Re^4: Passing a regex from a CGI HTML form (user supplied regex substitution without eval)

[Anonymous Monk]

You gotta have a canned solution for ignorant newbees and impatient veterans

Its not like it takes long to DIY-up a little safety, I typed up the above in preview box, now tested, with own Turpolate

use String::Interpolate::RE qw( strinterp );
print Substitution("BellyAche\n", '([a-z])([A-Z])', '$1    $2', '');
print Substitution("BellyAche\n", '([a-z])([A-Z])', '$1    $2', 'g');
sub Substitution {
    my( $in, $re, $rep, $flags ) = @_;
    my $global  =  $flags =~ m{g}i;
    my $qrFlags =  join '', $flags =~ m{([msixpodualn])}i;
    $qrFlags = "(?$qrFlags)";
    $re = qr{$qrFlags$re};
    if( $global ){
         $in =~ s{$re}{
           Replace($rep, \%+,{1=>$1,2=>$2,3=>$3});
         }gex;
    } else {
         $in =~ s{$re}{
           my $vars = {
               %+, 1=>$1, 2=>$2, 3=>$3,
           };
           Turpolate( $rep, $vars );
         }ex;
    }
    return $in;
}
sub Turpolate {
    my( $str, $vars ) = @_;
    $str =~ s{\$(\w+)}{
        exists $vars->{$1}
        ? $vars->{$1}
        : '$'.$1
    }gex;
    return $str;
}
sub Replace {
    my( $rep, $named, $numed ) = @_;
    my $vars = { %$named, %$numed, 'bananas','bananas' };
    return strinterp( $rep, $vars );
}
__END__
Belly    Ache
Belly    Ache

[trippledubs]

print Substitution("canned","working"); #canned
print Substitution("canned","compiles",'$1 $2','g'); #canned
print Substitution("canned","flawed",'$1 $2'); #canned
print Substitution("canned",".*",`ls`); #first directory entry
`touch down`;
print Substitution("canned",".*",`rm down`); #deleted file

[Anonymous Monk]

Heheh, what do you think that proves?

[trippledubs]

lol at first I was really excited, but no you are right it doesn't prove anything because $rep has to be a string. But there should be a way to do what I'm trying else the module authors and yourself would not couch your words!