Can unlang do this?

[Chris]

On Apr 24, 2008, at 11:57 AM, Alan DeKok wrote:

> Chris wrote:
>> I guess the trick is fixing it (breaking it?) so this works without
>> opening up any vectors for injection attacks.  Would it be safe to
>> exclude the "control" list from being escaped like this?  It seems  
>> that
>> only attributes in the the request and proxy-request lists would be  
>> the
>> real problems.
>
>  Yes and no.  The best way is via a "tainted" flag, like Perl.  But
> that involves a lot more work.
>

Certainly better from my perspective to work within the current  
capabilities.  I've pared what would have been about six different  
ldap modules per redundant server down to two, so I'm happy.  I  
*could* probably get it down to one but I don't think the extra  
complexity to do so would outweigh the gains.

>> Would it have been so difficult to say "man unlang see update"  
>> instead
>> of just "man unlang"?  You spent more time complaining about the  
>> way I
>> asked the question than it would have taken to answer it. ;)
>
>  Exactly.
>
>  I wish to emphasize *thinking* and *reading*.  Answering questions by
> cutting & pasting portions of the documentation is a disservice to
> everyone.  It has it's appeal, but it's wrong.

Hardly suggesting a cut-and-paste, but okay.

Thanks again for the help.