Re: [Beanshell-dev] The sad state of Javascripting
"David A. Lee" <[email protected]> Tue, 1 May 2007 16:15:19 -0500
| Newsgroups | gmane.comp.java.beanshell.user,gmane.comp.java.beanshell.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============1639063810== Content-Type: multipart/alternative; boundary="----=_NextPart_000_009D_01C78C0B.E985FDF0" This is a multi-part message in MIME format. ------=_NextPart_000_009D_01C78C0B.E985FDF0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable If were on the "new feature" bandwagon :) the one feature I'd love to = see added is some ability to protect/restrict code from executing = arbitrary java code outside of specific packages or classes. I'm sure = that there is some trick you can do with Classloaders but I haven't = figured it out ... its certainly not obvious. Right now this is a HUGE = security hole which makes the use of BH within a larger framework (say = an app server) extremely dangerous. For example, nothing is stopping = any bsh code from calling System.exit() ...=20 This is fine if the developer of the apps is also the developer of the = scripts ... but if you'd like to expose scripting to outside users there = is no way to create a protected environment. Atleast no way I know of. = I don't think you'd call this feature a "language feature" ... but its = certainly more then a "bug fix". ... ----- Original Message -----=20 From: Alexey Zinger=20 To: [email protected] ; David A. Lee=20 Cc: beanshell-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org ; Alexey Zinger ; = beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org=20 Sent: Tuesday, May 01, 2007 4:00 PM Subject: Re: [Beanshell-users] [Beanshell-dev] The sad state of = Javascripting It is true that there are people asking for both bug fixes and = language features and both are not being answered at the moment. I = think if there is a fork for just the bug fixes, people who specifically = don't want language changes can still use it and then there can be a = separate release or a fork on top of that. I don't know how big that = group would be though aside from myself. [email protected] wrote: I'm not sure how many outstanding bugs there are, but I suspect = there aren't that many. I'm using BeanShell extensively and I've only had = the namespacing issue mentionned a few emails ago (incidently, the issue = is not about 'overloading' which doesn't make sense in the absence of = types, it's just an overidding problem....later definitions taking the = place of former ones) and I've fixed this in my own copy of BeanShell that is = being distributed with Scriba (http://www.kobrix.com/scriba.jsp). On the other hand, why restrict a fork to bug fixes only? I'd be = tempted to implement and experiment with _significant_ new features rather = than wait for a committee in a closed room to decide what's best for the = user community, as it happens with every other JSR. Correct me if I'm = wrong, but I fear that for the JSR based 3.0, there won't be any open conversation going, we'll all have to hold our breadths and wait and = hope for the best. Take a look at how impressive Perl 6 is in terms of linguistict capabilities...it's because it is a product of the whole community! Best, Boris > Lets hope that when 3.0 comes out it wont *have* these bugs. > And if it does, and if the fixes cant or wont be integrated, the = lets hope > authors will be more open to fixing bugs in 3.0 then in 2.0. > This is why I suggest a "bug fix only" fork ... > > Time will only tell if people prefer an active 2.0 branch or a = future 3.0 > branch. > I certianly would prefer a carefully managed 2.0 bug fix branch = now over a > 3.0 branch sometime in the future. > I'm also concerned about the impact of the hinted "refactoring" in = the 3.0 > branch ... how much of a hit will existing code take ? > I dont know ... maybe too much to move onto 3.0 for a long time = after its > out. > > My experience with similar projects is that sometimes people = actually > prefer the "N" branch over the "N+1" branch for exactly these = reasons ... > so 2.0 and 3.0 may very well diverge ... which isnt a horrible = thing > necessarily. All depends on what your goals are. > Maybe at some point it will be clearer if 3.0 will want to catch = up with > the 2.0 branch or go its seperate way. Possibly at that point it = might > be a good idea to re-examine what the goals are of this fork ... > > But for now, in the near future (say 1 year out ...) I see a huge > advantage in getting a 2.0 fork which has some active bug fixing. > I certianly would jump on it, and help with it. Providing the goal = (for > now) is stability and fixes and there was some infrastructure in = place to > test fixes before they were commited. I dont know the state of = unit test > for BeanShell ... > > > ----- Original Message ----- > From: Alexey Zinger > To: beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org > Cc: beanshell-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org > Sent: Tuesday, May 01, 2007 3:05 PM > Subject: Re: [Beanshell-dev] [Beanshell-users] The sad state of > Javascripting > > > I agree in principle, but I wonder what the likelihood of these = fixes > not being easily integratable into the 3.0 release will be... > > "David A. Lee" wrote: > I vote "yes", although I would suggest we keep this fork a "bug = fix > only" > fork in the hopes that the fixes may someday be incorporated back = into > the > mainline. > If we start adding feature enhacements mixed in with bug fixes, or > start > doing 'gratuitius fixes' then we will likely be locked into a dead > end. > I volunteer to help. > > < this is just an oppinion ... I dont have the "right" to vote ... > anymore > then anyone who is "just a user"> > > -David Lee > > > ----- Original Message ----- > From: "fschmidt" > To: > Sent: Monday, April 30, 2007 10:23 PM > Subject: Re: [Beanshell-users] The sad state of Java scripting > > > > > > Would anyone object to me forking BeanShell? > > > > -- > > View this message in context: > > = http://www.nabble.com/The-sad-state-of-Java-scripting-tf3664576.html#a102= 64126 > > Sent from the BeanShell - User mailing list archive at = Nabble.com. > > > > > > = -------------------------------------------------------------------------= > > This SF.net email is sponsored by DB2 Express > > Download DB2 Express C - the FREE version of DB2 express and = take > > control of your XML. No limits. Just data. Click to get it now. > > http://sourceforge.net/powerbar/db2/ > > _______________________________________________ > > Beanshell-users mailing list > > Beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org > > https://lists.sourceforge.net/lists/listinfo/beanshell-users > > > > > = -------------------------------------------------------------------------= > This SF.net email is sponsored by DB2 Express > Download DB2 Express C - the FREE version of DB2 express and take > control of your XML. No limits. Just data. Click to get it now. > http://sourceforge.net/powerbar/db2/ > _______________________________________________ > Beanshell-developers mailing list > Beanshell-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org > https://lists.sourceforge.net/lists/listinfo/beanshell-developers > > > > > Alexey > 2001 Honda CBR600F4i (CCS) > 1992 Kawasaki EX500 > http://azinger.blogspot.com > http://bsheet.sourceforge.net > http://wcollage.sourceforge.net > > > > = -------------------------------------------------------------------------= ----- > Ahhh...imagining that irresistible "new car" smell? > Check out new cars at Yahoo! Autos. > > > = -------------------------------------------------------------------------= ----- > > > = -------------------------------------------------------------------------= > This SF.net email is sponsored by DB2 Express > Download DB2 Express C - the FREE version of DB2 express and take > control of your XML. No limits. Just data. Click to get it now. > http://sourceforge.net/powerbar/db2/ > > > = -------------------------------------------------------------------------= ----- > > > _______________________________________________ > Beanshell-developers mailing list > Beanshell-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org > https://lists.sourceforge.net/lists/listinfo/beanshell-developers > = -------------------------------------------------------------------------= > This SF.net email is sponsored by DB2 Express > Download DB2 Express C - the FREE version of DB2 express and take > control of your XML. No limits. Just data. Click to get it now. > = http://sourceforge.net/powerbar/db2/_____________________________________= __________ > Beanshell-users mailing list > Beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org > https://lists.sourceforge.net/lists/listinfo/beanshell-users > = -------------------------------------------------------------------------= This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ Beanshell-users mailing list Beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/beanshell-users Alexey 2001 Honda CBR600F4i (CCS) 1992 Kawasaki EX500 http://azinger.blogspot.com http://bsheet.sourceforge.net http://wcollage.sourceforge.net -------------------------------------------------------------------------= ----- Ahhh...imagining that irresistible "new car" smell? Check out new cars at Yahoo! Autos. ------=_NextPart_000_009D_01C78C0B.E985FDF0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.6000.16414" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2>If were on the "new feature" bandwagon :) the one = feature I'd=20 love to see added is some ability to protect/restrict code from = executing=20 arbitrary java code outside of specific packages or classes. I'm = sure that=20 there is some trick you can do with Classloaders but I haven't figured = it out=20 ... its certainly not obvious. Right now this is a HUGE security = hole=20 which makes the use of BH within a larger framework (say an app server)=20 extremely dangerous. For example, nothing is stopping any = bsh code=20 from calling System.exit() ... </FONT></DIV> <DIV><FONT size=3D2>This is fine if the developer of the apps is also = the=20 developer of the scripts ... but if you'd like to expose scripting to = outside=20 users there is no way to create a protected environment. Atleast = no way I=20 know of. I don't think you'd call this feature a = "language=20 feature" ... but its certainly more then a "bug fix". = ...</FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2></FONT> </DIV> <BLOCKQUOTE=20 style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; = BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px"> <DIV style=3D"FONT: 10pt arial">----- Original Message ----- </DIV> <DIV=20 style=3D"BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: = black"><B>From:</B>=20 <A title=3Dinline_four-/[email protected] = href=3D"mailto:inline_four-/[email protected]">Alexey=20 Zinger</A> </DIV> <DIV style=3D"FONT: 10pt arial"><B>To:</B> <A = [email protected]=20 href=3D"mailto:[email protected]">[email protected]</A> ; <A=20 [email protected] href=3D"mailto:[email protected]">David A. = Lee</A> </DIV> <DIV style=3D"FONT: 10pt arial"><B>Cc:</B> <A=20 title=3Dbeanshell-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org=20 = href=3D"mailto:beanshell-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org">beanshell-deve= [email protected]</A>=20 ; <A title=3Dinline_four-/[email protected] = href=3D"mailto:inline_four-/[email protected]">Alexey=20 Zinger</A> ; <A title=3Dbeanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org=20 = href=3D"mailto:beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org">beanshell-users@lis= ts.sourceforge.net</A>=20 </DIV> <DIV style=3D"FONT: 10pt arial"><B>Sent:</B> Tuesday, May 01, 2007 = 4:00 PM</DIV> <DIV style=3D"FONT: 10pt arial"><B>Subject:</B> Re: [Beanshell-users]=20 [Beanshell-dev] The sad state of Javascripting</DIV> <DIV><BR></DIV>It is true that there are people asking for both bug = fixes and=20 language features and both are not being answered at the moment. = I think=20 if there is a fork for just the bug fixes, people who specifically = don't want=20 language changes can still use it and then there can be a separate = release or=20 a fork on top of that. I don't know how big that group would be = though=20 aside from myself.<BR><BR><B><I><A=20 href=3D"mailto:[email protected]">[email protected]</A></I></B> = wrote: <BLOCKQUOTE class=3Dreplbq=20 style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: = rgb(16,16,255) 2px solid">I'm=20 not sure how many outstanding bugs there are, but I suspect = there<BR>aren't=20 that many. I'm using BeanShell extensively and I've only had=20 the<BR>namespacing issue mentionned a few emails ago (incidently, = the issue=20 is<BR>not about 'overloading' which doesn't make sense in the = absence of=20 types,<BR>it's just an overidding problem....later definitions = taking the=20 place of<BR>former ones) and I've fixed this in my own copy of = BeanShell=20 that is being<BR>distributed with Scriba=20 (http://www.kobrix.com/scriba.jsp).<BR><BR>On the other hand, why = restrict a=20 fork to bug fixes only? I'd be tempted<BR>to implement and = experiment with=20 _significant_ new features rather than<BR>wait for a committee in a = closed=20 room to decide what's best for the user<BR>community, as it happens = with=20 every other JSR. Correct me if I'm wrong,<BR>but I fear that for the = JSR=20 based 3.0, there won't be any open<BR>conversation going, we'll all = have to=20 hold our breadths and wait and hope<BR>for the best. Take a look at = how=20 impressive Perl 6 is in terms of<BR>linguistict capabilities...it's = because=20 it is a product of the = whole<BR>community!<BR><BR>Best,<BR>Boris<BR><BR>>=20 Lets hope that when 3.0 comes out it wont *have* these bugs.<BR>> = And if=20 it does, and if the fixes cant or wont be integrated, the lets = hope<BR>>=20 authors will be more open to fixing bugs in 3.0 then in 2.0.<BR>> = This is=20 why I suggest a "bug fix only" fork ...<BR>><BR>> Time will = only tell=20 if people prefer an active 2.0 branch or a future 3.0<BR>>=20 branch.<BR>> I certianly would prefer a carefully managed 2.0 bug = fix=20 branch now over a<BR>> 3.0 branch sometime in the future.<BR>> = I'm=20 also concerned about the impact of the hinted "refactoring" in the=20 3.0<BR>> branch ... how much of a hit will existing code take = ?<BR>> I=20 dont know ... maybe too much to move onto 3.0 for a long time after=20 its<BR>> out.<BR>><BR>> My experience with similar projects = is that=20 sometimes people actually<BR>> prefer the "N" branch over the = "N+1"=20 branch for exactly these reasons ...<BR>> so 2.0 and 3.0 may very = well=20 diverge ... which isnt a horrible thing<BR>> necessarily. All = depends on=20 what your goals are.<BR>> Maybe at some point it will be clearer = if 3.0=20 will want to catch up with<BR>> the 2.0 branch or go its seperate = way.=20 Possibly at that point it might<BR>> be a good idea to re-examine = what=20 the goals are of this fork ...<BR>><BR>> But for now, in the = near=20 future (say 1 year out ...) I see a huge<BR>> advantage in = getting a 2.0=20 fork which has some active bug fixing.<BR>> I certianly would = jump on it,=20 and help with it. Providing the goal (for<BR>> now) is stability = and=20 fixes and there was some infrastructure in place to<BR>> test = fixes=20 before they were commited. I dont know the state of unit = test<BR>> for=20 BeanShell ...<BR>><BR>><BR>> ----- Original Message = -----<BR>>=20 From: Alexey Zinger<BR>> To:=20 beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org<BR>> Cc:=20 beanshell-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org<BR>> Sent: Tuesday, = May 01,=20 2007 3:05 PM<BR>> Subject: Re: [Beanshell-dev] [Beanshell-users] = The sad=20 state of<BR>> Javascripting<BR>><BR>><BR>> I agree in = principle,=20 but I wonder what the likelihood of these fixes<BR>> not being = easily=20 integratable into the 3.0 release will be...<BR>><BR>> "David = A. Lee"=20 <[email protected]>wrote:<BR>> I vote "yes", although I would = suggest we=20 keep this fork a "bug fix<BR>> only"<BR>> fork in the hopes = that the=20 fixes may someday be incorporated back into<BR>> the<BR>>=20 mainline.<BR>> If we start adding feature enhacements mixed in = with bug=20 fixes, or<BR>> start<BR>> doing 'gratuitius fixes' then we = will likely=20 be locked into a dead<BR>> end.<BR>> I volunteer to=20 help.<BR>><BR>> < this is just an oppinion ... I dont have = the=20 "right" to vote ...<BR>> anymore<BR>> then anyone who is "just = a=20 user"><BR>><BR>> -David Lee<BR>><BR>><BR>> ----- = Original=20 Message -----<BR>> From: "fschmidt"<BR>> To:<BR>> Sent: = Monday,=20 April 30, 2007 10:23 PM<BR>> Subject: Re: [Beanshell-users] The = sad state=20 of Java scripting<BR>><BR>><BR>> ><BR>> > Would = anyone=20 object to me forking BeanShell?<BR>> ><BR>> > --<BR>> = >=20 View this message in context:<BR>> >=20 = http://www.nabble.com/The-sad-state-of-Java-scripting-tf3664576.html#a102= 64126<BR>>=20 > Sent from the BeanShell - User mailing list archive at=20 Nabble.com.<BR>> ><BR>> ><BR>> >=20 = -------------------------------------------------------------------------= <BR>>=20 > This SF.net email is sponsored by DB2 Express<BR>> > = Download DB2=20 Express C - the FREE version of DB2 express and take<BR>> > = control of=20 your XML. No limits. Just data. Click to get it now.<BR>> >=20 http://sourceforge.net/powerbar/db2/<BR>> >=20 _______________________________________________<BR>> > = Beanshell-users=20 mailing list<BR>> > = Beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org<BR>> >=20 https://lists.sourceforge.net/lists/listinfo/beanshell-users<BR>> = ><BR>><BR>><BR>>=20 = -------------------------------------------------------------------------= <BR>>=20 This SF.net email is sponsored by DB2 Express<BR>> Download DB2 = Express C=20 - the FREE version of DB2 express and take<BR>> control of your = XML. No=20 limits. Just data. Click to get it now.<BR>>=20 http://sourceforge.net/powerbar/db2/<BR>>=20 _______________________________________________<BR>> = Beanshell-developers=20 mailing list<BR>> = Beanshell-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org<BR>>=20 = https://lists.sourceforge.net/lists/listinfo/beanshell-developers<BR>>= <BR>><BR>><BR>><BR>>=20 Alexey<BR>> 2001 Honda CBR600F4i (CCS)<BR>> 1992 Kawasaki=20 EX500<BR>> http://azinger.blogspot.com<BR>>=20 http://bsheet.sourceforge.net<BR>>=20 http://wcollage.sourceforge.net<BR>><BR>><BR>><BR>>=20 = -------------------------------------------------------------------------= -----<BR>>=20 Ahhh...imagining that irresistible "new car" smell?<BR>> Check = out new=20 cars at Yahoo! Autos.<BR>><BR>><BR>>=20 = -------------------------------------------------------------------------= -----<BR>><BR>><BR>>=20 = -------------------------------------------------------------------------= <BR>>=20 This SF.net email is sponsored by DB2 Express<BR>> Download DB2 = Express C=20 - the FREE version of DB2 express and take<BR>> control of your = XML. No=20 limits. Just data. Click to get it now.<BR>>=20 http://sourceforge.net/powerbar/db2/<BR>><BR>><BR>>=20 = -------------------------------------------------------------------------= -----<BR>><BR>><BR>>=20 _______________________________________________<BR>> = Beanshell-developers=20 mailing list<BR>> = Beanshell-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org<BR>>=20 = https://lists.sourceforge.net/lists/listinfo/beanshell-developers<BR>>= =20 = -------------------------------------------------------------------------= <BR>>=20 This SF.net email is sponsored by DB2 Express<BR>> Download DB2 = Express C=20 - the FREE version of DB2 express and take<BR>> control of your = XML. No=20 limits. Just data. Click to get it now.<BR>>=20 = http://sourceforge.net/powerbar/db2/_____________________________________= __________<BR>>=20 Beanshell-users mailing list<BR>>=20 Beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org<BR>>=20 = https://lists.sourceforge.net/lists/listinfo/beanshell-users<BR>><BR><= BR><BR><BR>--------------------------------------------------------------= -----------<BR>This=20 SF.net email is sponsored by DB2 Express<BR>Download DB2 Express C - = the=20 FREE version of DB2 express and take<BR>control of your XML. No = limits. Just=20 data. Click to get it=20 = now.<BR>http://sourceforge.net/powerbar/db2/<BR>_________________________= ______________________<BR>Beanshell-users=20 mailing=20 = list<BR>Beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org<BR>https://lists.sourceforg= e.net/lists/listinfo/beanshell-users<BR></[email protected]></BLOCKQUOTE><= BR><BR><BR>Alexey<BR>2001=20 Honda CBR600F4i (CCS)<BR>1992 Kawasaki EX500<BR><A=20 = href=3D"http://azinger.blogspot.com">http://azinger.blogspot.com</A><BR><= A=20 = href=3D"http://bsheet.sourceforge.net">http://bsheet.sourceforge.net</A><= BR><A=20 = href=3D"http://wcollage.sourceforge.net">http://wcollage.sourceforge.net<= /A><BR> <P> <HR SIZE=3D1> Ahhh...imagining that irresistible "new car" smell?<BR>Check out <A=20 = href=3D"http://us.rd.yahoo.com/evt=3D48245/*http://autos.yahoo.com/new_ca= rs.html;_ylc=3DX3oDMTE1YW1jcXJ2BF9TAzk3MTA3MDc2BHNlYwNtYWlsdGFncwRzbGsDbm= V3LWNhcnM-">new=20 cars at Yahoo! Autos.</A> </BLOCKQUOTE></BODY></HTML> ------=_NextPart_000_009D_01C78C0B.E985FDF0-- --===============1639063810== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ --===============1639063810== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Beanshell-users mailing list Beanshell-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/beanshell-users --===============1639063810==--