haskell-servant/servant

API construction is too lenient

Open

#659 ouverte le 11 janv. 2017

Voir sur GitHub
 (6 commentaires) (0 réactions) (0 assignés)Haskell (422 forks)batch import
help wanted

Métriques du dépôt

Stars
 (1 953 stars)
Métriques de merge PR
 (Merge moyen 5h 49m) (2 PRs mergées en 30 j)

Description

All of the following compile, but produce code which is nonsense in practice:

  • Static path parts containing slashes:

    "api/v1/item" :> Get '[JSON] [Item]
    

    This should be done as "api" :> "v1" :> "item" :> ..., and the resulting API is not functional.

  • Case-sensitive headers:

      Header "Authentication" String :> Header "authentication" String :> "item" :> Get '[JSON] [Item]
    

    According to the RFC, header names are case sensitive. Servant already handles this correctly by assigning the same value to both if either is set, but allowing both to be defined could theoretically result in hard-to-find bugs, as a client can send both at the same time.

  • Duplicate headers:

      Header "authentication" String :> Header "authentication" String :> "item" :> Get '[JSON] [Item]
    

    Obviously, the resulting server will be passed two identical values. This should not be allowed, as some external code which parses this may rely on the uniqueness of headers.

I'm not sure if it's even technically possible to prevent those from compiling, but it would be nice to have.

Guide contributeur