Re^4: Passing a regex from a CGI HTML form (user supplied regex substitution without eval)

You gotta have a canned solution for ignorant newbees and impatient veterans

Its not like it takes long to DIY-up a little safety, I typed up the above in preview box, now tested, with own Turpolate

use String::Interpolate::RE qw( strinterp );
print Substitution("BellyAche\n", '([a-z])([A-Z])', '$1    $2', '');
print Substitution("BellyAche\n", '([a-z])([A-Z])', '$1    $2', 'g');
sub Substitution {
    my( $in, $re, $rep, $flags ) = @_;
    my $global  =  $flags =~ m{g}i;
    my $qrFlags =  join '', $flags =~ m{([msixpodualn])}i;
    $qrFlags = "(?$qrFlags)";
    $re = qr{$qrFlags$re};
    if( $global ){
         $in =~ s{$re}{
           Replace($rep, \%+,{1=>$1,2=>$2,3=>$3});
         }gex;
    } else {
         $in =~ s{$re}{
           my $vars = {
               %+, 1=>$1, 2=>$2, 3=>$3,
           };
           Turpolate( $rep, $vars );
         }ex;
    }
    return $in;
}
sub Turpolate {
    my( $str, $vars ) = @_;
    $str =~ s{\$(\w+)}{
        exists $vars->{$1}
        ? $vars->{$1}
        : '$'.$1
    }gex;
    return $str;
}
sub Replace {
    my( $rep, $named, $numed ) = @_;
    my $vars = { %$named, %$numed, 'bananas','bananas' };
    return strinterp( $rep, $vars );
}
__END__
Belly    Ache
Belly    Ache
[download]

Comment on Re^4: Passing a regex from a CGI HTML form (user supplied regex substitution without eval) Download Code

Replies are listed 'Best First'.
Re^5: Passing a regex from a CGI HTML form (user supplied regex substitution without eval) by trippledubs (Deacon) on Sep 01, 2016 at 04:37 UTC
print Substitution("canned","working"); #canned print Substitution("canned","compiles",'$1 $2','g'); #canned print Substitution("canned","flawed",'$1 $2'); #canned print Substitution("canned",".",`ls`); #first directory entry `touch down`; print Substitution("canned",".",`rm down`); #deleted file [download]	[reply] [d/l]
Re^6: Passing a regex from a CGI HTML form (user supplied regex substitution without eval) by Anonymous Monk on Sep 01, 2016 at 06:51 UTC
Heheh, what do you think that proves?	[reply]
Re^7: Passing a regex from a CGI HTML form (user supplied regex substitution without eval) by trippledubs (Deacon) on Sep 01, 2016 at 12:04 UTC
lol at first I was really excited, but no you are right it doesn't prove anything because $rep has to be a string. But there should be a way to do what I'm trying else the module authors and yourself would not couch your words!	[reply]
Re^8: Passing a regex from a CGI HTML form (user supplied regex substitution without eval) by Anonymous Monk on Sep 01, 2016 at 19:14 UTC