Re: [Po4a-devel] po4a against untrusted content

Hi, (sorry not to answer to Nicolas' last email, and to somehow break the thread... I deleted it by accident.) intrigeri wrote (12 Nov 2008 12:22:24 GMT) : I've tried for hours to implement Nicolas' suggestion, i.e. to forward nowrapi18n option from every module to Locale::Po4a::Common; this seems impossible to achieve, given the nested/circular dependency network that currently exists between all Locale::Po4a::* modules; implementing this would imply to have every module forward this option to any other module it is use'ing, which ends up with a quite long and ugly diff, and still, I did not manage to make it work as wanted. I've therefore chosen a far simpler solution, still based on Joey's proposed patch: the first time Locale::Po4a::Common is loaded determines whether Text::WrapI18N is used. As explained in the pod my patch adds, the one who wants to use Locale::Po4a programmatically *and* disable the use of Text::WrapI18N must write e.g. use Locale::Po4a::Common qw(nowrapi18n); use Locale::Po4a::Text; instead of: use Locale::Po4a::Text; This is far from being a perfect solution, but it is less invasive and... it works. This is implemented in the first attached patch against CVS head, namely: 0001-Common.pm-support-a-nowrapi18n-option.patch Side note: as this works around #470250, and fixes a security issue (exposed by my ikiwiki plugin use case), is it realistic to get something based on this patch into Lenny? I would happily provide the same patch against the po4a package currently in Lenny. I also implemented another of Nicolas' suggestions, i.e. to disable Text::WrapI18N use unless the module is used from a program running on an interactive terminal. This is: 0002-Common.pm-do-not-use-wrapi18n-unless-running-on-an-interactive-terminal.patch It's unfortunately not sufficient for ikiwiki needs, as ikiwiki sometimes runs on interactive terminals, e.g. when ikiwiki-mass-rebuild is invoked by dpkg in postinst. And you really don't want your dpkg upgrade to be frozen inside an infinite loop, due to weird content having been checked into whatever wiki you're hosting two months ago. That's why the first patch is needed as well. Bye, -- intrigeri <intrigeri(a)boum.org&gt; | gnupg key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | The impossible just takes a bit longer.