get a problem with
>PerlWarn On
>PerlTaintCheck On
>in httpd.conf.
>So, when I turn PerlWarn Off and PerlTaintCheck Off it works.
>
>Main error message:
>[AxKit] [Error] Insecure dependency in eval while running with -T switch
>at /usr/lib/perl5/site_perl/5.6.1/i586-linux/Apache/AxKit/Language/XSP.pm
>line 109.

This is AxKit and not mod_perl's fault. AxKit doesn't seem to be taint 
safe. You might want to get them to change it (unlikely, it'd be a pretty 
long job :) or turn off PerlTaintCheck.

-- 
Per Einar Ellefsen
[EMAIL PROTECTED]





PerlWarn/AxKit - insecure dependency

2002-05-29 Thread Arnold van Kampen



Hi

I have been going through the code example on www.perl.com
(XSP, Taglibs and Pipelines)

I  noticed I get a problem with 
PerlWarn On
PerlTaintCheck On
in httpd.conf.
So, when I turn PerlWarn Off and PerlTaintCheck Off it works.

Main error message:
[AxKit] [Error] Insecure dependency in eval while running with -T switch
at /usr/lib/perl5/site_perl/5.6.1/i586-linux/Apache/AxKit/Language/XSP.pm
line 109.
 
For testing I used these
lynx -source localhost/axkit/weather1.xsp?zip=15206 | xmllint --format -
lynx -source localhost/axkit/weather1.xsp?zip=15206 




Arnold


I am using 
Apache 1.3.23 
mod_perl 1.26
AxKit 1.52
linux 2.4.10 i686 (SuSE) 


Below are 
- config files
- code example files
- error message


CONFIG FILES

# startup.pl

#!/usr/bin/perl

use lib qw(/usr/local/apache/lib/modperl);
#use lib qw("/home/kampen/lib/modperl");

use Apache::Constants;
use Apache::Registry;
use Apache::RegistryLoader;
use DBI;
use CGI qw(:all);


use DirHandle;
use strict;


$Apache::Registry::NameWithVirtualHost = 0;


my $rl = Apache::RegistryLoader->new;
my $dh = DirHandle->new("/usr/local/apache/perl") or die $!;

foreach my $file ($dh->read) {
next unless $file =~ /\.(pl|cgi)$/;

#print $STDOUT "pre-loading $file\n";


$rl->handler("/perl/$file","/usr/local/apache/perl/$file");
}


1;
__END__


# perl.conf

PerlRequire conf/startup.pl

PerlInitHandler Apache::Reload
PerlSetVar ReloadAll Off
PerlSetVar ReloadTouchFile /tmp/reload_modules
#PerlWarn On
#PerlTaintCheck On

PerlModule  AxKit
Alias /axkit/   /usr/local/apache/axkit/

SetHandler  perl-script
PerlHandler AxKit
   
AxDebugLevel 10
AxCacheDir  /tmp/axkit_cache
AxStackTraceOn   
AxGzipOutputOff

AxAddXSPTaglib AxKit::XSP::Util
AxAddXSPTaglib AxKit::XSP::Param
AxAddXSPTaglib MyTaglibs::WeatherTaglib

AxAddStyleMap application/x-xsp Apache::AxKit::Language::XSP
AxAddStyleMap application/x-xpathscript Apache::AxKit::Language::XPathScript
AxAddStyleMap text/xsl  Apache::AxKit::Language::Sablot





SetHandler  perl-script
PerlHandler MyTaglibs::WeatherTaglibs



SetHandler  perl-script
PerlHandler Test::Test



PerlModule  Apache::PerlSections


push @Alias, [ qw(/perl/ /usr/local/apache/perl/) ];

$Location{"/perl/"} = { SetHandler  =>  "perl-script",
PerlHandler =>  "Apache::Registry",
Options =>  "+ExecCGI",
PerlSendHeader  =>  "On",
PerlSetupEnv=>  "On"
};

$PerlSetVar = "Filter On" if Apache->module('Apache::Filter');

print STDERR Apache::PerlSections->dump;






##
CODE SAMPLES

weather1.xsp:






http://www.apache.org/1999/XSP/Core";
xmlns:util="http://apache.org/xsp/util/v1";
xmlns:param="http://axkit.org/NS/xsp/param/v1";
xmlns:weather="http://olddog.acon.nl/axkit_articles/weather/";
>

Mijn weer rapportage

  









weather.xsl:
---
http://www.w3.org/1999/XSL/Transform";
>

Hi! It's 


The weather in
,
 is
 and
F
(courtesy of The
Weather Channel).
  











as_html.xsl
---
http://www.w3.org/1999/XSL/Transform";
version="1.0">




















ERROR MESSAGE form logs


[notice] Apache/1.3.23 (Unix) AxKit/1.52 mod_perl/1.26 configured --
resuming normal operations
[notice] Accept mutex: sysvsem (Default: sysvsem)
[warn] [client 127.0.0.1] [AxKit] handler called for /axkit/weather1.xsp
[AxKit] checking if we process this resource
[AxKit] media: screen, preferred style: #default
Use of uninitialized value in join or string at
/usr/lib/perl5/site_perl/5.6.1/i586-linux/Apache/AxKit/Cache.pm line 25.
[AxKit] Cache: key = f1e3924e8ebc61f378d51b84cb5dfec0
[AxKit] getting styles and external entities from the XML
[AxKit] styles not cached - calling $provider->get_styles()
[AxKit] using XS get_styles (libxml2)
[AxKit] calling xs_get_styles_fh()
[AxKit] calling xs_get_styles_str()
[AxKit] parse_pi: href = NULL
[AxKit] parse_pi: type = application/x-xsp
[AxKit] parse_pi: href = weather.xsl
[AxKit] parse_pi: type = text/xsl
[AxKit] parse_pi: href = as_html.xsl
[AxKit] parse_pi: type = text/xsl
Use of uninitialized value in concatenation (.) or string at
/usr/lib/perl5/site_perl/5.6.1/i586-linux/Apache/AxKit/Provider.pm line
256.
Use of uninitialized value in concatenation (.) or string at
/usr/lib/perl5/site_perl/5.6