Saferish strings in Haskell APIs

An introduction safer-ish strings in Haskell library APIs using OverloadedStrings and rewrite rules.

This was presented at the Open Programming Miniconf at linux.conf.au 2013.

Transcript

1. Safe strings in Haskell APIs
2. Safe
   Safer strings in Haskell APIs
3. Safe
   Safer
   Saferish strings in Haskell APIs
4. Haskell • Purely functional • But pragmatically practical • Strongly typed • Pretty safe
5. Strings
6. OverloadedStrings • Added to GHC 6.8.1 • Allows string literal syntax to be used for other data types.
7. OverloadedStrings
8. OverloadedStrings
9. So what? • Use custom datatypes instead of String at API boundaries. • If SQL commands aren’t strings, no string concatenation and less risk of injection vulnerabilities!
10. mysql-simple • Database access library for MySQL written by Bryan O'Sullivan. • Uses this pattern to pass query text to the API.
11. mysql-simple
12. mysql-simple
13. mysql-simple
14. mysql-simple
15. No concatenation
16. No concatenation
17. BUT! • All of the code which makes this work is public and you can import it. • So you (and any other developer) can circumvent this safety pretty trivially.
20. So what do we want?
31. How does this magic work? • Through the magic of compiler rules! • Allow library authors to specify rewrite rules to be applied during compilation. • Used for fusion and other optimisation techniques for data structure libraries. (text is very, very fast).
32. String “Literals” • GHC generates a packed C-style string in the executable. • Code like this: ! • compiles to something like this:
33. So rewrite this code!
34. By default, it’s unsafe... It turns out that RULES do type inference. So we can write a RULE which replaces our fromStrings with out fromStringUnsafe.
35. Unsafe calls
36. Safe calls • The only safe calls are the ones which use static values!
37. Identify and replace safe calls • Recall RULES use type inference. • And that the only safe calls are ones with static values. • And that static values have a specific type. • And are processed (before our code) with runtime support functions.
38. Replace safe “unsafe” calls with “safe”
45. Does it work?
58. What’s next? • Make it less fragile. (Needs NOINLINE pragmas and is sensitive to optimisation). • Make the error compile time. (But it needs to be typesafe to work. #lolwut) • Probably much better and easier to write a GHC plugin.