Skip to Content.
Sympa Menu

pcplantdb - Re: [pcplantdb] status

pcplantdb@lists.ibiblio.org

Subject: pcplantdb

List archive

Chronological Thread  
  • From: Richard Morris <webmaster@pfaf.org>
  • To: Permaculture Plant Database <pcplantdb@lists.ibiblio.org>
  • Subject: Re: [pcplantdb] status
  • Date: Thu, 27 Jan 2005 01:24:17 +0000

Sean Maley wrote:

How do you distinguish when a prankster embeds XML
into their descriptions, thus corrupting our ability
to feed that data using XML? The DTD can take care of
some things, but what happens when we see things like:

<botanical_name id='1' legacy_pfaf_latin_name="">
<composition part_of_plant='leaf'>
<water type='mg'>4</water>
<energy type="calories">10</energy>
</composition>
<cultivars cultivar="okay place" synonyms="">
corrupt notes: </cultivars></botanical_name>
<botanical_name id="666"
legacy_pfaf_latin_name="">
<cultivars
cultivar="cheeches beastly stuff"
common_name="weed">
</cultivars>
</botanical_name>

Surely we won't write code to look for this stuff? Base64 would resolve this, but then we aren't human
readable anymore. I can prevent a character like
ASCII 0 getting into the database merely from
Javascript.

The other alternative has us certifying a data source
by some means. We could also put required information
into the dataset that self identifies corrupted data. For instance, a source id that has been safeguarded
from public access. The above example becomes flagged
for missing this key unknowable information.

Sorry for the conundrums, but this sort of concern is
what I do in my day job (financial markets data
feeds). I thought the perspective would help harden
how data transfers occur for PIW. If I'm out of line,
please don't be afraid to say so (thick skin is a
requirement in my position).

Yep definitle an issue. The route I've taken on the pfaf site is to really restrict the data input which is allowed. I generally go buy the philosophy that unless it goes by some very strict rules its rejected.

Begin by allowing no XML input, only plain text, or a v small sub set
say <p> <b> <i> tags. Attached is a php script I've just done to validate user input.

As to adding silly data such as
cultivar="cheeches beastly stuff"
easiest is for us to just delete stupid entries. I'm thinking of
getting all comments to pfaf site sent to my email, with a quick delete link which I can reply to. A bit of moderation work but the initial number of addition we will receive sohould not make this to big a burden. Smarter solutions later!

BTW hi to a new face, whats your background?

Rich

<?php

// checks to see if the tags are ok in data

function testtags($data)
{
	// first check that only allowed tags are present

	preg_match_all("|<([/]?)([\w]+)([^>]*)>|",$data,$matches);

	for ($i=0; $i< count($matches[0]); $i++) {
//		echo "matched: ".$matches[0][$i]."\n";
//		echo "part 1: ".$matches[1][$i]."\n";
//		echo "part 2: ".$matches[2][$i]."\n";
//		echo "part 3: ".$matches[3][$i]."\n\n";

		// only a b i p A B I P allowed
		if(!preg_match("/^[abipABIP]$/",$matches[2][$i])) return "Illegal tag ". $matches[2][$i];

		// nothing in closing tags
		if($matches[1][$i]=="/" && $matches[3][$i] != "") return "Malformed closing tag";

		// b i p must have no atributes
		if(!preg_match("/^[bipBIP]$/",$matches[2][$i]) && $matches[3][$i] != "")
			return "Tag " . $matches[2][$i] . " should not have atributes";

		// a tags must be <a href="http://...";> or <a href="http://...";>
		if($matches[1][$i]=="" && !preg_match("/^[bipBIP]$/",$matches[2][$i]))
		{
			if( preg_match("| href=\"http://[^\"]*\|") ||
			  preg_match("| href=\"ftp://[^\"]*\|") ||
			  preg_match("| href=\"mailto:[^\"]*\|") ) {}
			else
				return "Illegal <a> tag";
		}
	}
	return NULL;
}

function testnotags($data)
{
	// first check that only allowed tags are present

	if(preg_match("|<.*>|",$data,$matches)) return "no tags allowed";
}

function checktags($data)
{
//	print htmlspecialchars($data) . "<br>\n";
	$res = testtags($data);
//	print "res (". $res .")<br>\n";
	if(!is_null($res)) {
		print $res;
		exit;
	}
}

function checknotags($data)
{
//	print htmlspecialchars($data) . "<br>\n";
	$res = testnotags($data);
//	print "res (". $res .")<br>\n";
	if(!is_null($res)) {
		print $res;
		exit;
	}
}

?>



Archive powered by MHonArc 2.6.24.

Top of Page