pcplantdb

[Richard Morris <webmaster@pfaf.org>]

Sean Maley wrote:

> How do you distinguish when a prankster embeds XML
> into their descriptions, thus corrupting our ability
> to feed that data using XML?  The DTD can take care of
> some things, but what happens when we see things like:
>
> <botanical_name id='1' legacy_pfaf_latin_name="">
>   <composition part_of_plant='leaf'>
>      <water type='mg'>4</water>
>      <energy type="calories">10</energy>
>   </composition>
>   <cultivars cultivar="okay place" synonyms="">
>     corrupt notes:  </cultivars></botanical_name>
>     <botanical_name id="666"
> legacy_pfaf_latin_name="">
>      <cultivars
>          cultivar="cheeches beastly stuff"
>          common_name="weed">
>   </cultivars>
> </botanical_name>
>
> Surely we won't write code to look for this stuff? 
> Base64 would resolve this, but then we aren't human
> readable anymore.  I can prevent a character like
> ASCII 0 getting into the database merely from
> Javascript.
>
> The other alternative has us certifying a data source
> by some means.  We could also put required information
> into the dataset that self identifies corrupted data. 
> For instance, a source id that has been safeguarded
> from public access.  The above example becomes flagged
> for missing this key unknowable information.
>
> Sorry for the conundrums, but this sort of concern is
> what I do in my day job (financial markets data
> feeds).  I thought the perspective would help harden
> how data transfers occur for PIW.  If I'm out of line,
> please don't be afraid to say so (thick skin is a
> requirement in my position).
Yep definitle an issue. The route I've taken on the pfaf site is to 
really restrict the data input which is allowed. I generally go buy the 
philosophy that unless it goes by some very strict rules its rejected.

Begin by allowing no XML input, only plain text, or a v small sub set
say <p> <b> <i> tags. Attached is a php script I've just done to 
validate user input.

As to adding silly data such as
        cultivar="cheeches beastly stuff"
easiest is for us to just delete stupid entries. I'm thinking of
getting all comments to pfaf site sent to my email, with a quick delete 
link which I can reply to. A bit of moderation work but the initial 
number of addition we will receive sohould not make this to big a 
burden. Smarter solutions later!

BTW hi to a new face, whats your background?

Rich

<?php

// checks to see if the tags are ok in data

function testtags($data)
{
	// first check that only allowed tags are present

	preg_match_all("|<([/]?)([\w]+)([^>]*)>|",$data,$matches);

	for ($i=0; $i< count($matches[0]); $i++) {
//		echo "matched: ".$matches[0][$i]."\n";
//		echo "part 1: ".$matches[1][$i]."\n";
//		echo "part 2: ".$matches[2][$i]."\n";
//		echo "part 3: ".$matches[3][$i]."\n\n";

		// only a b i p A B I P allowed
		if(!preg_match("/^[abipABIP]$/",$matches[2][$i])) return "Illegal tag ". $matches[2][$i];

		// nothing in closing tags
		if($matches[1][$i]=="/" && $matches[3][$i] != "") return "Malformed closing tag";

		// b i p must have no atributes
		if(!preg_match("/^[bipBIP]$/",$matches[2][$i]) && $matches[3][$i] != "")
			return "Tag " . $matches[2][$i] . " should not have atributes";

		// a tags must be <a href="http://...";> or <a href="http://...";>
		if($matches[1][$i]=="" && !preg_match("/^[bipBIP]$/",$matches[2][$i]))
		{
			if( preg_match("| href=\"http://[^\"]*\|") ||
			  preg_match("| href=\"ftp://[^\"]*\|") ||
			  preg_match("| href=\"mailto:[^\"]*\|") ) {}
			else
				return "Illegal <a> tag";
		}
	}
	return NULL;
}

function testnotags($data)
{
	// first check that only allowed tags are present

	if(preg_match("|<.*>|",$data,$matches)) return "no tags allowed";
}

function checktags($data)
{
//	print htmlspecialchars($data) . "<br>\n";
	$res = testtags($data);
//	print "res (". $res .")<br>\n";
	if(!is_null($res)) {
		print $res;
		exit;
	}
}

function checknotags($data)
{
//	print htmlspecialchars($data) . "<br>\n";
	$res = testnotags($data);
//	print "res (". $res .")<br>\n";
	if(!is_null($res)) {
		print $res;
		exit;
	}
}

?>