** Using WeBWorK **

I'm back again with another question related to the Java evaluator I've been working on. As suggested in a previous post, I added XML::Parser to the module list in global.conf so that I could use it in my own module for the evaluator. Everything worked great.

However, now we are moving from our old ww2.0 install to a new ww2.2 install and I am having an issue. The error message reads:

    'require' trapped by operation mask at
    /usr/local/lib/perl5/5.8.8/mach/IO/Handle.pm line 256

   $parser->parsefile($path);

   $parser = new XML::Parser();
   $parser->setHandlers(Char => &char_handler,
                        End => &end_handler,
                        Start => &start_handler);
   $parser->parsefile($path);

So my current understanding of the situation is that XML::Parser makes use of IO::Handle which contains the 'require' statement which is disallowed. Does this seem correct? Could one of the changes such as security updates between the 2.0 and 2.2 versions be involved? If so, is there anything I can do?

Thanks,

David

PS we've also upgraded from perl 5.6 to 5.8 if that makes a difference.

<| Post or View Comments |>

This is kind of a known issue with Safe -- modules can be loaded outside the safe compartment and shared, but if they load other modules at runtime this will be trapped by Safe.

You might try adding IO::Handle to the modules list as well, as well as any other modules that need to get loaded.

We're working on better ways to expose external code to the safe compartment, but it's still at the planning stage. In particular, look at Safe::Hole, which claims to solve exactly this problem.

<| Post or View Comments |>

perl 5.8 updated a number of modules to use things like IO:Handle instead of using open() directly.

You're running into a frustrating problem that a number of us are having with trying to add specific capabilities within the Safe compartment without including too many dangerous "powers".

Safe::Hole is something to investigate, but so far it hasn't been quite the right tool. Wish I could help more, but at the moment I don't have further advice.

-- Mike

<| Post or View Comments |>