> From: Dan Bron
> 
> Ric wrote:
> > 10&#.^:_1 (or 10&#.inv ) has always seemed to me to be the "right"
> > way of converting a number to its digits but it is slower and fatter
> > than  the other methods:
> 
> Pepe wrote:
> > Perhaps, for the reason that you mentioned, there is case for
> > special code for ( 10&#.^:_1 ) .
> 
> Agreed.

Seems like a good idea to me.
 
> >  ( ,.&.": ) is indeed a neat phrase
> 
> Also agreed!   However, I am concerned with  (&.":), because it applies
> (":^:_1),  which is  (". ) which obviously can and will
> execute arbitrary code.  And this implication may not be obvious to the
> programmer when he types  (&.":).  Now, there's no problem
> if he controls (y) but applying these phrases to user strings makes the
> application vulnerable to "J injection" attacks.
> 
> This isn't a problem in the current case (because the input is numeric,
> and even if it were a rank-1 string,  (".) would never be
> applied to more than one character anyway).    But I do have an open
> relevant enhancement request open on it [2], where I recommend
> x&".  be made invertible.

Yes I was about to reply to Raul's suggested solution ( >./ 5 */\ "."0 data ) 
that I had an uneasy feeling using Do (monadic ". ) to convert strings to 
numbers, when I realised that was exactly what ,.&.": was doing:
   ": b. _1
".

I am (was) not so concerned about security vulnerabilities (it would be nice to 
have to worry about hordes of J programmers out there waiting to seize on such 
opportunities! ;-)  ) as I am about conversion errors, although in this 
instance there shouldn't be any problems.
   ". '4 -3 7'
1 _3
   _". '4 -3 7'
4 _3 7
   ". '4 3 7 7e-4'
|ill-formed number
|       ".'4 3 7 7e-4'
   _". '4 3 7 7e-4'
4 3 7 0.0007

----------------------------------------------------------------------
For information about J forums see http://www.jsoftware.com/forums.htm

Reply via email to