- web-devel - Haskell.org

HEADS-UP: security fix, please upgrade clientsession to >= 0.7.3.1
by Felipe Almeida Lessa 03 Oct '11

03 Oct '11

Hello! Please be advised that clientsession < 0.7.3.1 is vulnerable to timing attacks [1]. We have just released a fix and it's already on Hackage [2]. We advise all users of clientsession (and, consequently, Yesod) to upgrade as soon as possible to a version >= 0.7.3.1. With a timing attack a malicious user may be able to construct a valid MAC for his message. However, the attacker is not able to recover the MAC key or the encryption key. So you don't need to change your keys, just upgrade ASAP. Cheers, =) [1] https://github.com/snoyberg/clientsession/pull/4 [2] http://hackage.haskell.org/package/clientsession-0.7.3.1 -- Felipe.

1 1

Happstack plugin warnings
by Asafe Ribeiro 24 Sep '11

24 Sep '11

Hi, I'm using the happstack plugin to avoid recompiling my templates. However if I get a warning my page does not render, instead it shows the warnings on the browser. Is there any workaround ?

2 1

Yesod development server auto-build
by Ramon Snir 24 Sep '11

24 Sep '11

I'm trying out Yesod, but when the Yesod development server is running, on every file change it rebuilds the application. A great feature, but when saving several files (with Ctrl+Shift+S), it builds the application multiple times - once for every file. Is there a way to configure it so it won't do that? Thanks, Ramon Snir *---* *"What better use is there for the human body, than to serve the human mind?"* -- Freeman J. Dyson

1 0

yesod init && wai-handler-devel
by Balázs Endrész 05 Sep '11

05 Sep '11

Hi everyone, I've just tried Yesod for the first time, and managed to get the site produced by the scaffolder working with wai-handler-devel. But currently there seem to be a couple of issues with it: 1.) #ifdef WINDOWS macros doesn't work with wai-handler-devel, on Windows it tries to load System.Posix.Signals in Application.hs 2.) in wai-handler-devel.hs I had to set the `yesod` field of the `Devel` data type to True because otherwise it wouldn't work 3.) in Application.hs the withFoundation function takes two extra arguments, so it produces a scary error message if one tries `wai-handler-devel 3000 Application withFoundation`. This can be solved with something like this: withFoundation' f = do conf <- Settings.loadConfig Settings.Development -- logger <- makeLogger let logger = undefined s <- static Settings.staticDir Settings.withConnectionPool conf $ \p -> do runConnectionPool (runMigration migrateAll) p let h = Foundation conf logger s p toWaiApp h >>= f but then the logger produces some strange things: Interpreting success, new app loaded GET / Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 GET /static/css/normalize.css AccepGtE:T t/esxtta/tciscs/,t*m/p*/;-qf=n0M.a15 eGBE.Tc s[Gs(E "TAE cT/ckse7tp_atft:2i vct"/e,tx"mt"p/)/c]5s ts-,J*H/Q*-;Sq.=j0s. 1A ccept: */* GET /favicon.ico Accept: */* AAAcccccceeepppttt::: *tt/ee*xx tt//ccssss,,**//**;;qq==00..11 What could be the problem here?

2 1

Re: [web-devel] Handling disconnection in wai or warp
by Michael Snoyman 01 Sep '11

01 Sep '11

I think this does what you're looking for. Note how we have to handle the exception (via finally) that's thrown by the closing connection: {-# LANGUAGE OverloadedStrings #-} import Network.Wai (Application, Response (ResponseEnumerator)) import Network.Wai.Handler.Warp (run) import Network.HTTP.Types (status200) import Data.Enumerator (run_, ($$), enumList) import Blaze.ByteString.Builder.Char.Utf8 (fromShow) import Control.Exception (finally) main :: IO () main = run 3000 app app :: Application app _ = return $ ResponseEnumerator $ \f -> run_ (enum $$ f status200 [("content-type", "text/plain")]) `finally` cleanup where enum = enumList 8 $ map fromShow [1 :: Int ..] cleanup = putStrLn "Connection closed" On Thu, Sep 1, 2011 at 6:38 AM, Hiromi ISHII <konn.jinro(a)gmail.com> wrote: > Thanks Michael and Gregory. > > On 2011/08/29, at 19:07, Michael Snoyman wrote: > >> I'm not entirely certain what's going on here, but my guess is that >> for either WAI or Snap you'd want to use the enumerator interface >> instead of lazy ByteStrings. > > I understand that I have to use ResponseEnumerator to build a response to achieve my goal, right? > If so, how to handle disconnections in ResponseEnumerator? > >> Also, for WAI, you should *not* set the >> transfer-encoding, that is something the backend handles for you >> automatically. > Thanks. I fiexed it. > > On 2011/08/29, at 22:10, Gregory Collins wrote: > >> Correct, with either WAI or Snap you will need to write an enumerator >> to do this. > > You mean I have to use addToOutput function instead of writeLBS? > I rewrote my code using addOutput as below: > > = Snap Code = > stream :: Application () > stream = do > req <- withRequest $ return . (rqRemoteAddr &&& rqRemotePort) > addToOutput $ myEnumerator > logError "this would never be happened..." > > myEnumerator (Continue k) = k (Chunks $ map fromLazyByteString $ map (LBS.pack . show) [1..]) > myEnumerator s@(Error err) = liftIO (print err) >> returnI s > myEnumerator step@(Yield _ _) = liftIO (putStrLn "yielded.") >> returnI step > = end = > > Running snap server using this code, I accessed the page from browser and disconnect, but nothing is written in the log. > What's my mistakes? > > > In addition, I tried to use 'settingsOnException' to handle the Exception in WAI. > It could handle disconnection, but I couldn't know which conneciton is closed. > Is there any method to know which connection is closed? > > > -- Hiromi ISHII > konn.jinro(a)gmail.com > > > >

1 0

Issues with aeson encoding performance
by Chris Smith 30 Aug '11

30 Aug '11

I know a lot of you use aeson for JSON encoding, and I get the feeling I'm doing something wrong here, so if you can give me some kind of a hint, I'd appreciate it. The aeson package description talks about getting up to around 40K messages per second from the encoding, but I'm pegging the CPU at 100% just trying to send 10 messages per second. Profiling (which is a REAL pain to reproduce, since the GHC API is involved... but I locally butchered a copy of the code enough to route around that) shows JSON serialization taking 98% of the CPU and doing 99.8% of allocations (on the order of 5 GB of total allocation if I leave it running for 15 seconds). Heap profiling also shows the vast majority of the heap occupied by aeson's types (Value, Number, etc), and with huge spikes. The streaming code -- very straightforward; it just repeatedly does a toJSON (getValue (f t)) at most once every 0.1 seconds -- is at https://github.com/cdsmith/gloss-web/blob/master/src/Main.hs#L188 and the serialization (of Gloss's Picture data type) is at https://github.com/cdsmith/gloss-web/blob/master/src/Instances.hs#L106 The code to build the Picture data type is the "animation" function in the second example at: http://cdsmith.wordpress.com/2011/08/20/animations-added-to-web-based-haske… Any ideas? I'm about to try rewriting the JSON serialization to avoid aeson, but before I go there, I thought I'd ask if anyone sees something obviously wrong here. -- Chris Smith

3 4

Handling disconnection in wai or warp
by Hiromi ISHII 29 Aug '11

29 Aug '11

Hi there, I am writing a simple server which returns infinite stream of data to client like Twitter's streaming API. I have to manage the number of clients and the connection times of each one. So I have to handle disconnections during server sending a response to the client. I'm currently considering using wai (+warp) or snap framework. My code fragments for snap and wai are below: ==== snap ver. application ==== stream :: Application () stream = do req <- withRequest $ return . (rqRemoteAddr &&& rqRemotePort) writeLBS $ LBS.unlines $ map (LBS.pack . show) [1..] -- I have to handle disconnection here ==== end ==== ==== wai ver. ==== streamHandler :: Application streamHandler req = do return $ responseLBS statusOK [ ("Content-Type", "application/json") , ("Transfer-Encoding", "chunked") ] (LBS.unlines $ map (LBS.pack . show) [1..]) -- I have to handle disconnection here ==== end ==== Thanks, -- Hiromi ISHII

3 2

Yesod: Dynamic subdomains
by "Timo B. Hübel" 27 Aug '11

27 Aug '11

Hi, I am building a Yesod web app which should support dynamic subdomains. I.e. a user registers as "foobar" on http://www.example.com and can afterwards access her content via http://foobar.example.com Is this possible at all? I am wondering, because the server name is somehow hard coded in Settings.hs as approot. If it is possible: How do I access the domain name in a handler function? Thanks! Timo

3 5

WAI or Snap and the EventSource API
by Mathias Biilmann Christensen 27 Aug '11

27 Aug '11

Hi there, I've been experimenting a bit with the new EventSource API ( http://hacks.mozilla.org/2011/06/a-wall-powered-by-eventsource-and-server-s… ). EventSource looks like a much nicer alternative to WebSockets in all the cases where the connection doesn't really need to be bi-directional (ajax request to push to the server, Event Source to push to the client). It doesn't require a new protocol and should be trivial to pass through HTTP aware load balancers, cache proxies and so on. Have been trying to get either Snap or Warp to serve up an EventSource endpoint, but so far I'm stuck at not being able to get any of them to actually write to the response body before the request is all over. Here's some example code: Snap based: https://gist.github.com/1174102 WAI/Warp based: https://gist.github.com/1174632 The code is mostly the same apart from the glue to the web server. In both cases I'm trying a silly enumerator that gets messages from the keyboard and pass them to the iterator. It all compiles and kinda works, but nothing gets written to the response before I end the enumeration with "q". Any hints on what I'm doing wrong? Or any example code for controlling writes to the response body during a long request? Cheers, Mathias

2 1

wai-logger v0.0.1
by Kazu Yamamoto 25 Aug '11

25 Aug '11

Hello, I have released wai-logger v0.0.1. - This version removes the date thread. Instead new cache mechanism suggested on this ML was implemented. - This version still uses Data.Time. This is because C's strftime did not contribute to improve performance according to my benchmark. - Experimental APIs for Builder are provided: apacheFormatBuilder and hPutBuilder. These APIs are slower but will be revisited when new ByteString library will become available. --Kazu

3 4