security framework for XML-LibXSLT [fwd]

Hi,

I thought someone might be interested. Shane Corgatelli contributed a security 
framework to XML::LibXSLT. Currently you may find his patch applied to 
SubVersion (svn co svn://axkit.org/XML-LibXSLT/trunk) and it will eventually 
appear in 1.62. Shane's description and the relevant section from POD 
follows.

  Petr

From http://rt.cpan.org/Ticket/Display.html?id=21887

> I've created a patch that adds an interface to the libxslt security
> framework. It introduces a new class 'XML::LibXSLT::Security' that has a
> similar interface to XML::LibXML::InputCallback.
>
> It allows the user to create callback functions for each of the libxslt
> security preferences. Currently the security preferences are only
> applied to the transform context and are only available at runtime. I
> believe it is thread safe, but have not explicitly tested this.
>
> The patch file (against 1.61) is attached.
>
> Hope this is useful,
>
> Shane Corgatelli
> EZ-NetTools

---------
From LibXSLT documentation:

XML::LibXSLT::Security
    Provides an interface to the libxslt security framework by allowing
    callbacks to be defined that can restrict access to various resources
    (files or URLs) during a transformation.

    The libxslt security framework allows callbacks to be defined for
    certain actions that a stylesheet may attempt during a transformation.
    It may be desirable to restrict some of these actions (for example,
    writing a new file using exsl:document). The actions that may be
    restricted are:

    read_file
        Called when the stylesheet attempts to open a local file (ie: when
        using the document() function).

    write_file
        Called when an attempt is made to write a local file (ie: when using
        the exsl:document element).

    create_dir
        Called when a directory needs to be created in order to write a
        file.

        NOTE: By default, create_dir is not allowed. To enable it a callback
        must be registered.

    read_net
        Called when the stylesheet attempts to read from the network.

    write_net
        Called when the stylesheet attempts to write to the network.

  Using XML::LibXSLT::Security
    The interface for this module is similar to XML::LibXML::InputCallback.
    After creating a new instance you may register callbacks for each of the
    security options listed above. Then you apply the security preferences
    to the XML::LibXSLT or XML::LibXSLT::Stylesheet object using
    "security_callbacks()".

      my $security = XML::LibXSLT::Security->new();
      $security->register_callback( read_file  => $read_cb );
      $security->register_callback( write_file => $write_cb );
      $security->register_callback( create_dir => $create_cb );
      $security->register_callback( read_net   => $read_net_cb );
      $security->register_callback( write_net  => $write_net_cb );

      $xslt->security_callbacks( $security );
       -OR-
      $stylesheet->security_callbacks( $security );

    The registered callback functions are called when access to a resource
    is requested. If the access should be allowed the callback should return
    1, if not it should return 0. The callback functions should accept the
    following arguments:

    $tctxt
        This is the transform context (XML::LibXSLT::TransformContext). You
        can use this to get the current XML::LibXSLT::Stylesheet object by
        calling "stylesheet()".

          my $stylesheet = $tctxt->stylesheet();

        The stylesheet object can then be used to share contextual
        information between different calls to the security callbacks.

    $value
        This is the name of the resource (file or URI) that has been
        requested.

    If a particular option (except for "create_dir") doesn't have a
    registered callback, then the stylesheet will have full access for that
    action.

  Interface
   new()
    Creates a new XML::LIbXSLT::Security object.

   register_callback( $option, $callback )
    Registers a callback function for the given security option (listed
    above).

   unregister_callback( $option )
    Removes the callback for the given option. This has the effect of
    allowing all access for the given option (except for "create_dir").


--++**==--++**==--++**==--++**==--++**==--++**==--++**==
ptk mailing list
[email protected]
https://mailman.stanford.edu/mailman/listinfo/ptk