# HG changeset patch # User Adam Chlipala # Date 1268177324 18000 # Node ID 9d3ccb8b39ac67976267b1b22806430939bd3bc8 # Parent 0b1d666bddb48dbd9fdb103e8c75b3f714074ea2 safeGet diff -r 0b1d666bddb4 -r 9d3ccb8b39ac CHANGELOG --- a/CHANGELOG Tue Mar 09 17:50:42 2010 -0500 +++ b/CHANGELOG Tue Mar 09 18:28:44 2010 -0500 @@ -1,3 +1,9 @@ +======== +Next +======== + +- safeGet .urp directive + ======== 20100213 ======== diff -r 0b1d666bddb4 -r 9d3ccb8b39ac doc/manual.tex --- a/doc/manual.tex Tue Mar 09 17:50:42 2010 -0500 +++ b/doc/manual.tex Tue Mar 09 18:28:44 2010 -0500 @@ -151,6 +151,7 @@ \item \texttt{prefix PREFIX} sets the prefix included before every URI within the generated application. The default is \texttt{/}. \item \texttt{profile} generates an executable that may be used with gprof. \item \texttt{rewrite KIND FROM TO} gives a rule for rewriting canonical module paths. For instance, the canonical path of a page may be \texttt{Mod1.Mod2.mypage}, while you would rather the page were accessed via a URL containing only \texttt{page}. The directive \texttt{rewrite url Mod1/Mod2/mypage page} would accomplish that. The possible values of \texttt{KIND} determine which kinds of objects are affected. The kind \texttt{all} matches any object, and \texttt{url} matches page URLs. The kinds \texttt{table}, \texttt{sequence}, and \texttt{view} match those sorts of SQL entities, and \texttt{relation} matches any of those three. \texttt{cookie} matches HTTP cookies, and \texttt{style} matches CSS class names. If \texttt{FROM} ends in \texttt{/*}, it is interpreted as a prefix matching rule, and rewriting occurs by replacing only the appropriate prefix of a path with \texttt{TO}. While the actual external names of relations and styles have parts separated by underscores instead of slashes, all rewrite rules must be written in terms of slashes. +\item \texttt{safeGet URI} asks to allow the page handler assigned this canonical URI prefix to cause persistent side effects, even if accessed via an HTTP \cd{GET} request. \item \texttt{script URL} adds \texttt{URL} to the list of extra JavaScript files to be included at the beginning of any page that uses JavaScript. This is most useful for importing JavaScript versions of functions found in new FFI modules. \item \texttt{serverOnly Module.ident} registers an FFI function or transaction that may only be run on the server. \item \texttt{sigfile PATH} sets a path where your application should look for a key to use in cryptographic signing. This is used to prevent cross-site request forgery attacks for any form handler that both reads a cookie and creates side effects. If the referenced file doesn't exist, an application will create it and read its saved data on future invocations. You can also initialize the file manually with any contents at least 16 bytes long; the first 16 bytes will be treated as the key. diff -r 0b1d666bddb4 -r 9d3ccb8b39ac src/compiler.sig --- a/src/compiler.sig Tue Mar 09 17:50:42 2010 -0500 +++ b/src/compiler.sig Tue Mar 09 18:28:44 2010 -0500 @@ -1,4 +1,4 @@ -(* Copyright (c) 2008-2009, Adam Chlipala +(* Copyright (c) 2008-2010, Adam Chlipala * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -53,7 +53,8 @@ filterMime : Settings.rule list, protocol : string option, dbms : string option, - sigFile : string option + sigFile : string option, + safeGets : string list } val compile : string -> bool val compiler : string -> unit diff -r 0b1d666bddb4 -r 9d3ccb8b39ac src/compiler.sml --- a/src/compiler.sml Tue Mar 09 17:50:42 2010 -0500 +++ b/src/compiler.sml Tue Mar 09 18:28:44 2010 -0500 @@ -57,7 +57,8 @@ filterMime : Settings.rule list, protocol : string option, dbms : string option, - sigFile : string option + sigFile : string option, + safeGets : string list } type ('src, 'dst) phase = { @@ -385,6 +386,7 @@ val protocol = ref NONE val dbms = ref NONE val sigFile = ref (Settings.getSigFile ()) + val safeGets = ref [] fun finish sources = let @@ -413,7 +415,8 @@ sources = sources, protocol = !protocol, dbms = !dbms, - sigFile = !sigFile + sigFile = !sigFile, + safeGets = rev (!safeGets) } fun mergeO f (old, new) = @@ -456,7 +459,8 @@ (#sources old), protocol = mergeO #2 (#protocol old, #protocol new), dbms = mergeO #2 (#dbms old, #dbms new), - sigFile = mergeO #2 (#sigFile old, #sigFile new) + sigFile = mergeO #2 (#sigFile old, #sigFile new), + safeGets = #safeGets old @ #safeGets new } in if accLibs then @@ -569,7 +573,7 @@ | "include" => headers := relifyA arg :: !headers | "script" => scripts := arg :: !scripts | "clientToServer" => clientToServer := ffiS () :: !clientToServer - | "effectful" => effectful := ffiS () :: !effectful + | "safeGet" => safeGets := arg :: !safeGets | "benignEffectful" => benignEffectful := ffiS () :: !benignEffectful | "clientOnly" => clientOnly := ffiS () :: !clientOnly | "serverOnly" => serverOnly := ffiS () :: !serverOnly @@ -642,6 +646,7 @@ Settings.setMimeRules (#filterMime job); Option.app Settings.setProtocol (#protocol job); Option.app Settings.setDbms (#dbms job); + Settings.setSafeGets (#safeGets job); job end in diff -r 0b1d666bddb4 -r 9d3ccb8b39ac src/demo.sml --- a/src/demo.sml Tue Mar 09 17:50:42 2010 -0500 +++ b/src/demo.sml Tue Mar 09 18:28:44 2010 -0500 @@ -114,7 +114,8 @@ filterMime = #filterMime combined @ #filterMime urp, protocol = mergeWith #2 (#protocol combined, #protocol urp), dbms = mergeWith #2 (#dbms combined, #dbms urp), - sigFile = mergeWith #2 (#sigFile combined, #sigFile urp) + sigFile = mergeWith #2 (#sigFile combined, #sigFile urp), + safeGets = [] } val parse = Compiler.run (Compiler.transform Compiler.parseUrp "Demo parseUrp") diff -r 0b1d666bddb4 -r 9d3ccb8b39ac src/effectize.sml --- a/src/effectize.sml Tue Mar 09 17:50:42 2010 -0500 +++ b/src/effectize.sml Tue Mar 09 18:28:44 2010 -0500 @@ -143,7 +143,12 @@ | DExport (Link, n, _) => (case IM.find (writers, n) of NONE => () - | SOME (loc, s) => ErrorMsg.errorAt loc ("A link (" ^ s ^ ") could cause side effects; try implementing it with a form instead"); + | SOME (loc, s) => + if Settings.isSafeGet s then + () + else + ErrorMsg.errorAt loc ("A link (" ^ s + ^ ") could cause side effects; try implementing it with a form instead"); ((DExport (Link, n, IM.inDomain (pushers, n)), #2 d), evs)) | DExport (Action _, n, _) => ((DExport (Action (if IM.inDomain (writers, n) then diff -r 0b1d666bddb4 -r 9d3ccb8b39ac src/settings.sig --- a/src/settings.sig Tue Mar 09 17:50:42 2010 -0500 +++ b/src/settings.sig Tue Mar 09 18:28:44 2010 -0500 @@ -198,4 +198,8 @@ val setSigFile : string option -> unit val getSigFile : unit -> string option + (* Which GET-able functions should be allowed to have side effects? *) + val setSafeGets : string list -> unit + val isSafeGet : string -> bool + end diff -r 0b1d666bddb4 -r 9d3ccb8b39ac src/settings.sml --- a/src/settings.sml Tue Mar 09 17:50:42 2010 -0500 +++ b/src/settings.sml Tue Mar 09 18:28:44 2010 -0500 @@ -452,4 +452,13 @@ fun setSigFile v = sigFile := v fun getSigFile () = !sigFile +structure SS = BinarySetFn(struct + type ord_key = string + val compare = String.compare + end) + +val safeGet = ref SS.empty +fun setSafeGets ls = safeGet := SS.addList (SS.empty, ls) +fun isSafeGet x = SS.member (!safeGet, x) + end