2 ms·
come again? I didn't say you can't validate while parsing for untrusted input, I said for untrusted input you will probably STILL need additional separate valid
by dnautics 5y ago
come again? I didn't say you can't validate while parsing for untrusted input, I said for untrusted input you will probably STILL need additional separate validation methods. Key emphasis on negating don't absolute imperative in the original aphorism.
- yakshaving_jgt 5y agoI didn't say that that's what you said. I tried to communicate that whether or not the input is trusted is besides the point. Unless I'm deeply confused, the idea in parse, don't validate is about doing something like this parseFoo :: Text -> Maybe Foo parseFoo t = if textIsAFoo t then Just (Foo t) else Nothing f :: Foo -> IO () f = _ Rather than something like this (which seems to be more common) f :: Text -> IO () f t = when (textIsAFoo t) g where g = _
- dnautics 5y agoI thought the idea of parse, don't validate is that your parser should contain validation logic. So instead of text -> generic json parser -> validate json -> ... you would do text -> custom json parser that stops if encounters "incorrect content" -> ...
- yakshaving_jgt 5y agoYou can think of the parser as containing validation logic — it can parse the value into a more constrained type if it conforms to validation rules, or it can fail. The point is that once your value is in a more principled type, the rest of the system is free from having to make assumptions (and guard against potential failures) about the breadth of that value's domain. As the article mentions, this is really only relevant to languages with proper type systems like Haskell.