abcdev has asked for the wisdom of the Perl Monks concerning the following question:

We have a POE::Component::Server::TCP with a number of clients that need to send it their code for execution. Is there a way to do it better than sending strings and evaling them on receiving? We tried POE::Filter::Reference, and it does not help, or at least we can't figure how. Thank you.

Replies are listed 'Best First'.
Re: POE Filters: sending coderefs over TCP
by shmem (Chancellor) on Jan 22, 2007 at 09:35 UTC
    Sending coderefs will fail because memory addresses will most certainly not be the same. Sending code as a string and evalling it on receiving is the only way I can think of.

    You can retrieve the code from named subs or coderefs with B::Deparse:

    use B::Deparse; my $d = B::Deparse->new; # anonymous sub my $coderef = sub { print "howdy!" }; # assuming herveus ;) my $code = $d->coderef2text($coderef); # named sub, e.g. coderef2text from B::Deparse $code = $d->coderef2text(\&B::Deparse::coderef2text);

    --shmem

    _($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                                  /\_¯/(q    /
    ----------------------------  \__(m.====·.(_("always off the crowd"))."·
    ");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}
Re: POE Filters: sending coderefs over TCP
by merlyn (Sage) on Jan 22, 2007 at 13:11 UTC
    perldoc Storable says:
    CODE REFERENCES Since Storable version 2.05, CODE references may be seri- alized with the help of B::Deparse. To enable this fea- ture, set $Storable::Deparse to a true value. To enable deserializazion, $Storable::Eval should be set to a true value. Be aware that deserialization is done through "eval", which is dangerous if the Storable file contains malicious data. You can set $Storable::Eval to a subrou- tine reference which would be used instead of "eval". See below for an example using a Safe compartment for deseri- alization of CODE references. If $Storable::Deparse and/or $Storable::Eval are set to false values, then the value of $Storable::forgive_me (see below) is respected while serializing and deserializing.
    Perhaps you need to set that correctly on both ends, when using POE::Filter::Reference with Storable.
Re: POE Filters: sending coderefs over TCP
by rinceWind (Monsignor) on Jan 22, 2007 at 13:19 UTC

    I'm curious about your application. Do you want your client to be able to run any arbitrary piece of Perl code? Is this wise? Apart from the security risks if your client is compromised, how would you intend to debug code running on the server?

    Granted you could run in safe mode, and restrict anything dangerous, but a better approach might be straightforward RPC; any code you need to run would already exist server side, you merely do method calls to it via a proxy object. This would make developing and testing it a whole site easier.

    --

    Oh Lord, won’t you burn me a Knoppix CD ?
    My friends all rate Windows, I must disagree.
    Your powers of persuasion will set them all free,
    So oh Lord, won’t you burn me a Knoppix CD ?
    (Missquoting Janis Joplin)