This module makes it possible to enrich content with data from an external SPARQL endpoint, based on fields or any other data available. Since it is entirely loaded client side (with JSONP), it is very lightweight, but it can still be very flexible.

Since things are injected from javascript, I have taken the precautions that you both have to have extended permissions ('restrict access' => TRUE) and added a check plain on the raw server data returned. That's about as sure as I can get without dropping some functionality. Hope that passes the security test :)

I have added extensive documentation linked up from the project page, and it is also available in the help section when you install the module.

Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch master http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql
For Drupal 7.

Review of other projects:
http://drupal.org/node/1458302#comment-6003342
http://drupal.org/node/1522378#comment-6000334
http://drupal.org/node/1512124#comment-5901284

...and
http://drupal.org/node/1546758#comment-6055320
http://drupal.org/node/1273586#comment-6055374
http://drupal.org/node/1242758#comment-6055536

Comments

misc’s picture

Status: Needs review » Needs work

Welcome with your application.
It's going to take some time to get a full review, but hopefully you will get as soon as possible.

Anyhow, it seem that you included third party code (js-file), you should not have that in projects on drupal.org: http://drupal.org/node/422996

eiriksm’s picture

Status: Needs work » Needs review

Thanks for that tip.

Now updated with instructions in README, libraries dependency and checking of installed plugin.

Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch 7.x-1.x http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql

Link to last PAReview: http://ventral.org/pareview/httpgitdrupalorgsandboxeiriksm1409172git

For Drupal 7.

darrell_ulm’s picture

Status: Needs review » Needs work
StatusFileSize
new1.43 KB

Just a few coding issues. See the attached file with the scan results.

Please see documentation standards and coding standards. The documentation is not following convention:
Example:

/**
 * Build the settings form.
 */
function jsonp_sparql_admin_settings($form, &$form_state) 
function jsonp_sparql_admin_settings($form, &$form_state)

This needs to have a full documented header. Same throughout.

See:
http://drupal.org/coding-standards
http://drupal.org/node/1354

eiriksm’s picture

Status: Needs work » Needs review

Thanks for that!

Have added some more documentation, fixed the XHTML style and some other small cleanups. But the pareview warning about filter_xss or check_plain just does not seem to go away, no matter where i put the check. And obviously it is not going to be dangerous either, since it is an internal link, in plain text right there.

Thanks again for reviewing.

Repeat for easy access of the links:

Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch 7.x-1.x http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql

Link to last PAReview: http://ventral.org/pareview/httpgitdrupalorgsandboxeiriksm1409172git

For Drupal 7.

alex dicianu’s picture

StatusFileSize
new215.39 KB

Hi,
I am trying to install your module and I'm getting the following warning.
The JQuery JSONP plugin must be installed in order to do any client side queries. Please go to Status Report for instructions.
In the .install file you check for the 2.2.0 version. I downloaded the latest version which is 2.2.1. The name for the 2.2.1 version is a bit different also. You should fix this with a more robust check.

if (file_exists($path . '/jquery.jsonp-2.2.0.min.js') || file_exists($path . '/jquery.jsonp-2.2.0.js')) {

I've tried to execute a basic sparql query from dbpedia, but I encountered a 404 error. See attachment screenshot. I don't have a proxy.

.module file line 162 ... :)

else: {
  // TODO: Write som clever stuff here.
  dsm('damn');
}
alex dicianu’s picture

Status: Needs review » Needs work
eiriksm’s picture

Status: Needs work » Needs review

Thanks for that!

Have added even more install instructions, now supporting newer versions of the library and more logical error message instead of dsm('damn'). Regarding your error, you have omitted the question mark in the endpoint, so I have updated the description to more clearly stating how to format the endpoint URL.

Thanks again for reviewing.

Repeat for easy access of the links:

Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch 7.x-1.x http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql

Link to last PAReview: http://ventral.org/pareview/httpgitdrupalorgsandboxeiriksm1409172git

For Drupal 7.

eiriksm’s picture

Also, i just realized that projects often have a lot of info in their README or help sections, but are not as thorough on the project page. So I have added detailed installation instructions and a simple, but detailed configuration walkthrough to the project page.

Thanks again for testing!

luxpaparazzi’s picture

Status: Needs review » Needs work

Parareview did not mention any issues.

What is SPARQL and what does a SPARQL endpoint do?
It would be nice having some basic information and maybe an external link at your project page.

/**
 * On uninstall: remove module variables and clear variable cache.
 */
function jsonp_sparql_uninstall() {
  db_query("DELETE FROM {variable} WHERE name LIKE 'jsonp_sparql_%'");
  cache_clear_all('variables', 'cache');
}

You should mention "Implements hook_uninstall()." at the beginning of doc-comment.

'page callback' => '_jsonp_sparql_ajax_test'
Page callbacks should be public functions, so you should remove "_"

Consider putting the following code into a template-function or into event template-file, see http://api.drupal.org/api/drupal/includes!theme.inc/function/theme/7

        $block['content'] .= '<div style="text-align:center;" id="sparqlloading' . $i . '"><img src="' . $base_path . $modulepath . '/img/loading.gif"></div>';
        $block['content'] .= '</div>';
  $form['jsonp_sparql_block_set' . $delta]['second']['jsonp_sparql_test_query_' . $delta] = array(
    '#type' => 'markup',
    '#title' => 'Test Sparql query',
    '#prefix' => '<div class="sparqltestquery" id="jsonp_sparql_querytest_' . $delta . '"><button class="' . $delta . '">' . t('Test Sparql query') . '</button>',
    '#suffix' => '<div class="testquerydesc">' . t('This magic button will also fill out the column presentation in the presentation tab') . '</div></div>',
  );
luxpaparazzi’s picture

The response time for a review is now approaching 4 weeks.
Get a review bonus and we will come back to your application sooner.
See: http://drupal.org/node/1410826

You could for example start by evaluatating my own project:
http://drupal.org/node/1302786

eiriksm’s picture

Status: Needs work » Active

@luxpaparazzi
Thanks for reviewing.

I agree with you on all issues, although they are small. I was actually thinking about adding the theme functions anyway, so this stuff can be overridden.

The repository is now updated with the latest changes you proposed, and the project page includes some links and description about SPARQL.

Thanks again for you feedback, and I appreciate the fact that the review queue is long. I have planned to get to reviewing other projects, but the time is not always on your side (I am sure you know what I mean).

eiriksm’s picture

Status: Active » Needs review

Repeat for easy access of the links, since I also need to change status:

Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch 7.x-1.x http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql

Link to last PAReview: http://ventral.org/pareview/httpgitdrupalorgsandboxeiriksm1409172git

For Drupal 7.

eiriksm’s picture

Issue tags: +PAreview: review bonus

Updated with review bonus links.

klausi’s picture

Status: Needs review » Needs work
Issue tags: -PAreview: review bonus +PAreview: security

Review of the 7.x-1.x branch:

  • Drupal Code Sniffer has found some issues with your code (please check the Drupal coding standards).
    FILE: ...7/sites/all/modules/pareview_temp/test_candidate/jsonp_sparql.admin.inc
    --------------------------------------------------------------------------------
    FOUND 1 ERROR(S) AFFECTING 1 LINE(S)
    --------------------------------------------------------------------------------
     33 | ERROR | Function comment short description must end with a full stop
    --------------------------------------------------------------------------------
    

This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. Get a review bonus and we will come back to your application sooner.

manual review:

  1. "variable_get('jsonp_sparql_blocks_number')": instead of checking the result for this call you can just pass the default value "1" to variable_get() as second parameter.
  2. "t('JSONP SPARQL block') . ' ' . $human_number": don't concatenate variables into translatable strings, use placeholders instead.
  3. "php_eval($phpcode)": I hate it when I see that. Is that really necessary? Executing user provided input is a security and maintenance nightmare. You should only do that if the php module is enabled, so that there is some restriction possible for site administrators. I see that you check for the PHP permission in jsonp_sparql_block_configure(), so it is probably ok.
  4. "function_exists('php_eval')": that function always exists in Drupal, so this check is not necessary.
  5. "t('The SPARQL endpoint at !server did not answer our request. The error returned was: !error', array('!server' => $server, '!error' => $data->error))": this is vulnerable to XSS exploits, as $server is user provided input and needs to be sanitized. See http://drupal.org/node/28984 . Use the "@" placeholder and t() will run check_plain() automatically for you.
  6. "drupal_add_js('Drupal.jsonpSparqlParse(' . $i . ', ' . $data . ');',": $data is untrusted third party input. You can't just embed it like that, as the server could return a malicious script snippet that would get embedded and executed. Why can't you pass the response as javascript setting?
  7. jsonp_sparql.js: Contains a strange first character, see http://drupalcode.org/sandbox/eiriksm/1409172.git/blob/refs/heads/7.x-1....
  8. jsonp_sparql_form.js: "$(document).ready(function() {": I think you should use Drupal.behaviors instead. See http://drupal.org/node/756722 and http://drupal.org/node/304258#drupal-behaviors
  9. "Drupal.t('Oh no. An error. The server returned an error code !code with the following message: !error', {'!code': data['code'], '!error': data['error']}": again, you should use the "@" placeholder to be safe.
  10. "module_exists('libraries')": that call is useless as you module depends on libraries anyway, so remove it.
  11. jsonp_sparql_admin_settings(): no need to check for the library again here, hook_requirements() already ensures that.
  12. jsonp_sparql_block_save(): It is too late to check for access here. And you already check in jsonp_sparql_block_configure(), so remove the check here.
  13. "'#title' => 'Custom PHP code to use for input',": all user facing text must run through t() for translation. Same for "array(TRUE => 'yes', FALSE => 'no'),". Please check all your strings.

Removing review bonus tag, you can add it again if you have done another 3 reviews of other projects.

eiriksm’s picture

Status: Needs work » Needs review

Thanks a lot for reviewing. Your review is very helpful!

I have some comments on some of the points though:

3. I agree with this, and understand the concern for php_eval(). But I wanted to include it for maximum flexibility (and I needed it for the project the module was developed for) so it is included as an option. And, as you say, the access is thoroughly checked (JSONP SPARQL flags restricted access, and php_eval is a permission independent of this and also states that this is dangerous. I also include a warning in the description, if you are using this.) So keeping it for now (since you also say it is OK). After all, block module uses it as well. :)

4. That is actually not true. php_eval only exists if php module is enabled (it is defined in php.module). And the !empty($access_php) will always validate for user 1, even though php module is not enabled (I tested!). A WOD would be the result if I did not have this check. I did double check this, and can confirm that the check really is necessary. I did however change it to module_exists('php'), as it is for example used in the block module.

12. If I don't check for access here, there will be PHP notices for people with block edit access (that for example wants to change the title of the block) when they save the block. These notices will result in overriding the variables with nothing, and breaking the block. So keeping this as it is, as I really think it is needed.

Please let me know if any of my comments are wrong. Other than that, now updated with all the points listed. Thanks for spotting them! Also found another BOM in the other js file (as you pointed out for jsonp_sparql.js in point 7), and fixed that as well.

eiriksm’s picture

Issue summary: View changes

Review bonus

eiriksm’s picture

Issue tags: +PAreview: review bonus

Adding review bonus tag.

klausi’s picture

Status: Needs review » Reviewed & tested by the community
Issue tags: -PAreview: review bonus

manual review:

  1. jsonp_sparql_ajax_test(): you should use drupal_json_output().
  2. jsonp_sparql_admin_settings(): you could use element_validate_number() as #element_validate callback.

But otherwise looks RTBC to me. Removing review bonus tag, you can add it again if you have done another 3 reviews of other projects.

patrickd’s picture

Status: Reviewed & tested by the community » Fixed

Thanks for your contribution and welcome to the community of project contributors on drupal.org!

I've granted you the git vetted user role which will let you promote this to a full project and also create new projects as either sandbox or "full" projects depending on which you feel is best.

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

As you continue to work on your module, keep in mind: Commit messages - providing history and credit and Release naming conventions.

Thanks to the dedicated reviewer(s) as well.

eiriksm’s picture

Thanks!

And thank you for the very helpful process it has been to have the code reviewed. I have learned a lot, and changed a couple of habits to the better :)

Thanks to the helpful reviewers also!

Automatically closed -- issue fixed for 2 weeks with no activity.

Anonymous’s picture

Issue summary: View changes

Updated issue summary.