Mailing-List: contact dev-help@cocoon.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cocoon.apache.org
From: "Reinhard Poetz" <reinhard@apache.org>
To: <dev@cocoon.apache.org>, <ntoper@jouve.fr>
Subject: RE: variable substitution in @type attributes
Date: Wed, 4 Feb 2004 16:12:20 +0100
Message-ID: <001001c3eb31$49e07ec0$1e01a8c0@WRPO>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Importance: Normal
In-Reply-To: <200402041606.32342.ntoper@jouve.fr>


From: Nicolas Toper [mailto:ntoper@jouve.fr]=20

> True, this is a big security hole...
>=20
> Well, for the exception, where is the difference btw calling=20
> a non existant=20
> component and calling a non existant resource (like a file)??
>=20
> But it seems hard use... At the same time, this'd be cool for=20
> readers (like=20
> gif, jpeg,etc..)=20

Cool yes, but IMO too much magic. I would be -1 on changing this. With
explicit namings the sitemap remains easily readable.

--
Reinhard

>=20
> What do you think?
>=20
> Le Mercredi 04 F=E9vrier 2004 15:58, Carsten Ziegeler a =E9crit :
> > I think one major point is security or more precise: to detect=20
> > possible problems early on. If you now use a wrong type=20
> information,=20
> > which means address a component that doesn't exist, you get an=20
> > exception immediately on startup. So, you know very early that your=20
> > application is not correct.
> >
> > With a dynamic type attribute you defer this to a much later point=20
> > which might be dangerous as well and very hard to find.
> >
> > Carsten
> >
> > > -----Original Message-----
> > > From: news [mailto:news@sea.gmane.org]On Behalf Of Jorg Heymans
> > > Sent: Wednesday, February 04, 2004 3:51 PM
> > > To: dev@cocoon.apache.org
> > > Subject: Re: variable substitution in @type attributes
> > >
> > >
> > > Vadim, that post is from 2001.
> > >
> > > The arguments are:
> > > - it affects the cache ->is this still relevant for the rewritten=20
> > > cache mechanism in 2.1+ ?
> > > - Flexibility syndrome ->point taken
> > > - It's a reactor pattern forcing distribution of control and=20
> > > increasing the number of contracts between the different=20
> contexts.=20
> > > ->not sure what is meant there. Does he mean that selecting a=20
> > > component during pipeline setup would not be the sole decision of=20
> > > the sitemap anymore? Which contexts are meant here?
> > >
> > > I can understand the pipeline overhead in looking through=20
> the list=20
> > > of all components everytime for one that matches the=20
> parameter, but=20
> > > this could be documented and left to the user to decide what he=20
> > > prefers most.
> > >
> > >
> > > Please note that I am not trying to advocate this change, just=20
> > > looking to up my knowledge on cocoon another nudge.
> > >
> > > thanks
> > > Jorg
> > >
> > > Vadim Gritsenko wrote:
> > > > Jorg Heymans wrote:
> > > >> Carrying the discussion over from users@
> > > >> Why is variable substituion not allowed in @type attributes ?
> > > >
> > > > Archives have it.
> > > >
> > > >=20
> http://marc.theaimsgroup.com/?l=3Dxml-cocoon-dev&m=3D9886706782656
5&w=3D
> > > 2
> > >
http://marc.theaimsgroup.com/?l=3Dxml-cocoon-dev&m=3D98867067826565&w=3D2=

> > >
> > > Vadim