Boundary Sanitization

Since the early days of web programming, people have tried to make the development process more enjoyable. As a community, we have constantly pushed new techniques to solve some of the persistent difficulties related to security threats, the stateless nature of HTTP, the different languages (HTML, CSS, JavaScript) required to create a powerful web application, and more.

Yesod attempts to simplify the web development process by playing to the strengths of the Haskell programming language. Haskell's strong compilability guarantees not only include types, but its referential transparency ensures that there are no unintended side effects. Pattern matching for algebraic data types can help ensure that we consider every possible case. When you build on top of Haskell, whole classes of errors disappear.

Unfortunately, using Haskell is not enough. The Web is not inherently type safe. Even the simplest case, distinguishing between an integer and a string, is impossible: all data on the web is transmitted as raw bytes, defying our efforts at type safety. Every programmer must validate all input. I (Michael Snoyman) call this a boundary problem: no matter how type-safe your application is internally, every boundary to the outside world still needs to be cleaned up (sanitized).

SNOYMAN, Michael, 2015. Developing web apps with Haskell and Yesod. Second edition. Beijing: Oreilly. ISBN 978-1-4919-1559-2.