[Haskell-cafe] ANNOUNCE: Bravo-0.1.0
matthias.reisner at googlemail.com
Tue Mar 23 22:13:33 EDT 2010
Am 12.03.2010 05:37 schrieb Matthias Reisner:
> Hi Michael
> Am 12.03.2010 01:33 schrieb Michael Snoyman:
>> I'll need to look into the library a bit more to get a better idea,
>> but it
>> seems like Bravo could work for my needs. One thing that concerns me
>> is your
>> comment that it allows embedding of Haskell expressions. In general,
>> I try
>> to keep a strict separation between login and presentation: can you
>> exactly what type of expressions can be embedded?
> This is really one disadvantage of the current Bravo version I'm
> worrying about too. At the moment you can insert arbitrary Haskell
> expressions, so no one prevents the template writer from inserting
> expressions like `unsafePerformIO launchAtomicMissile >> return ""'.
> Some kind of security mechanism will definitely be included in future
> releases, but I'm not sure in what way at the moment. I thought about
> passing a list of permitted function names to the template creation
> function and then failing with an error if any other functions are used.
Today I thought about a security mechanism for Bravo and came to the
simple solution: There actually is no need for it! If you don't trust
your template writers, just do the following: Create a new module and
import all functions you permit to be used in your templates (or hide
functions from the Prelude). Call the template creation functions within
this module and export all created data structures. Perhaps different
templates may access different sets of permitted functions, so just
create a module for each of these sets.
Meanwhile I created the wiki page for Bravo and added an example that
illustrates the problem (see
>> Finally, I can't seem to get it to compile on 6.12. Any chance of
>> getting a
>> version out that supports it?
> The problem seems to be haskell-src-meta, that doesn't like
> template-haskell-2.4, and on the other side I can't get build
> template-haskell < 2.4 with GHC-6.12. So I will contact Matt Morrow,
> the maintainer of haskell-src-meta, and see if he can fix it.
Matt didn't reply yet, but there already is a patched haskell-src-meta
version available at http://moonpatio.com/repos/haskell-src-meta_NEW_TH.
I updated Bravo to be compatible with this version.
More information about the Haskell-Cafe