[Haskell-cafe] ANNOUNCE: Bravo-0.1.0

[Matthias Reisner]

Am 12.03.2010 05:37 schrieb Matthias Reisner:
> Hi Michael
>
> Am 12.03.2010 01:33 schrieb Michael Snoyman:
>> I'll need to look into the library a bit more to get a better idea, 
>> but it
>> seems like Bravo could work for my needs. One thing that concerns me 
>> is your
>> comment that it allows embedding of Haskell expressions. In general, 
>> I try
>> to keep a strict separation between login and presentation: can you 
>> explain
>> exactly what type of expressions can be embedded?
>
> This is really one disadvantage of the current Bravo version I'm 
> worrying about too. At the moment you can insert arbitrary Haskell 
> expressions, so no one prevents the template writer from inserting 
> expressions like `unsafePerformIO launchAtomicMissile >> return ""'. 
> Some kind of security mechanism will definitely be included in future 
> releases, but I'm not sure in what way at the moment. I thought about 
> passing a list of permitted function names to the template creation 
> function and then failing with an error if any other functions are used.

Today I thought about a security mechanism for Bravo and came to the 
simple solution: There actually is no need for it! If you don't trust 
your template writers, just do the following: Create a new module and 
import all functions you permit to be used in your templates (or hide 
functions from the Prelude). Call the template creation functions within 
this module and export all created data structures. Perhaps different 
templates may access different sets of permitted functions, so just 
create a module for each of these sets.

Meanwhile I created the wiki page for Bravo and added an example that 
illustrates the problem (see 
http://www.haskell.org/haskellwiki/Bravo#Security_concerns).

>
>> Finally, I can't seem to get it to compile on 6.12. Any chance of 
>> getting a
>> version out that supports it?
>
> The problem seems to be haskell-src-meta, that doesn't like 
> template-haskell-2.4, and on the other side I can't get build 
> template-haskell < 2.4 with GHC-6.12. So I will contact Matt Morrow, 
> the maintainer of haskell-src-meta, and see if he can fix it.

Matt didn't reply yet, but there already is a patched haskell-src-meta 
version available at http://moonpatio.com/repos/haskell-src-meta_NEW_TH. 
I updated Bravo to be compatible with this version.


Regards,

Matthias