Changeset 15648 in project

Timestamp:

08/30/09 12:10:23 (11 years ago)

Author:

certainty

Message:

Changes applied for certainty (82.83.157.152) through svnwiki:

File:

• wiki/eggref/4/uri-dispatch (modified) (4 diffs)

wiki/eggref/4/uri-dispatch

@@ -20 +20 @@
 The dispatch-algorithm is implemented as follows:
 
-('''Note''' Although not explicitly stated here the algorithm performs a whitelist-check on any procedure before it is invoked. See '''enable-whitelisting''' and '''whitelist!''')
+('''Note''' See also the whitelisting-section, to learn how to limit the exposure of procdures)
 
 * The path is empty. It checks if '''default-dispatch-target''' is bound to a procedure.
-   If it is, then it is invoked. If it is not, then '''dispatch-error''' is invoked.
+  If it is, then it is invoked. If it is not, then '''dispatch-error''' is invoked.
 
 * The path has exactly one element. It assumes that this element is the name
-   of a thunk that was defined outside a module. If such a thunk exists it is invoked.
-   If no such a thunk exists '''dispatch-error'''.is invoked.
+  of a thunk that was defined outside a module. If such a thunk exists it is invoked.
+  If no such a thunk exists '''dispatch-error'''.is invoked.
 
 * The path contains at least two elements. 
@@ -36 +36 @@
   outside any module. If such a procedure exists, it is invoked passing the rest of the elements as arguments.
   If no such procedure exists '''dispatch-error''' is invoked with the full path as arguments. The path is applied
-  to the procedure so you can use for example dsssl-style lambdalists to declare optional arguments or a rest-argument.
+  to the procedure so you can use for example dsssl-style lambda-lists to declare optional arguments or a rest-argument.
+
+All those lookups are done in the current '''dispatch-environment''', which can be parameterized.
 
 
-<procedure>(whitelist! DEFINITION)</procedure>
-Though nice for development it is not advisable to allow anybody out there to invoke abritary procedures of your application.
-So you might want to '''enable-whitelisting''' in production and whitelist only those modules and/or procedures you really want
-to be callable from the outside. Whis procedure expects a list that defines the procedure/modules
-you want to whitelist. If a procedure is requested that does exist but is not whitelisted '''dispatch-error''' is invoked.
-You have basically two possibilities to perform whitelisting, all of which can be combined.
+==== Whitelisting 
 
-1) whitelist procedures outside modules
-<pre>(whitelist! '(procedure1 procedure2 procedure3))</pre>
+Though nice for development it is not advisable to allow everybody out there to invoke abritary procedures of your application.
+So you might want to whitelist only those procedures that really acts as the interface of your application.
 
-2) whitelist all procedures inside a module
-<pre>(whitelist! '((module my-module my-module2))</pre>
+To enable whitelisting you simply parameterize the '''whitelist''' parameter with your whitelisting-specification.
+If a procedure is requested that does exist but is not whitelisted '''dispatch-error''' is invoked.
 
 
-'''In the near future you will have the following possibilities as well:'''
+'''Whitelisting specification'''
 
-whitelist specific procedures inside a module
-<pre>(whitelist! '((module-name procedure1 procedure2)))</pre>
+The whitelist allows to selectivly whitelist procedures modules and procedures inside modules.
+The examples explain all three cases
 
-It is also planned to implement some keywords that allow easier use of this procedure. 
+ (whitelist '(proc1 proc2 proc3)) 
 
+This will whitelist the procedures proc1..proc3. Those procedures must be defined outside a module.
+
+ (whitelist '((mod1 . (proc1 proc2))
+
+This will whitelist the procedures proc1 and proc2 that must reside inside the module mod1.
+
+ (whitelist '((mod1 . *))
+
+This will whitelist all procedures inside the module mod1.
+
+Of course you can mix those declarations.
+
+
+<parameter>whitelist</parameter>
+
+The parameter holding the whitelist. It defaults to #f which means whitelisting is disabled.
 
 
@@ -66 +79 @@
 If no handler for a uri can be found, the dispatcher will invoke the procedure that dispatch-error is currently parameterized with.
 '''NOTE''' dispatch-error is also invoked if the requested handler exists but is not whitelisted.
+Defaults to (constantly #f).
 
 <parameter>enable-whitelisting</parameter>
 
 If set to #t then whitelist-checks are enabled. Defaults to #f.
+
 <parameter>default-dispatch-target</parameter>
 
@@ -76 +91 @@
 
 <parameter>dispatch-environment</parameter>
-
 The environment that is used to lookup the procedures. It defaults to '''interaction-environment'''.