Am 12.03.2010 05:37 schrieb Matthias Reisner:
Hi Michael
Am 12.03.2010 01:33 schrieb Michael Snoyman:
I'll need to look into the library a bit more to get a better idea, but it seems like Bravo could work for my needs. One thing that concerns me is your comment that it allows embedding of Haskell expressions. In general, I try to keep a strict separation between login and presentation: can you explain exactly what type of expressions can be embedded?
This is really one disadvantage of the current Bravo version I'm worrying about too. At the moment you can insert arbitrary Haskell expressions, so no one prevents the template writer from inserting expressions like `unsafePerformIO launchAtomicMissile >> return ""'. Some kind of security mechanism will definitely be included in future releases, but I'm not sure in what way at the moment. I thought about passing a list of permitted function names to the template creation function and then failing with an error if any other functions are used.
Today I thought about a security mechanism for Bravo and came to the simple solution: There actually is no need for it! If you don't trust your template writers, just do the following: Create a new module and import all functions you permit to be used in your templates (or hide functions from the Prelude). Call the template creation functions within this module and export all created data structures. Perhaps different templates may access different sets of permitted functions, so just create a module for each of these sets. Meanwhile I created the wiki page for Bravo and added an example that illustrates the problem (see http://www.haskell.org/haskellwiki/Bravo#Security_concerns).
Finally, I can't seem to get it to compile on 6.12. Any chance of getting a version out that supports it?
The problem seems to be haskell-src-meta, that doesn't like template-haskell-2.4, and on the other side I can't get build template-haskell < 2.4 with GHC-6.12. So I will contact Matt Morrow, the maintainer of haskell-src-meta, and see if he can fix it.
Matt didn't reply yet, but there already is a patched haskell-src-meta version available at http://moonpatio.com/repos/haskell-src-meta_NEW_TH. I updated Bravo to be compatible with this version. Regards, Matthias