🌐 Mailman 3 September 2000 - Python-list - python.org

filtering out "bad" regular expressions from user input
by Skip Montanaro Sept. 30, 2000

Sept. 30, 2000

We allow users to input regular expressions to our search engine. Problem is, when (and they inevitably do, so it's not "if") they input a bad regular expression, it sends the backend search engine into a tizzy (backend is MySQL, frontend is Python). For example, "^" will cause it to match everything, as will "^.*$", "" and ".*". Currently, I'm filtering out a small set of known bad inputs using simple string comparison: '^' '$' '.' '|' '' '[]' '[.]' '.*' '.+' '^.+$' '^.*$' Of course, that leaves out '^.*.*$', '^.* .*$', '.+.*' and '.*|.*', to name but a few. I'm looking for a better approach to filtering out bad regular expressions. I realize determining if a regular expression will run for a long time is similar (or equivalent) to the halting problem and largely depends on the context in which it is applied, but there must be a better way to reduce the odds of allowing bad input through to a suitably small value than simply looking for a small set of easy-to-guess cases. I could simply disallow any searches that contain '.*' or '.+', but there's always '[A-Z0-9a-z ]*' and more, and I don't want to simply eliminate patterns containing "*" or "+", because that would pretty much eviscerate the capability. Any thoughts? -- Skip Montanaro (skip(a)mojam.com) http://www.mojam.com/ http://www.musi-cal.com/

3 2

Re: PEP: Adding new operators for elementwise/objectwise operations
by gareth_rees＠my-deja.com Sept. 30, 2000

Sept. 30, 2000

hzhu(a)users.sourceforge.net wrote: > This is a Python Extension Proposal for introducing operators for > distinguishing between elementwise and objectwise operations. I think that it would be a bad idea if this proposal were adopted. This proposal achieves only a small advantage for a small subset of users of Python: + greater readability of algebraic operations on vectors and matrices while introducing disadvantages and risks for all users of Python: - increased complexity of language implementation means greater risk of defects - increased complexity of language definition makes it harder to learn and harder to document - increased size of Python core makes it less suitable for embedding Python's simplicity and robustness are among the features that make it attractive to many of its users. I think that extensions that make Python more complex and less robust should be considered very seriously before being adopted. Python's module system allows extensions like this to be developed without affecting people who don't use the extensions. -- Gareth Rees Sent via Deja.com http://www.deja.com/ Before you buy.

4 5

Re: numerical python
by Travis Oliphant Sept. 30, 2000

Sept. 30, 2000

> More specifically I need to store objects and use their elements in large > matrix calculations. I don't really want to go loading a matrix each time I > need to use one. The two possibilities I thought of was storing just the > references to the object elements within the matricies(so I can keep them all > in memory), or instead using matrix stacks, keeping track of them, an if > necessary, comiiting them to a database in case of failure somewhere or memory > problems. How does numerical python best handle large matricies? > Numerical Python uses references to matrix regions, so you could store all of your matrices into one big 3-D array and use indexing to access the "slice" of interest. The thing to watch out for with large matrices is "slient upcasting" from single precision to double precision because python scalars are interpreted as double precision objects. Copying large chunks of data (especially if it means swapping to disk) will slow you down. If you steer clear of such things, Numeric Python is very fast. -Travis

2 1

application serving? (zope/corba/mod_python/webware/cgi)
by Nick Bower Sept. 30, 2000

Sept. 30, 2000

i'm trying to learn a little about using python for web applications, and have come across various ways to do it. my very basic understanding is that mod_python/webware are server-side incude type things (all fine there), but then someone told me that embedding a persistent interpretter like this is a fairly fickle way of operating, and a full corba implementation is more robust. can someone explain the difference to me? and where zope fits into this scheme? perhaps someone could reccommend some reading on this area - the ways of executing code from the web seem to be very fundamentally different.

3 2

Re: filtering out "bad" regular expressions from user input
by Andrew Dalke Sept. 30, 2000

Sept. 30, 2000

Skip: > Andrew> The time slowdown occurs for backtracking, especially if there are > Andrew> multiple levels of backtracking. > >As usual, I specified the problem incompletely. The problem isn't so much >regular expressions that perform poorly when matched against particular >strings. It is that some very simple regular expressions (like ".*") can >match all (or almost all) records in a database of 20,000 or so rows. And I also read something different than what you posted. :) I had been thinking about the problem of how to protect a server from what I guess I'll call "pathological regexp attacks", where the regexp takes exponential time to match and so acts as a denial of service attack. You post had enough similarities to what I had been worried about that I thought that that's what you were talking about. Andrew dalke(a)acm.org

1 0

Re: Sum of the Least Squares
by Gene C Sept. 30, 2000

Sept. 30, 2000

I'm into code reuse. :-)

1 0

Disadvatages of using Python.
by Steve Juranich Sept. 30, 2000

Sept. 30, 2000

I was recently talking with one of my professors who has also recently become one of the Pythonistas. He told me that the one thing he didn't like about using Python is that he didn't get to curse as much. I just thought I'd share. ---------------------------------------------------------------------- Stephen W. Juranich sjuranic(a)ee.washington.edu Electrical Engineering http://students.washington.edu/sjuranic University of Washington http://rcs.ee.washington.edu/ssli

6 5

IPC9: Call for Tutorials
by Garry Hodgson Sept. 30, 2000

Sept. 30, 2000

We're still looking for people to give tutorials at next year's Python conference. We've gotten several submissions, but the more, the merrier. For details on what we're looking for, and what to submit, see: http://www.python9.org/p9-call-tutorials.html If you have questions, please contact me directly. -- Garry Hodgson Once in a while Senior Hacker you can get shown the light Software Innovation Services in the strangest of places AT&T Labs if you look at it right

1 0

Re: very good reasons?
by Janko Hauser Sept. 30, 2000

Sept. 30, 2000

Hope that this is a joke, but form the wonderful lesson just learned, this would be >>> a=[2,3,1] >>> for i in a.sort() or a: ... print i ... 1 2 3 >>> IMHO this is a real python idiom, like the 'while 1: ... break' thing. __Janko -- Institut fuer Meereskunde phone: 49-431-597 3989 Dept. Theoretical Oceanography fax : 49-431-565876 Duesternbrooker Weg 20 email: jhauser(a)ifm.uni-kiel.de 24105 Kiel, Germany

1 1

[ANNOUNCE] Webware for Python 0.4
by echuck3＠my-deja.com Sept. 30, 2000

Sept. 30, 2000

Webware provides a suite of Python components for developing web applications. You get an app server, servlets, CGI wrapper, Python Server Pages (PSP) and more. Home: http://webware.sourceforge.net/ Download: http://download.sourceforge.net/Webware/Webware-0.4.tar.gz Docs: http://webware.sourceforge.net/Webware/Documentation/Webware.html Discuss: webware-discuss(a)lists.sourceforge.net Highlights: * Webware has found use in the real world resulting in plenty of excellent feedback, refinements and bugfixes. * There is a new installation script that, among other things, generates HTML class hierarchies, file summaries and syntax-highlighted source as part of the documentation. * More integration with other web technologies like mod_python, PyWX/AOLserver, etc. * Better behavior on Windows with no known Windows problems. * MiscUtils has been expanded on, and documented for the first time. * A comprehensive installation guide for WebKit. * Various improvements to both WebKit and PSP as documented in their release notes. http://webware.sourceforge.net/ Sent via Deja.com http://www.deja.com/ Before you buy.

2 2