5 ms·
Or, if you use existing parsers in a language like Haskell, you know parsing is supposed to be a pure function. If parsing suddenly requires IO effects, you can
by Peaker 13y ago
Or, if you use existing parsers in a language like Haskell, you know parsing is supposed to be a pure function. If parsing suddenly requires IO effects, you can be suspicious and try to figure out what is going on.
- gamegoblin 13y agoEven with haskell, someone could sneak in a performUnsafeIO call if you aren't careful. Of course this is trivial to detect with compiler flags etc.
- jrockway 13y agoMore likely, they'll just write bindings to libxml2.
- jmillikin 13y agoI wrote a libxml2 binding in Haskell (http://hackage.haskell.org/package/libxml-sax http://hackage.haskell.org/package/libxml-sax). It was an absolute nightmare, in part because handling entities safely requires a lot of hoop-jumping (and I'm not even 100% I caught all the places libxml2 does unsafe stuff).
- jrockway 13y ago"absolute nightmare" sounds like you did pretty well for libxml2.
- Peaker 13y agoWe're not talking about a malicious XML library here, though. We're talking about a misunderstanding regarding what happens during legitimate parsing of XML.
- gamegoblin 13y agoI was just responding to you about pure functions. You can make a Haskell function with a pure type signature that includes a call to unsafePerformIO.
- Peaker 13y agoYou can, but: A) Legitimate libraries don't (unless the IO action is in fact pure) B) Rogue libraries that do this will not generally work: laziness, optimizations, RTS races can all make the IO action run 0..N times, arbitrarily. C) It doesn't change the fact that in Haskell, the XML library exposes the weird XML behavior of looking up external entities by being in IO (my original point) -- because of A.