ton has asked for the wisdom of the Perl Monks concerning the following question:

Fellow Monks,

I recently read through Jeffery Goff's excellent Parse::RecDescent tutorial. This inspired me to write my own context free grammar to parse the results of Data::Dumper, as eval-ing the structure is a huge security hole.

I've got everything working except for escaped character interpolation on double-quoted strings (e.g. "\t", "\n"). In other words, I want to be able to convert the string '\t' into ASCII 9. Is there an easy way to do this other than writing regexs for every escape I want to catch? Please note that I do not want to use eval, as this would just reintroduce the security hole. I also do not want to do any kind of variable expansion.

Thanks!

-Ton

BTW: I realize that Data::Dumper dumps its strings in single quote mode. The interpolation is solely for completeness. :)

-----
Be bloody, bold, and resolute; laugh to scorn
The power of man...

Replies are listed 'Best First'.
Re: Selective string interpolation
by japhy (Canon) on Jun 29, 2001 at 03:48 UTC
    You could try something like: 
    $string =~ s/(?<!\\)((?:\\\\)*)([\$\@])/$1\\$2/g;
$string = eval qq{
<< "I KNOW THIS STRING IS NOT IN THERE"
$string
I KNOW THIS STRING IS NOT IN THERE
};

    [download]


    japhy -- Perl and Regex Hacker
[reply]
[d/l]
Re: Selective string interpolation
by tadman (Prior) on Jun 29, 2001 at 03:46 UTC
    This is a bit tricky because there are a variety of escape types to handle. In particular, there are the "regular" codes like '\n' which translate into a single character, but there are also others.
    1. '\cX' is the equivalent of CTRL-X, where X is a letter from a to z, or also a few others in the nearby ASCII space (such as ESC).
    2. '\xNN' is the ASCII character hexidecimal 0xNN.
    3. '\0nnn' is the ASCII character octal nnn.
    You could build a regex to handle these, perhaps, such as: 
    my %escape = map { ( chr($_) => eval '"\\'.chr($_).'"'||undef ) } 0 ..
+ 127;

sub interpolate
{
        my ($s) = @_;

        $s =~ s/\\c(.)/chr(ord(lc($1))-ord('`'))/ge;
        $s =~ s/\\x([a-fA-F0-9]{2})/chr(hex($1))/ge;
        $s =~ s/\\0([0-9]{1,3})/chr(oct($1))/ge;
        $s =~ s/\\0/\0/g;

        $s =~ s/\\(.)/$escape{$1}/gs;

        return $s;
}

    [download]
[reply]
[d/l]
Re: Selective string interpolation
by ton (Friar) on Jun 29, 2001 at 05:02 UTC
    I've posted my current code at Undumper. Any other feedback is much appreciated.

    -Ton
    -----
    Be bloody, bold, and resolute; laugh to scorn
    The power of man...

[reply]
      You're not handling blessed items yet, and there's a much simpler way to write "listy" things.

      I'll take your inspiration and generate a version for a Linux Magazine article, crediting you... how do you want to be listed?

      -- Randal L. Schwartz, Perl hacker

[reply]

Back to Seekers of Perl Wisdom