Subject: [Tools-discuss] Potential new tool: getdrafts

From: EKR <[email-masked]>
Date: Mon, 05 Mar 2007 17:09:38 -0800

I'm one of those people who prints out every draft that they need to
read for each IETF. I usually do this manually, but I got tired of it so
this time I wrote a little perl script that scrapes the agendas for each
WG you specify, tries to find anything that looks like it might be a
draft name and then downloads it. It will also print them out for you if
you have enscript.

This isn't finished and I worry that I'm not being paranoid enough about
scrubbing the input from the agenda page before passing strings to the
shell (though I don't know of any problems) but I thought it might
be a useful contribution.

A copy can be found at:
https://svn.resiprocate.org/rep/ietf-drafts/ekr/getdrafts.pl

-Ekr

_______________________________________________
Tools-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-discuss

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 06 Mar 2007 08:43:36 +0100

Hi,

> draft name and then downloads it. It will also print them out for you if

Cool.

> shell

As a general comment, you might want to consider having the -T option
on the hash-bang line; that will turn on taint checking, and you won't
be able to do anything dangerous with unscrubbed values.  -w could also
be a good idea (i.e., use -Tw; hash-bang lines only pass on *one* option
group).

In this particular case, your filter for bad stuff (/^[a-zA-Z\-0-9]+-\d\d$/)
looks good to me, except it doesn't exactly match valid/existing draft names.
No recent drafts use upper-case letters, so even if you get a match
containing an upper-case letter, you won't be able to retrieve a matching
draft.  On the other hand, there are 9 drafts from the last 365 days which
have a period character as part of the name (even if that's un-acceptable
in a draft name, according to 1id-guidelines).  So the filter regex
/^[a-z0-9\.-]+-\d\d$/ should be a closer match to draft names.

> (though I don't know of any problems) but I thought it might

Certainly looks useful to me.

	Henrik

---

From: EKR <[email-masked]>
Date: Tue, 06 Mar 2007 08:41:05 -0800

Henrik Levkowetz <[email-masked]> wrote:
> be able to do anything dangerous with unscrubbed values.

This is more of a pain in the ass than it sounds since it applies to all
command line args and most of them are trusted. But that said, I guess
it's worth doing since you might want to put it in a web app or something.

>  -w could also

Yeah....

> draft.

I didn't know if that was a hard rule or not.

  On the other hand, there are 9 drafts from the last 365 days which
> /^[a-z0-9\.-]+-\d\d$/ should be a closer match to draft names.

Sure. I can fix that. I was just thinking about how "." was a 
pathname component. :)

> Certainly looks useful to me.

That's good to hear. 

I've checked in a new version into the SVN repository that incorporates
your suggestions.

Not sure what next steps are here. I'm happy to just publish a pointer
to it, but also happy to contribute it to the IETF tools... whatever
makes the most sense...

-Ekr

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 06 Mar 2007 18:55:00 +0100

Hi,

> Henrik Levkowetz <[email-masked]> wrote:

...
> it's worth doing since you might want to put it in a web app or something.

Yes, I know!  Although perl isn't my first language, I've used it, also with
-T, and it is a bother to untaint everything.  But you do get some extra
security, which you'll want if you use it in a web app, as you say.

...
> I didn't know if that was a hard rule or not.

Yup, it is.

1id-guidelines.txt requires the name to only contain [a-z0-9-], but the
secretariat's checks don't seem to trigger on embedded period characters,
so those slip through at present.

> Sure. I can fix that. I was just thinking about how "." was a 

And so it is, and it shouldn't be permitted, but one has to work the
existing realities ,;-)

> to it, but also happy to contribute it to the IETF tools... whatever

I'll set up a page using the regular tool page format, and let you see
if it suits you.  It would be good if you could put a license on it;
whatever you feel is appropriate.

	Henrik

---

From: Henrik Levkowetz <[email-masked]>
Date: Sat, 10 Mar 2007 20:50:15 +0100

Hi ekr,

on 2007-03-06 18:55 Henrik Levkowetz said the following:
...
> whatever you feel is appropriate.

Ok, I've set up a page, here:

  http://www1.tools.ietf.org/tools/getdrafts/

With a link from the new tool overview page I've started to generate from
the individual tool pages and tool descriptions:

  http://www1.tools.ietf.org/tools/

Does this work for you?

	Henrik