ANNOUNCE; Try python beta

[Mike Meyer]

Ok, I've given it the interface I want, and made it less of an
attractive nuisance.

http://www.mired.org/home/mwm/try_python/ is now ready for people to
play with. There's no tutorial information on it yet, that's the next
thing to do. However, I won't be able to work on it for a while, so if
you want to make suggestions about what that should look like, all
such suggestions will be given proper consideration.

<mike
--
Mike Meyer <mwm@mired.or g> http://www.mired.org/home/mwm/
Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information.

[Lonnie Princehouse]

Re: ANNOUNCE; Try python beta

Pretty neat =)

But aren't you concerned about security? Letting anybody execute
arbitrary Python expressions (and therefore also arbitrary system
commands?!) on your box --- even from within a FreeBSD jail --- seems a
bit dangerous.

[Claudio Grondi]

Re: ANNOUNCE; Try python beta

Mike Meyer wrote:[color=blue]
> Ok, I've given it the interface I want, and made it less of an
> attractive nuisance.
>
> http://www.mired.org/home/mwm/try_python/ is now ready for people to
> play with. There's no tutorial information on it yet, that's the next
> thing to do. However, I won't be able to work on it for a while, so if
> you want to make suggestions about what that should look like, all
> such suggestions will be given proper consideration.
>
> <mike[/color]

I suggest it should work like IDLE do and not remain limited to
evaluating of expressions. One can easily get the impression Python is
very limited and this is not what can help Python to show its strengths.

By the way:

The page doesn't work for me in MSIE (I am on a Windows system)[color=blue][color=green][color=darkred]
>>> 1+1[/color][/color][/color]
SyntaxError: unexpected EOF while parsing (line 1)

It does work for me in FireFox and Netscape:[color=blue][color=green][color=darkred]
>>> 1+1[/color][/color][/color]
2

but in Opera I get:[color=blue][color=green][color=darkred]
>>> 1+1[/color][/color][/color]
祓瑮硡牅潲 㩲甠敮灸捥整⁤ 佅⁆桷汩⁥ 慰獲湩⁧氨 湩⁥⤱>>>


I am most curious about the last one with no idea how it comes?

Maybe the subject of your posting should be changed to:

Try my skills in processing form requests from different Internet browser?

Claudio

[Gerhard Häring]

Re: ANNOUNCE; Try python beta

Lonnie Princehouse wrote:[color=blue]
> Pretty neat =)
>
> But aren't you concerned about security? Letting anybody execute
> arbitrary Python expressions (and therefore also arbitrary system
> commands?!) on your box --- even from within a FreeBSD jail --- seems a
> bit dangerous.[/color]

I found out about the FreeBSD jail myself, too ;-)

Removing __import__ from the builtins would make such detective work
much harder, though ;-)

-- Gerhard

[Devan L]

Re: ANNOUNCE; Try python beta

Mike Meyer wrote:[color=blue]
> Ok, I've given it the interface I want, and made it less of an
> attractive nuisance.
>
> http://www.mired.org/home/mwm/try_python/ is now ready for people to
> play with. There's no tutorial information on it yet, that's the next
> thing to do. However, I won't be able to work on it for a while, so if
> you want to make suggestions about what that should look like, all
> such suggestions will be given proper consideration.
>[/color]
I was bored so I wrote some code that takes input one line at a time
and spits out the a tuple representing the state and a message to be
echoed. It handles statements on multiple lines, too. So it might be
helpful, since your tutorial doesn't seem to handle multiple lines or
statements.

You can see it at <http://www.datamech.co m/devan/bastille.txt>

[Mike Meyer]

Re: ANNOUNCE; Try python beta

"Lonnie Princehouse" <finite.automat on@gmail.com> writes:[color=blue]
> Pretty neat =)
> But aren't you concerned about security? Letting anybody execute
> arbitrary Python expressions (and therefore also arbitrary system
> commands?!) on your box --- even from within a FreeBSD jail --- seems a
> bit dangerous.[/color]

What's there is actually more restricted than a FreeBSD jail. This one
has been tightened down to a statically linked Python interpreter, the
statically linked cgi program which does nothing but launch the Python
interpreter with the right arguments, and python library files. I've
even removed most of the latter that aren't used by the python
script. So yeah - you can run arbitrary system commands, except there
shouldn't be any.

The previous version was in a jail, which is why I didn't want it
generally announced. The logs made amusing reading. I like Gerhard's
idea of removing __import__, and have done that.

<mike
--
Mike Meyer <mwm@mired.or g> http://www.mired.org/home/mwm/
Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information.

[Mike Meyer]

Re: ANNOUNCE; Try python beta

Claudio Grondi <claudio.grondi @freenet.de> writes:[color=blue]
> Mike Meyer wrote:[color=green]
>> Ok, I've given it the interface I want, and made it less of an
>> attractive nuisance.
>> http://www.mired.org/home/mwm/try_python/ is now ready for people to
>> play with. There's no tutorial information on it yet, that's the next
>> thing to do. However, I won't be able to work on it for a while, so if
>> you want to make suggestions about what that should look like, all
>> such suggestions will be given proper consideration.
>> <mike[/color]
> I suggest it should work like IDLE do and not remain limited to
> evaluating of expressions. One can easily get the impression Python is
> very limited and this is not what can help Python to show its
> strengths.[/color]

I thought about that. It's not clear that it's fixable at this
level. If not, it'll be documented.
[color=blue]
> By the way:
> The page doesn't work for me in MSIE (I am on a Windows system)[color=green][color=darkred]
> >>> 1+1[/color][/color]
> SyntaxError: unexpected EOF while parsing (line 1)[/color]

Yeah, I know. I poked at it briefly, but couldn't figure out what was
goiing on. MSIE on the Mac doesn't work at all (no AJAT), and I don't
have regular access to a Windows box to try it on.
[color=blue]
> It does work for me in FireFox and Netscape:[color=green][color=darkred]
> >>> 1+1[/color][/color]
> 2[/color]

Also Safari, Mozilla and Netscape. If you try it with a browser
without XMLHttpRequest, it'll suggest them.
[color=blue]
> but in Opera I get:[color=green][color=darkred]
> >>> 1+1[/color][/color]
> 祓瑮硡牅潲 㩲甠敮灸捥整⁤ 佅⁆桷汩⁥ 慰獲湩⁧氨 湩⁥⤱>>>[/color]

Yup, I've seen that one as well. I have *no* idea what Opera thinks
it's doing. Adding a charset to the content-type didn't solve the
problem. I checked opera's web site, and couldn't find a page for web
developers.

I've added a note about these problems.
[color=blue]
> Maybe the subject of your posting should be changed to:
> Try my skills in processing form requests from different Internet browser?[/color]

Actually, it's doing form processing. It's doing XMLHttpRequests .

<mike
--
Mike Meyer <mwm@mired.or g> http://www.mired.org/home/mwm/
Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information.

[skip@pobox.com]

Re: ANNOUNCE; Try python beta

[color=blue][color=green]
>> It does work for me in FireFox and Netscape:[color=darkred]
>> >>> 1+1[/color]
>> 2[/color][/color]

Mike> Also Safari, Mozilla and Netscape.

I tried 4+3 in Safari and got

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>500 Internal Server Error</TITLE>
</HEAD><BODY>
<H1>Internal Server Error</H1>
The server encountered an internal error or
misconfiguratio n and was unable to complete
your request.<P>
Please contact the server administrator,
webmaster@mired .org and inform them of the time the error occurred,
and anything you might have done that may have
caused the error.<P>
More information about this error may be available
in the server error log.<P>
<HR>
<ADDRESS>Apac he/1.3.26 Server at www.mired.org Port 80</ADDRESS>
</BODY></HTML>

in the terminal just now (9:05 or so CST).

Skip

[David Wahler]

Re: ANNOUNCE; Try python beta

Mike Meyer wrote:[color=blue]
> The previous version was in a jail, which is why I didn't want it
> generally announced. The logs made amusing reading. I like Gerhard's
> idea of removing __import__, and have done that.[/color]

Oh, you have, eh? Are you absolutely sure? Try running "grep 'all your
base' log".

-- David

[Mike Meyer]

Re: ANNOUNCE; Try python beta

"David Wahler" <dwahler@gmail. com> writes:[color=blue]
> Mike Meyer wrote:[color=green]
>> The previous version was in a jail, which is why I didn't want it
>> generally announced. The logs made amusing reading. I like Gerhard's
>> idea of removing __import__, and have done that.[/color]
> Oh, you have, eh? Are you absolutely sure? Try running "grep 'all your
> base' log".[/color]

Yup, removing it securely is more trouble than it's worth. Which is
why this is running in a sandbox inside a jail - I knew that securing
Python was a probably impossible.

I put __import__ back, and even imported os just to save you some
time. I also put the expression that will get do the equivalent of "ls
-R /" up for anyone to read.

<mike
--
Mike Meyer <mwm@mired.or g> http://www.mired.org/home/mwm/
Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information.

[Mike Meyer]

Re: ANNOUNCE; Try python beta

skip@pobox.com writes:[color=blue][color=green][color=darkred]
> >> It does work for me in FireFox and Netscape:
> >> >>> 1+1
> >> 2[/color][/color]
> Mike> Also Safari, Mozilla and Netscape.
> I tried 4+3 in Safari and got[/color]

I've been futzing with it all evening. Various things I've done have
broken it in strange ways. It's working now (or was - someone may have
found a way to break it).

I'm tempted to put in a hook to log expressions and let people play
them back - it's kind of amusing.

<mike
--
Mike Meyer <mwm@mired.or g> http://www.mired.org/home/mwm/
Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information.

[Kay Schluehr]

Re: ANNOUNCE; Try python beta

Mike Meyer wrote:[color=blue]
> Ok, I've given it the interface I want, and made it less of an
> attractive nuisance.
>
> http://www.mired.org/home/mwm/try_python/ is now ready for people to
> play with. There's no tutorial information on it yet, that's the next
> thing to do. However, I won't be able to work on it for a while, so if
> you want to make suggestions about what that should look like, all
> such suggestions will be given proper consideration.
>
> <mike
> --
> Mike Meyer <mwm@mired.or g> http://www.mired.org/home/mwm/
> Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information.[/color]

Very nice though a little tedious to use ;)

Working on Windows XP behind a proxy ( trying both Mozilla + Internet
Explorer ) and typing
[color=blue][color=green][color=darkred]
>>> 1+2[/color][/color][/color]

results in a HTML request in the output field of the console:

<html>
<head>
<title> Data Transfer Status Report </title>
<META http-equiv="Refresh" content="1;
URL=http://www.mired.org/home/mwm/try_python/GGTSPU-fw1.gdm.de-1305-446462-DAT/python.sbox?%3E %3E%3E%201+2">
</head>
<body bgcolor="#fffff f">
<h2> Data Transfer Status Report</h2>
<hr>
<table>
<tr><td align=right>URL :</td><td align=left><b>< a
href="http://www.mired.org/home/mwm/try_python/python.sbox?%20 1+2">http://www.mired.org/home/mwm/try_python/python.sbox?%20 1+2</a></b></td></tr>

etc.

The interesting issue is the provided link. Copying the HTML output
into a file and executing it opens a file transfer connection. The
result is as expected:

python.sbox

It contains the correct result: it is 3 :)

Kay

[Richie Hindle]

Re: ANNOUNCE; Try python beta


[Claudio][color=blue]
> The page doesn't work for me in MSIE (I am on a Windows system)[/color]

[Mike][color=blue]
> Yeah, I know. I poked at it briefly, but couldn't figure out what was
> goiing on. MSIE on the Mac doesn't work at all (no AJAT), and I don't
> have regular access to a Windows box to try it on.[/color]

I think it's your JavaScript '\r' processing that's broken. Certainly the
error ("unexpected EOF while parsing") is consistent with having a \r on the
end of the expression. Won't this:

if (input.length == 1)

always fail in the case where the user has typed a newline? I'd ditch that
code and do it at the server end:

expr = expr[4:].strip()

--
Richie Hindle
richie@entrian. com

[Paul Boddie]

Re: ANNOUNCE; Try python beta

Mike Meyer wrote:

[Browser behaviour]
[color=blue]
> Actually, it's doing form processing. It's doing XMLHttpRequests .[/color]

You might want to add some workarounds for Konqueror. What I found was
that Konqueror (on KDE 3.4.0) has a tendency to add null bytes to the
end of some form field values. Consequently, I get mostly "SyntaxErro r:
unexpected EOF while parsing (line 1)" in that browser. It could well
be that other browsers also have their quirks with XMLHttpRequest.

Paul

[Mike Meyer]

Re: ANNOUNCE; Try python beta

Richie Hindle <richie@entrian .com> writes:[color=blue][color=green]
>> Yeah, I know. I poked at it briefly, but couldn't figure out what was
>> goiing on. MSIE on the Mac doesn't work at all (no AJAT), and I don't
>> have regular access to a Windows box to try it on.[/color]
>
> I think it's your JavaScript '\r' processing that's broken. Certainly the
> error ("unexpected EOF while parsing") is consistent with having a \r on the
> end of the expression.[/color]

Python doesn't care about the trailing newline.
[color=blue]
> Won't this:
>
> if (input.length == 1)
>
> always fail in the case where the user has typed a newline? I'd ditch that
> code and do it at the server end:[/color]

The point of the '\r' processing is to make sure we don't send the
entire text area string to the server. That breaks things pretty
badly. My assumption is that if splitting on '\n' leaves us with one
thing, we may have gotten a string that used \r for newlines, so we
split on that. Hmm. If the results of the first split left us with
"'\r'expr", then the second split will send an empty string, which
would result in what we're seeing.

I'll investigate that.

thanks,
<mike
--
Mike Meyer <mwm@mired.or g> http://www.mired.org/home/mwm/
Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information.