Popcorn Dave has asked for the wisdom of the Perl Monks concerning the following question:

Fellow monks I come to you with yet another question...

I am close to finishing a Perl/Tk program to test regexes that lets the user enter a regex, the text they want to fiddle with, then prints out the result. Regex options are handled via checkboxes so that they can mix and match to see what happens.

My problem is getting the user built regex to actually evaluate. I've tried using eval with {}, "", '' and nothing at all, but to no avail.

Here's the code I'm playng with at present: 

sub do_it{
    $regex .= $options;
    my $blah = $user_text;
    eval{$user_text =~ $regex};
    print "User text: $user_text\n";
    }

[download]

The $options is built from the check boxes. But $user_text is never getting changed- e.g. $regex=s/e/y/ $user_text=there - still sends $user_text back as there, not thyre.

Can someone please throw some light on this and point me in a direction to solve this?

Thanks!

Replies are listed 'Best First'.
Re: Question on evaulating a user built regex
by erikharrison (Deacon) on Apr 22, 2002 at 15:57 UTC

    What you need to do is place the regex inside the m// operator, then print the match. If you are trying a substitution, then use the s// operator. Eval is unnecesarry.

    $user_text =~ m/$user_regex/;
print $&;

    [download]
    Cheers,
    Erik
[reply]
[d/l]
      I'm letting the user build the expression, including the regex operator so I need a way for the string to be evaluated at runtime as a regex.
[reply]
        Then you'll want eval "\$user_text =~ $regex".

        =cut
        --Brent Dax
        There is no sig.

[reply]
[d/l]
Re: Question on evaulating a user built regex
by perlplexer (Hermit) on Apr 22, 2002 at 16:33 UTC
    If you use "" with eval, make sure you escape the $ in '$user_text'; otherwise, it'll be interpolated into a constant string. 
    sub do_it{
  #...
  eval "\$user_text =~ $regex";
  if (length $@){
    print "Error : $@";
  }else{
    print "User text: $user_text\n"
  }
  #...

    [download]

    --perlplexer
[reply]
[d/l]
Re: Question on evaulating a user built regex
by Stegalex (Chaplain) on Apr 22, 2002 at 19:57 UTC
    You need to compile the first argument of your regexp with the qr// operator. I like chicken.
[reply]
Re: Question on evaluating a user built regex
by Sweeper (Pilgrim) on Apr 23, 2002 at 05:50 UTC
    Security Hazard!

    Are you sure you want to evaluate a user regexp? The user can insert a (?{...}) construct to include some Perl executable code, which can in turn include a call to system, or backticks, which can contain very bad things.

    And there is more than one way to do nasty things. The user can write a Denial-of-Service regexp, a regexp which backtracks a lot and locks your machine. See Mastering Regular Expressions page 140+ (the book with two owls on the cover)

    Update

    Yes, Perlplexer, you are right. The security hazards are mostly irrelevant in a Perl/Tk program. Yet, my warning still holds for any monk who would use the answers in this thread for a CGI program (or any client-server app for that matter).

[reply]
      He is using Tk...
      If the user of that Tk app so desires, he can surely lock up his own PC... but who cares? ;)

      --perlplexer
[reply]

Back to Seekers of Perl Wisdom