tseaver@digicool.com wrote:
Duncan Booth reported:
It would be very useful to have access to regular expression matching from DTML. Importing the re module into the _ namespace as is done for string, math and whrandom looks to me to be both safe and useful.
with patch:
diff -r1.61 DT_Util.py 205c205 < import string, math, whrandom ---
import string, math, whrandom, re 219a220 d['re']=re
I am reluctant to Go There -- regexp's are notoriously hard to get right, and when they go south, they often take the family silver with them.
Yes.
It would be fairly trivial to write a back-tracking regexp, even inadvertently, the execution of which would be an effective denial-of-service attack on the server.
DTML really isn't the right place for them, anyway: according to the prevailing wisdom of the zopemeisters, complicated logic belongs in Python, rather than in DTML. (However, PythonMethods won't have access to the re module either without some help)
Right. Unless someone comes up with a "safe" re, one that *cannot* cause infinate loops or core dumps, we won't expose it in through the web code. Jim -- Jim Fulton mailto:jim@digicool.com Python Powered! Technical Director (888) 344-4332 http://www.python.org Digital Creations http://www.digicool.com http://www.zope.org Under US Code Title 47, Sec.227(b)(1)(C), Sec.227(a)(2)(B) This email address may not be added to any commercial mail list with out my permission. Violation of my privacy with advertising or SPAM will result in a suit for a MINIMUM of $500 damages/incident, $1500 for repeats.