web commit by BrandenRobinson: Explain why letting users specify regexes is bad.

diff --git a/doc/todo.mdwn b/doc/todo.mdwn
index d4abc832d0a6f17fdb5005cd3c039fcab7e14146..d7326854efd2c79c5b0481072e82825137c693d3 100644 (file)
--- a/doc/todo.mdwn
+++ b/doc/todo.mdwn
@@ -23,6 +23,10 @@ is built. (As long as all changes to all pages is ok.)
      explicitly named pages would be desirable.
   2. I think that since we're using Perl on the backend, being able to
      let users craft their own arbitrary regexes would be good.
      explicitly named pages would be desirable.
   2. I think that since we're using Perl on the backend, being able to
      let users craft their own arbitrary regexes would be good.

+
+     Joey points out that this is actually a security hole, because Perl
+     regexes let you embed (arbitrary?) Perl expressions inside them.  Yuck!
+

   3. Of course if you do that, you want to have form processing on the user
      page that lets them tune it, and probably choose literal or glob by
      default.
   3. Of course if you do that, you want to have form processing on the user
      page that lets them tune it, and probably choose literal or glob by
      default.