[Pharo-users] Re: Using ZnResponse>>#redirect: to pass an error message

2022-12-13 Thread vinref
Hi again

Unfortunately the solution I came up with above is vulnerable to cross-site 
scripting attack (XSS). The solution takes the parameter passed in from the url 
and shows it to the user. An attacker can insert a script and send the link to 
a user for instance. Please do not do this.

You can mitigate the XSS attack with CSP 
(https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src),
 but it can be tricky to get right. 

Back to square one.

Vince


[Pharo-users] Mardeep as a format to (re)publish and exchange Pharo powered data narratives, lesson and book(let)s

2022-12-13 Thread Offray Vladimir Luna Cárdenas

Hi,

As I told in a previous message, we, at the Grafoscopio[1][1a][1b] 
community, are migrating some lessons learned since 2015 to the new 
capabilities available since last year via Lepiter[2]. And one of such 
lessons is the use of human friendly data formats for exchanging and 
publishing data narratives.


[1] https://mutabit.com/grafoscopio/en.html
[1a] https://mutabit.com/repos.fossil/grafoscopio/doc/tip/intro.md
[1b] https://mutabit.com/repos.fossil/grafoscopio/doc/tip/readme.md.html
[2] 
https://lepiter.io/feenk/introducing-lepiter--knowledge-management--e2p6apqsz5npq7m4xte0kkywn/


Originally, in Grafoscopio, we made this friendly format by embedding 
Markdown inside STON, as shown in the Grafoscopio Manual (PDF[3], source 
code [3a]) and now we are flipping the strategy: embedding STON metadata 
in Mardeep[4]/Markdown, which allows us to exchange and publish Pharo 
powered data narratives, lessons and book(let)s in a pretty light format 
as shown by the republication of the "PetitParser: Building Modular 
Parsers" chapter (18th )from the Deep into Pharo book[4]  as a Markdeep 
data narrative[4a]. The chapter was rewritten in Lepiter and can be 
exported/imported to/from Markdeep, so new updates or learning notes can 
be created pretty easily[4b]. Because we combine this with Fossil 
SCM[5], it is also possible to have the history of the documents (look 
at [4a1][4b1]) in a self contained environment for collaborative 
publishing/writing that is easier to use, in comparison with Git based 
alternatives (as shown in our practices introducing this tools and 
workflows to non-programmers).


[3] 
https://mutabit.com/repos.fossil/grafoscopio/uv/Docs/En/Books/Manual/manual.pdf
[3a] 
https://mutabit.com/repos.fossil/grafoscopio/file?name=Docs/En/Books/Manual/manual.ston&ci=tip
[4] 
http://files.pharo.org/books-pdfs/deep-into-pharo/2013-DeepIntoPharo-EN.pdf
[4a] 
http://mutabit.com/repos.fossil/mutabit/doc/tip/wiki/en/petitparser-building-modular-parsers-2013--ac8zq.md.html
[4b] 
http://mutabit.com/repos.fossil/mutabit/doc/tip/wiki/en/petitparser-building-modular-parsers--ac8zq.md.html

[4a1] http://mutabit.com/repos.fossil/mutabit/timeline?uf=1680c3899
[4b1] 
http://mutabit.com/repos.fossil/mutabit/finfo?name=wiki/en/petitparser-building-modular-parsers--ac8zq.md.html&m=98674f27039de682&ci=67aabb62607b152d

[5] https://fossil-scm.org/

I like the results with so far with this light (re)publishing workflow 
based in Markdeep, despite some bugs, like subsection numbering done in 
Markdeep when combined with HTML divs[6] (a bug already reported to the 
author). For more detailed control of the output or the combination with 
HTML graphical libraries, like Apache Echarts, we're testing a similar 
strategy using Pandoc's Markdown with promising features. For example, 
we can have interactive snippets in the HTML exported document [6a].


[6] https://nitter.net/offrayLC/status/1585701931728740352#m
[6a] https://twitter.com/offrayLC/status/1555229528355651586

Such light, human readable and diff friendly publishing and exchange 
formats are kind of a dehydrated data narrative for the web and/or the 
file-system than can be re-hydrated back into a full Pharo/GToolkit 
image for total interactivity/moldability and meanwhile you can tease 
the casual web reader/explorer with data stories and visualizations 
without s/he having the need to have Pharo/GToolkit in her/his machine.


Cheers and thanks for the community and technologies that make this 
possible. I will be posting more advances as they come.


Offray