Is there a list of GHC extensions that are considered ‘safe’?

by

It’s probably best to look at what SafeHaskell allows:

Safe Language

The Safe Language (enabled through -XSafe) restricts things in two different ways:

  1. Certain GHC LANGUAGE extensions are disallowed completely.
  2. Certain GHC LANGUAGE extensions are restricted in functionality.

Below is precisely what flags and extensions fall into each category:

  • Disallowed completely: GeneralizedNewtypeDeriving, TemplateHaskell
  • Restricted functionality: OverlappingInstances, ForeignFunctionInterface, RULES, Data.Typeable
    • See Restricted Features below
  • Doesn’t Matter: all remaining flags.

Restricted and Disabled GHC Haskell Features

In the Safe language dialect we restrict the following Haskell language features:

  • ForeignFunctionInterface: This is mostly safe, but foreign import declarations that import a function with a non-IO type are be disallowed. All FFI imports must reside in the IO Monad.
  • RULES: As they can change the behaviour of trusted code in unanticipated ways, violating semantic consistency they are restricted in function. Specifically any RULES defined in a module M compiled with -XSafe are dropped. RULES defined in trustworthy modules that M imports are still valid and will fire as usual.
  • OverlappingInstances: This extension can be used to violate semantic consistency, because malicious code could redefine a type instance (by containing a more specific instance definition) in a way that changes the behaviour of code importing the untrusted module. The extension is not disabled for a module M compiled with -XSafe but restricted. While M can define overlapping instance declarations, they can only be used in M. If in a module N that imports M, at a call site that uses a type-class function there is a choice of which instance to use (i.e overlapping) and the most specific choice is from M (or any other Safe compiled module), then compilation will fail. It is irrelevant if module N is considered Safe, or Trustworthy or neither.
  • Data.Typeable: We allow instances of Data.Typeable to be derived but we don’t allow hand crafted instances. Derived instances are machine generated by GHC and should be perfectly safe but hand crafted ones can lie about their type and allow unsafe coercions between types. This is in the spirit of the original design of SYB.

In the Safe language dialect we disable completely the following Haskell language features:

  • GeneralizedNewtypeDeriving: It can be used to violate constructor access control, by allowing untrusted code to manipulate protected data types in ways the data type author did not intend. I.e can be used to break invariants of data structures.
  • TemplateHaskell: Is particularly dangerous, as it can cause side effects even at compilation time and can be used to access abstract data types. It is very easy to break module boundaries with TH.

I recall having read that the interaction of FunctionalDependencies and UndecidableInstances can also be unsafe, because beyond allowing an unlimited context stack depth UndecidableInstances also lifts the so-called coverage condition (section 7.6.3.2), but I can’t find a cite for this at the moment.

EDIT 2015-10-27: Ever since GHC gained support for type roles, GeneralizedNewtypeDeriving is no longer unsafe. (I’m not sure what else might have changed.)

More Related Contents:

  1. Memory footprint of Haskell data types
  2. When is memoization automatic in GHC Haskell?
  3. Small Haskell program compiled with GHC into huge binary
  4. Wrong IO actions order using putStr and getLine
  5. What is fusion in Haskell?
  6. How to make a CAF not a CAF in Haskell?
  7. What does the `forall` keyword in Haskell/GHC do?
  8. Why is GHC complaining about non-exhaustive patterns?
  9. How do I define Lisp’s apply in Haskell?
  10. Operating on a return from a Maybe that contains “Just”
  11. Is there a Haskell idiom for updating a nested data structure?
  12. What’s so bad about Lazy I/O?
  13. Positive integer type
  14. Explicitly import instances
  15. How to compare two functions for equivalence, as in (λx.2*x) == (λx.x+x)?
  16. Why do 3 and x (which was assigned 3) have different inferred types in Haskell? [duplicate]
  17. How do I use fix, and how does it work?
  18. List of different types?
  19. What is Levity polymorphism
  20. How to infer the type of an expression manually
  21. Understanding the Haskell as-pattern
  22. How to use (->) instances of Monad and confusion about (->)
  23. Why can a Num act like a Fractional?
  24. Composing function composition: How does (.).(.) work?
  25. How do I convert a list to a tuple in Haskell?
  26. Implement zip using foldr
  27. How to enumerate a recursive datatype in Haskell?
  28. In what sense is the IO Monad pure?
  29. Explanation of “tying the knot”
  30. Return specific type within Haskell

Leave a Comment