[Zope] re module & through the web security

[Chris McDonough]

If you're concerned about the availability of various modules within
PythonMethods, you should participate in the PythonMethods project wiki,
probably at the page
http://dev.zope.org/Wikis/DevSite/Projects/PythonMethods/CurrentIssues.

> -----Original Message-----
> From: Dan L. Pierson [mailto:dan@sol.control.com]
> Sent: Wednesday, September 06, 2000 10:14 AM
> To: Chris Withers
> Cc: Chris McDonough; T.J. Mannos; Marcus Mendes; zope@zope.org
> Subject: Re: [Zope] re module & through the web security
> 
> 
> Chris Withers writes:
>  > Chris McDonough wrote:
>  > > There's the perception at DC that
>  > > 're' isn't appropriate for through-the-web usage because 
> it's possible to
>  > > write and use regex that sends the Python interpreter thread it's
>  > > operating within into a neverending loop.  Sorry.
> 
> [snip]
> 
>  > It seems like that perception is hobbling Python Methods, 
> in particular,
>  > by removing useful stuff like the re module because the 
> assumption is
>  > being made that people editing TTW code will be untrusted.
> 
> I think the re module is a good example for arguing that DTML and
> Python Methods should have different criteria for deciding what
> modules are available (and separate permissions for users, if they
> don't already).
> 
> Somehow, the idea of mixing regexps and DTML gives me chills, but I
> agree that it is a perfectly reasonable tool to want to use 
> in Python Methods.
> This relates more the crusade to depricate DTML programming 
> as opposed 
> to DTML report writing than it does to security concerns.
> 
> _______________________________________________
> Zope maillist  -  Zope@zope.org
> http://lists.zope.org/mailman/listinfo/zope
> **   No cross posts or HTML encoding!  **
> (Related lists - 
>  http://lists.zope.org/mailman/listinfo/zope-announce
>  http://lists.zope.org/mailman/listinfo/zope-dev )
>