6 ms·

This new, awesome site is using the framework Yesod[0], which is kinda like the Rails of the Haskell world, only it can do rad stuff like prevent XSS and 404s a

This new, awesome site is using the framework Yesod[0], which is kinda like the Rails of the Haskell world, only it can do rad stuff like prevent XSS and 404s at compile time. Yes, you read that right. [0] http://www.yesodweb.com/ http://www.yesodweb.com/

vmiroshnikov 12y ago
Btw, there's also a sinatra inspired framework – scotty (https://github.com/scotty-web/scotty https://github.com/scotty-web/scotty)
- spopejoy 12y ago
  "Bare" snap (snap-core and snap-server) are Sinatra-like too.
arianvanp 12y ago
You know what is REALLY cool? Almost all haskell web frameworks use the Web Application Interface[0]. Which is a unified interface for haskell web applications. This means you can mount web applications written in OTHER frameworks under your routes and vica versa. [0] http://www.stackage.org/package/wai http://www.stackage.org/package/wai
- icebraining 12y ago
  Yeah, wsgi was also cool when it appeared for Python, back in 2003.
- MaxGabriel 12y ago
  Is WAI that popular? I thought Yesod/Scotty used it, but Snap/Happstack did not.
rimantas 12y ago
Tell me more about preventing 404 at compile time. I call http://www.yesodweb.com/bullshit http://www.yesodweb.com/bullshit
- chrisdotcode 12y ago
  http://www.yesodweb.com/book/shakespearean-templates#shakespearean-templates_type_safe_urls http://www.yesodweb.com/book/shakespearean-templates#shakesp... If you're used to only programming in dynamic languages, it can be a shock, but yes, a good type system can do things you never thought possible. If you were the downvoter, I'll take my vote back now.
  - theoh 12y ago
    I don't know who the downvoter is but I think it's a silly claim to be proud of. Anything more complex than a simple template system can enforce referential integrity of internal links by making the programmer refer to other pages on the site with some kind of handle. It's not rocket science and doing it with the (elaborate) type system isn't necessarily a selling point, in my opinion.
- grey-area 12y ago
  Presumably the idea is that you can prevent your site having broken internal links by constructing links with data types and checking the links when creating them at compile time. You could actually do something similar in most languages, even dynamic ones, so I don't see what is specific to haskell about it, e.g. rails has link_to and friends which require you to have a route set up in order to link to it (though not compile time). Golang has similar protection for XSS and reverse routes on routers if you require it so again not specific to Haskell. Clearly you won't be able to prevent (nor would you want to) links like yours above from being a 404, so perhaps no more internal 404s would be more accurate.
  - dmit 12y ago
    Let's be fair here, while you can detect invalid internal links in dynamic languages at runtime, the end result is basically the same for the user - a 404 or a 503 are equally bad in this case. That's the advantage of compiled languages over dynamic ones in these kinds of scenarios: you sacrifice immediate feedback during development to gain a guarantee from the compiler that all invariants you embedded in the application uphold. And the more powerful the language/compiler combination, the more compile-time guarantees you can specify.
akurilin 12y ago
Yesod is a real gem, been using it for most of our web applications and I discover new great things about it every day.
raiph 12y ago
It sounds like the feature you're highlighting here is static checking at compile-time of how routes are going to resolve at run-time. Is that right? Afaict Perl 6 covers this case: http://jnthn.net/papers/2015-fosdem-static-dynamic.pdf#page=75 http://jnthn.net/papers/2015-fosdem-static-dynamic.pdf#page=... Or am I missing something?
runeks 12y ago
How does it prevent XSS?
- QuixoticChris 12y ago
  2. XSS injection. Any html coming back from a form will be efficiently sanitized just once on arrival. Unsanitized strings will be sanitized before being displayed. http://www.yesodweb.com/page/about http://www.yesodweb.com/page/about I suspect this is accomplished through safe vs. unsafe types. Imagine the only function from `unsafe___` to `safe___` is the escape function, and all functions giving text back in responses is require to be of type `safe___`.

vmiroshnikov 12y ago

Btw, there's also a sinatra inspired framework – scotty (https://github.com/scotty-web/scotty https://github.com/scotty-web/scotty)

spopejoy 12y ago
"Bare" snap (snap-core and snap-server) are Sinatra-like too.

arianvanp 12y ago

You know what is REALLY cool? Almost all haskell web frameworks use the Web Application Interface[0]. Which is a unified interface for haskell web applications. This means you can mount web applications written in OTHER frameworks under your routes and vica versa. [0] http://www.stackage.org/package/wai http://www.stackage.org/package/wai

icebraining 12y ago
Yeah, wsgi was also cool when it appeared for Python, back in 2003.
MaxGabriel 12y ago
Is WAI that popular? I thought Yesod/Scotty used it, but Snap/Happstack did not.

rimantas 12y ago

Tell me more about preventing 404 at compile time. I call http://www.yesodweb.com/bullshit http://www.yesodweb.com/bullshit

chrisdotcode 12y ago
http://www.yesodweb.com/book/shakespearean-templates#shakespearean-templates_type_safe_urls http://www.yesodweb.com/book/shakespearean-templates#shakesp... If you're used to only programming in dynamic languages, it can be a shock, but yes, a good type system can do things you never thought possible. If you were the downvoter, I'll take my vote back now.
- theoh 12y ago
  I don't know who the downvoter is but I think it's a silly claim to be proud of. Anything more complex than a simple template system can enforce referential integrity of internal links by making the programmer refer to other pages on the site with some kind of handle. It's not rocket science and doing it with the (elaborate) type system isn't necessarily a selling point, in my opinion.
grey-area 12y ago
Presumably the idea is that you can prevent your site having broken internal links by constructing links with data types and checking the links when creating them at compile time. You could actually do something similar in most languages, even dynamic ones, so I don't see what is specific to haskell about it, e.g. rails has link_to and friends which require you to have a route set up in order to link to it (though not compile time). Golang has similar protection for XSS and reverse routes on routers if you require it so again not specific to Haskell. Clearly you won't be able to prevent (nor would you want to) links like yours above from being a 404, so perhaps no more internal 404s would be more accurate.
- dmit 12y ago
  Let's be fair here, while you can detect invalid internal links in dynamic languages at runtime, the end result is basically the same for the user - a 404 or a 503 are equally bad in this case. That's the advantage of compiled languages over dynamic ones in these kinds of scenarios: you sacrifice immediate feedback during development to gain a guarantee from the compiler that all invariants you embedded in the application uphold. And the more powerful the language/compiler combination, the more compile-time guarantees you can specify.

akurilin 12y ago

Yesod is a real gem, been using it for most of our web applications and I discover new great things about it every day.

raiph 12y ago

It sounds like the feature you're highlighting here is static checking at compile-time of how routes are going to resolve at run-time. Is that right? Afaict Perl 6 covers this case: http://jnthn.net/papers/2015-fosdem-static-dynamic.pdf#page=75 http://jnthn.net/papers/2015-fosdem-static-dynamic.pdf#page=... Or am I missing something?

runeks 12y ago

How does it prevent XSS?

QuixoticChris 12y ago
2. XSS injection. Any html coming back from a form will be efficiently sanitized just once on arrival. Unsanitized strings will be sanitized before being displayed. http://www.yesodweb.com/page/about http://www.yesodweb.com/page/about I suspect this is accomplished through safe vs. unsafe types. Imagine the only function from `unsafe___` to `safe___` is the escape function, and all functions giving text back in responses is require to be of type `safe___`.