From: Lon H. <lh...@re...> - 2004-05-27 17:22:01
|
Hi, One of the FC development users tossed me this patch: https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=100603&action=view It changes the functionality of joe's spell macro to use aspell instead of ispell (since, at least on Fedora Core, aspell is really just ispell in compatibility mode anyway), and mktemp instead of a hard-coded filename. I think it's a good idea, but I'm not aware of whether or not other distributions ship aspell but not ispell... Perhaps it could be something that could be autoconf'd? More information (actual bugzilla): https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124462 What do you all think? -- Lon Hohberger Red Hat, Inc. --> http://www.redhat.com My Public Key --> http://people.redhat.com/lhh/pubkey.txt |
From: <ja...@av...> - 2004-05-29 04:56:52
|
I added Aspell support, but "mktemp" seems to be too non-portable. For example the "-t" option in the patch does not exist in Slakware, plus mktemp doesn't exist on many old Unixes. Incidentally, how good is Aspell's international support? |
From: Lon H. <lh...@re...> - 2004-06-01 14:23:47
|
On Sat, 2004-05-29 at 00:58 -0400, ja...@av... wrote: > I added Aspell support, but "mktemp" seems to be too non-portable. For > example the "-t" option in the patch does not exist in Slakware, plus mktemp > doesn't exist on many old Unixes. Fair enough. > Incidentally, how good is Aspell's international support? Aspell is targetted to be fully i18n, of course, but development hasn't been as speedy as it could have. UTF-8 is apparently a fairly big hurdle ... couldn't imagine that, could we? ;) Whatever's most portable. Or we could autoconf it ;) -- Lon |
From: Josip R. <jo...@sr...> - 2004-06-02 21:53:08
|
On Sat, May 29, 2004 at 12:58:48AM -0400, ja...@av... wrote: > "mktemp" seems to be too non-portable. For example the "-t" option in the > patch does not exist in Slakware, plus mktemp doesn't exist on many old > Unixes. The configuration file should never default to gaping security holes, remember the DEADJOE problem... I know a fair amount of people who would say that just about any horribly broken temporary file creation method is better than "cat >ispell.tmp" :) -- 2. That which causes joy or happiness. |
From: Matthew M. <ma...@ma...> - 2004-06-02 22:05:43
|
On Wed, Jun 02, 2004 at 11:53:00PM +0200, Josip Rodin wrote: > > "mktemp" seems to be too non-portable. For example the "-t" option in the > > patch does not exist in Slakware, plus mktemp doesn't exist on many old > > Unixes. > The configuration file should never default to gaping security holes, > remember the DEADJOE problem... I know a fair amount of people who would > say that just about any horribly broken temporary file creation method is > better than "cat >ispell.tmp" :) :) FWIW, the "-t" option to mktemp is pretty new -- it didn't exist in Red Hat Linux 9 either. Using -t is definitely superior if available, though. -- Matthew Miller ma...@ma... <http://www.mattdm.org/> Boston University Linux ------> <http://linux.bu.edu/> |
From: <ja...@av...> - 2004-06-02 22:28:42
|
How about: "umask 022; /bin/rm ispell.tmp; cat >ispell.tmp; etc..." Josip Rodin <jo...@sr...> wrote: > On Sat, May 29, 2004 at 12:58:48AM -0400, ja...@av... wrote: > > "mktemp" seems to be too non-portable. For example the "-t" option in the > > patch does not exist in Slakware, plus mktemp doesn't exist on many old > > Unixes. > > The configuration file should never default to gaping security holes, > remember the DEADJOE problem... I know a fair amount of people who would > say that just about any horribly broken temporary file creation method is > better than "cat >ispell.tmp" :) > > -- > 2. That which causes joy or happiness. > > > ------------------------------------------------------- > This SF.Net email is sponsored by the new InstallShield X. > From Windows to Linux, servers to mobile, InstallShield X is the one > installation-authoring solution that does it all. Learn more and > evaluate today! http://www.installshield.com/Dev2Dev/0504 > _______________________________________________ > Joe-editor-general mailing list > Joe...@li... > https://lists.sourceforge.net/lists/listinfo/joe-editor-general |
From: Josip R. <jo...@sr...> - 2004-06-02 22:54:45
|
On Wed, Jun 02, 2004 at 06:30:45PM -0400, ja...@av... wrote: > > How about: "umask 022; /bin/rm ispell.tmp; cat >ispell.tmp; etc..." There's still a race condition between the rm and the cat. Using $$ in the file name would improve the odds, but it's still shoddy. I did a cursory check for mktemp, mkstemp, tempfile on a couple of Solaris 7 system and found none of them. It's doubtful that there's a decent solution without depending on a "new" program, but then, do old systems generally have ispell installed? (Needless to mention, mine didn't.) -- 2. That which causes joy or happiness. |
From: Josip R. <jo...@sr...> - 2004-06-02 22:57:45
|
On Thu, Jun 03, 2004 at 12:54:39AM +0200, Josip Rodin wrote: > > How about: "umask 022; /bin/rm ispell.tmp; cat >ispell.tmp; etc..." > > There's still a race condition between the rm and the cat. Oh and I should mention that a /tmp (where this would be exploitable) is generally a directory with the sticky bit on, so the rm couldn't do anything useful anyway. -- 2. That which causes joy or happiness. |
From: <ja...@av...> - 2004-06-02 23:44:05
|
Josip Rodin <jo...@sr...> wrote: > On Wed, Jun 02, 2004 at 06:30:45PM -0400, ja...@av... wrote: > > > > How about: "umask 022; /bin/rm ispell.tmp; cat >ispell.tmp; etc..." > > There's still a race condition between the rm and the cat. Using $$ in > the file name would improve the odds, but it's still shoddy. > > I did a cursory check for mktemp, mkstemp, tempfile on a couple of Solaris 7 > system and found none of them. It's doubtful that there's a decent solution > without depending on a "new" program, but then, do old systems generally > have ispell installed? (Needless to mention, mine didn't.) It's tempting to have JOE's "make install" install a "mktemp" (and "ispell"). Actually I seem to remember that I knew that this was a security hole even 9 years ago, but was so peeved that "ispell -" didn't work that I didn't fix it out of sheer annoyance. It's doubly annoying that "aspell" can't pipe either. Oh yeah: I was also annoyed that you couldn't check a single word by passing it on the command line. "aspell" at least can do this. There is "ispell -a", but then the user interface has to be in JOE (plus you have to pass the words in LISP). One cheesy solution is to have JOE always make a ~/.joe directory, and have the script always put the temporary file there. This has its own set of problems- if two people are logged into the same account and are running the editor at the same time, they can clash, plus what happens if you can't make ~/.joe? But I have to deal with all of this anyway, because I want JOE to save its state in a ~/.joe/joe.state file. |
From: Matthew M. <ma...@ma...> - 2004-06-02 23:57:42
|
On Wed, Jun 02, 2004 at 07:46:37PM -0400, ja...@av... wrote: > years ago, but was so peeved that "ispell -" didn't work that I didn't fix > it out of sheer annoyance. It's doubly annoying that "aspell" can't pipe > either. Oh yeah: I was also annoyed that you couldn't check a single word What about using aspell's C api? Not that I'm volunteering to write the interface. :) <http://aspell.net/man-html/6_Writing.html#SECTION00710000000000000000> -- Matthew Miller ma...@ma... <http://www.mattdm.org/> Boston University Linux ------> <http://linux.bu.edu/> |
From: Moritz B. <bar...@gm...> - 2004-06-03 03:55:31
|
Hi, On Thu, Jun 03, 2004 at 00:54:39 +0200, Josip Rodin wrote: > I did a cursory check for mktemp, mkstemp, tempfile on a couple of > Solaris 7 system and found none of them. I actually recall SunOS 5.5.1 and 5.6 having "mktmp" as a program, not a function call, which was at least close. I also suggest a joe-internal implementation of mkstemp(). ;-) Regards, Moritz |
From: Koblinger E. <eg...@uh...> - 2004-05-29 10:38:31
|
On Sat, 29 May 2004 ja...@av... wrote: > Incidentally, how good is Aspell's international support? AFAIK aspell is the one that most relies on the language being something like english, german, french or similar to these one. E.g. hungarian is a completely different language. Aspell has a very poor hungarian dictionary which is not maintained and could not really get better since aspell's way of thinking is very far from the logic of hungarian language. Ispell is better for us, but myspell (the spell checker of OpenOffice.org) is yet much better, and the best is hunspell which is a special hungarian-specific spellchecker derived from myspell. Afaik these all have ispell-compatible command line frontend (unfortunately they still use latin2, unable to handle utf8). On the other hand, I recommend to take a look at enchant at http://www.abisource.com/enchant/ . This is a framework developed by the AbiWord folks which provides a unique frontend to the available spell checkers, no matter which backend is used. E.g. I can have a config file where I tell enchant to use the hunspell backend if LANG=hu_HU but to use the aspell backend if LANG=en_US and ispell for de_DE. The advantage of enchant is that it has a library interface, so maybe you can optionally link joe against it and then it doesn't suffer from huge overhead due to fork()ing and then it'd maybe possible to implement realtime spell checking. Another advantage IIRC is that the library interface is clean UTF-8 (it converts the text itself if the engine requires a different encoding). AFAIK enchant is going to be adopted by larger projects (e.g. KDE) soon, maybe it's already done. (Note: use the latest version (1.1.3 at this moment) of enchant, here the odd middle-number doesn't mean unstable, and 1.0.x are extremely buggy.) Huhh, life is quite complicated, ain't it? :) -- Egmont |
From: <ja...@av...> - 2004-05-29 13:14:43
|
Well, it will have to wait. I just released JOE 3.1. |