- web-devel - Haskell.org

Security update: update to warp 2.0.3.3
by Michael Snoyman 06 Mar '14

06 Mar '14

We received a security report yesterday of a regression in the Warp 2.0 series[1] related to Slowloris protection. Please see the issue for details. The important information is: * Versions prior to 2.0 are not affected. * Updating to 2.0.3.3 solves the problem. Yesod users: I've just released a new version of yesod-platform which updates the warp dependency. If there are any questions, please let me know. [1] https://github.com/yesodweb/wai/issues/231

2 1

Proposed change to WAI: responseRaw
by Michael Snoyman 05 Mar '14

05 Mar '14

I've just tested out a new feature in WAI, which is available for testing on the raw-response branch[1]. Here's a summary of the change itself and its purpose. If there are no objections, I'm planning on releasing this as WAI 2.1. The goal is to have better support for WebSockets. WAI 2.0 and earlier are based purely around request/response pairs, without interleaving of reads and writes. There is some ambiguity about that interleaving when it comes to streaming responses[1], but essentially, WAI does not currently support the ability to have bidirectional communications with a client. The current wai-websockets package ties into a special settings hook provided by Warp (settingsIntercept). While this works, it makes it difficult to provide websockets support as a first-class citizen of a web framework. It also makes creating a WebSockets-aware HTTP reverse proxy more involved and less efficient. The proposed change comes down to a single new function in Network.Wai: responseRaw :: (C.Source IO B.ByteString -> C.Sink B.ByteString IO () -> IO ()) -> Response -> Response This would including a corresponding addition of a ResponseRaw constructor to Resonse. The idea is that the application would provide a function which takes a Source of bytes from the client, a Sink for sending bytes to the client, and the web server would provide that source/sink to the application. Since not all backends will support responseRaw (e.g., CGI), there is a requirement for a backup Response to be provided, which will be used in those cases. This is a very minor breaking change to the existing API. Only code which explicitly pattern matches on Response constructors will be affected, and even there the necessary changes are trivial (see the changes on the raw-response branch). Are there any objections to this change, or recommendations for ways to make it better? Michael [1] And in fact, I first tried implementing this change purely using the existing streaming response interface. However, after attempting it, it felt like too much of a hack, so I went for the responseRaw approach instead.

3 2

Re: [web-devel] Upgrading to warp 2
by Bardur Arantsson 25 Feb '14

25 Feb '14

On 2014-02-25 05:49, Michael Snoyman wrote: > On Mon, Feb 24, 2014 at 11:00 PM, Bardur Arantsson <spam(a)scientician.net>wrote: (I've taken the liberty of CC'ing the list.) > >> Hi all, >> [--snip--] >> When I try this I get: >> >> src/Handlers.hs:96:54: >> No instance for (MonadResource IO) >> arising from a use of `sourceFileRange' >> Possible fix: add an instance declaration for (MonadResource IO) >> In the second argument of `($)', namely >> `sourceFileRange sfp (Just l') (Just n)' >> In the expression: >> mapOutput (Chunk . fromByteString) >> $ sourceFileRange sfp (Just l') (Just n) >> In an equation for `src': >> src >> = mapOutput (Chunk . fromByteString) >> $ sourceFileRange sfp (Just l') (Just n) >> >> ... which I guess kinda makes sense -- you'd need a ResourceT (or >> similar) in the monad stack. I'm just not sure how or where to introduce >> the ResourceT to get this working. >> >> If I introduce an explicit type signature for "src", >> >> src :: forall m . MonadResource m => Source m (Flush Builder) >> >> then that line compiles, but I get the equivalent error at the usage >> site of "src" in the third argument to "responseSource" (which again >> also makes sense). >> >> Anyone got any pointers? >> >> Regards, >> >> > Firstly, why aren't you just using responseFile[1]? That will be more > efficient than using a Source directly, since Warp is able to use the > sendfile system call, not to mention all of Kazu's fancy fd-caching logic. > Even on a non-Warp backend, the functionality can simply degrade to being > the same as using a Source. Also, not sure if it's relevant, but Warp can > automatically handle range requests for you, so if you simply return a > responseFile and the user requests part of the file, Warp will > automatically generate the 206 response. > ResponseFile is broken for some clients (with Linux host at least), specifically my type of client, a PlayStation 3 (UPnP media player). There was a Thread of Doom(TM) about it on haskell-cafe, but it caused FD leaks, though we never found out quite *why* it was broken that way. (Things may have changed since this was in February 2010, but frankly I don't even care to spend the time to find out -- I don't need the performance anyway. I think I remember testing the WAI/Warp sendfile equivalent in pre-2.0 WAI/Warp and finding that it still had the same problem.) > Anyway, the issue here is that in WAI 2.0, we removed ResourceT from the > WAI stack for efficiency reasons. Yup, I noticed that ;) > That makes the cases where you *do* need > to safely allocate scarce resources like a file handle a bit trickier. In > this case, I wouldn't bother with ResourceT at all, but instead explicitly > use the bracket pattern, via responseSourceBracket, openFile, and > closeFile. This would look like: > > serveFile :: Integer -> [(Maybe Integer, Maybe Integer)] -> IO Response > serveFile fsz [(l,h)] = do > let l' = maybe 0 id l > let h' = maybe (fsz-1) id h > let n = (h' - l' + 1) > let src h = mapOutput (Chunk . fromByteString) $ sourceHandleRange h > (Just l') (Just n) > sfp = "foo.hs" > responseSourceBracket > (IO.openFile sfp IO.ReadMode) (IO.hClose) $ \h -> > return (partialContent206, [], src h) > > > [1] > http://hackage.haskell.org/package/wai-2.0.0/docs/Network-Wai.html#v:respon… > Ah, yes, this works! I had noticed responseSourceBracket, but (stupidly) didn't actually try it. Thank you very much. Regards,

2 1

Upgrading to warp 2
by Bardur Arantsson 24 Feb '14

24 Feb '14

Hi all, So I decided to upgrade one of my programs to Warp 2.x, but I'm getting stuck on generating the Response from a "sourceFileRange" (from Data.Conduit.Binary). Here's a snippet of the relevant code: serveFile :: Integer -> [(Maybe Integer, Maybe Integer)] -> IO Response serveFile fsz [(l,h)] = do let l' = maybe 0 id l let h' = maybe (fsz-1) id h let n = (h' - l' + 1) let src = mapOutput (Chunk . fromByteString) $ sourceFileRange sfp (Just l') (Just n) return $ responseSource partialContent206 [ hdrContentLength n , (hContentType, mimeType) , hdrContentRange l' h' fsz , hdrAcceptRangesBytes , hdrConnectionClose ] src When I try this I get: src/Handlers.hs:96:54: No instance for (MonadResource IO) arising from a use of `sourceFileRange' Possible fix: add an instance declaration for (MonadResource IO) In the second argument of `($)', namely `sourceFileRange sfp (Just l') (Just n)' In the expression: mapOutput (Chunk . fromByteString) $ sourceFileRange sfp (Just l') (Just n) In an equation for `src': src = mapOutput (Chunk . fromByteString) $ sourceFileRange sfp (Just l') (Just n) ... which I guess kinda makes sense -- you'd need a ResourceT (or similar) in the monad stack. I'm just not sure how or where to introduce the ResourceT to get this working. If I introduce an explicit type signature for "src", src :: forall m . MonadResource m => Source m (Flush Builder) then that line compiles, but I get the equivalent error at the usage site of "src" in the third argument to "responseSource" (which again also makes sense). Anyone got any pointers? Regards,

1 0

Add session header to response of Wai.Application.Static.staticApp
by Leif Warner 17 Feb '14

17 Feb '14

I want to add a session cookie header to the response of staticApp. Now, I know that adding a "session" to a static file doesn't make sense. I just figured I'd set the session once on the splash page, rather than risk generating multiple sessions for the subsequently fetched "dynamic" resources. (They're actually static files, but per-user copies of the static files.) I was maybe hoping for something along the lines of: do response <- (staticApp $ defaultWebAppSettings ".") request return $ response { responseHeaders = sessionCookie : responseHeaders response } But that will tell me "`responseHeaders' is not a record selector". staticApp returns either ResponseFile, or ResponseBuilder (304 "Not Modified"). I could import Network.Wai.Internal, pattern match on those, and return those w/ the added header. That seems a bit crufty, though - was hoping someone could suggest a more elegant solution? Maybe some Lens or Functor instance across a response's headers, I dunno. -Leif

1 1

template for happstack project
by cdep.illabout+hweb＠gmail.com 05 Jan '14

05 Jan '14

I am looking for a good template to use for a happstack project. I want to write a dynamic site (like a blog or a twitter clone) using happstack, and I am looking for a project template for a site based on happstack. Ideally the template project would include things like: 1) some sort of html templater (like heist? hsx? or even blaze-html?) 2) some sort of javascript [translation?] library (like jmacro or fay) 3) a small example of working with RqData 4) some sort of form library (reform?) 5) type-safe routing (web-routes?) 6) some sort of db-layer (acid-state or persistent) It would also be nice to see the "recommended" layout for the actual source files on disk. For example, how to split source code up in some fashion (MVC?). I guess an example project would be just as good as a project template... Does anyone know of something like this?

1 0

Upgrading from WAI 1.4.1 to 2.0.0, Monad / ResourceT issues
by Leif Warner 09 Dec '13

09 Dec '13

Trying to upgrade this code from WAI 1.4.1 to 2.0.0. On one hand, I don't have to liftIO the IO action on line 23 anymore. On the other, this line that writes the request body to a file seems to be giving me some trouble now: https://github.com/LeifW/online-typechecker/blob/master/index.hs#L22 No instance for (MonadResource IO) arising from a use of `sinkFile' Possible fix: add an instance declaration for (MonadResource IO) In the second argument of `($$)', namely `sinkFile ("sources" </> fromText name)' In a stmt of a 'do' block: requestBody req $$ sinkFile ("sources" </> fromText name) If I put a "runResouceT" in front of that, like "runResourceT $ requestBody req $$ sinkFile ("sources" </> fromText name)", I get Couldn't match type `IO' with `ResourceT IO' Expected type: Data.Conduit.Internal.Source (ResourceT IO) Data.ByteString.Internal.ByteString Actual type: Data.Conduit.Internal.Source IO Data.ByteString.Internal.ByteString In the return type of a call of `requestBody' In the first argument of `($$)', namely `requestBody req' In the second argument of `($)', namely `requestBody req $$ sinkFile ("sources" </> fromText name)' Any pointers?

2 1

Lista de emails como fazer um email marketing lista de emails
by Ed Soares 24 Nov '13

24 Nov '13

Lista de emails como fazer um email marketing lista de emails trabalho com mala direta bem como lista de emails, email marketing gratis emails empresas: http://www.maladiretaemails.com realmente é mala direta, é fantástico para a maioria das pessoas. email lista gratis list mail além disso lista de emails, enderecos de email email marketing, a intenção de nosso website. se você deseja lista de mail, email marketing gratis e bem como trabalhe com mala direta: http://www.maladiretaemails.com é excelente lista email incluindo envio de emails, email lista gratis mailing. é muito bom emails lista bem como o que é email marketing. mala direta como fazer emails de pessoas, emails empresas. nos dias de hoje email cadastro que contenham Enviar email, servidor de email é excelente. será o propósito de nosso website: email marketing gratis, Enviar email, e programa para enviar e mail. Oferecemos o melhor em email cadastro programa para enviar e mail, mala direta como fazer.

1 0

simple-sendfile 0.2.13
by Kazu Yamamoto 11 Oct '13

11 Oct '13

Hi, I have just released simple-sendfile 0.2.13. In this version, I modified the source code for Linux so that I can take profile easier. All tests are passed. Buf if you find something wrong on Linux, please let me know. --Kazu

1 0

http-client library
by Michael Snoyman 04 Oct '13

04 Oct '13

After some discussion with Kazu, I'm planning on starting work on a new package called http-client. The goal will be to separate out the core functionality from http-conduit into a lower-dependency package. In particular, I'm hoping to get a package without dependencies on tls, conduit, or resourcet. The motivations for this are: * Kazu and I need a lighter-weight library for testing out Warp. * With WAI 2.0 coming out, the resourcet-dependent interface of http-conduit currently doesn't make as much sense. * By separating things out like this, I believe we can get clean things up. * The vast majority of the http-conduit codebase has nothing at all to do with TLS or conduit support. Persistent connections, cookie handling, multipart forms, chunking, etc, all fall purely into the realm of raw HTTP support. By getting these core features out there separately, people will be able to take advantage of them without reinventing the wheel. Is there any interest from others in this project? If so, please let me know, as specific requests can help guide the API decisions I make.

2 1