Re: [Fwd: [Mason] patch for task 294: support exec/subexec("comp:method")]

On Mon, 22 May 2006, Zach Welch wrote:

> I would have subclassed, but the existing implementation is not simply
> designed for that purpose. The function is fairly monolithic and would
> require large chunks of copied code. That's just not correct.

Well, it's not like we _want_ the code to suck, it just sometimes gets 
that way ;)

I do agree that it's monolithic.

> If I factor out those chunks of code that I patched into new helper
> functions, then yes, I could subclass and be happy. Such changes would
> be more disruptive than what I have proposed, but this would be an
> acceptable solution for me.

A patch along these lines (that passes all the existing tests) would be 
very cool.

> Moreover, I would have assumed that a refactoring would likely be
> rejected without this broader perspective of its applicability. Besides,

Not at all.

> Further. this was listed as TODO on the main mason wiki; if that feature

Err, I'll let Jon answer to that, since he created it.

It seems from the standpoint of "why not, I can do it via a comp call" and 
wrong from a security perspective.

At the very least, it probably needs to be something that can be turned on 
or off, and we need to make sure it _can't_ be done by default via 
the ApacheHandler or CGIHandler code, simply because we don't want folks 
to install Mason 1.34 and introduce a security hole to an existing site.

Jon, do you remember what motivated that todo item? I think it'd be good 
to update it based on this discussion.


-dave

/*===================================================
VegGuide.Org                        www.BookIRead.com
Your guide to all that's veg.       My book blog
===================================================*/


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642