4 ms·
We're not talking about a malicious XML library here, though. We're talking about a misunderstanding regarding what happens during legitimate parsing of XML.
by Peaker 13y ago
We're not talking about a malicious XML library here, though. We're talking about a misunderstanding regarding what happens during legitimate parsing of XML.
- gamegoblin 13y agoI was just responding to you about pure functions. You can make a Haskell function with a pure type signature that includes a call to unsafePerformIO.
- Peaker 13y agoYou can, but: A) Legitimate libraries don't (unless the IO action is in fact pure) B) Rogue libraries that do this will not generally work: laziness, optimizations, RTS races can all make the IO action run 0..N times, arbitrarily. C) It doesn't change the fact that in Haskell, the XML library exposes the weird XML behavior of looking up external entities by being in IO (my original point) -- because of A.