On 10/02/2013, at 8:53 AM, Mark Wotton <[email protected]> wrote: > On Sat, Feb 9, 2013 at 11:35 PM, Samuel Cochran > <[email protected]> wrote: >> Actually YAML doesn't eval at all. The injection vector was YAML loading an >> arbitrary ruby type which evals a string property. >> >> I imagine loading a StructedThingy that eval'd one of its properties when >> constructed in Haskell would also yield the same vector. > > Unfortunately, your imagination has led you astray. A StructedThingy > cannot eval one of its properties: it never gets the opportunity to do > so, because the type that constructs it is not allowed to do IO.
Apologies, it has been a long time since I looked at Haskell. I didn't fully grasp that IO was a monad. That's quite cleverly designed. It does trade the ability to use something like YAML as an arbitrary marshalling system, but Haskell makes data much, much easier to deal with sufficiently abating the lust to marshall. -- You received this message because you are subscribed to the Google Groups "Ruby or Rails Oceania" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at http://groups.google.com/group/rails-oceania?hl=en. For more options, visit https://groups.google.com/groups/opt_out.
