For the usual reasons it seemed best to use FCKeditor as an input widget for HOPE. I had hoped to provide some kind of hacker-friendly markup but time is short and convincing FCKeditor to generate it would probably require some heart surgery. So XHTML everywhere it is.
Clearly this path should lead to paranoia; we can't allow users to
submit arbitary strings, or even arbitary XHTML. My heavyweight
solution is to validate such submissions against a stripped-down XHTML DTD using HaXml. So far I've removed forms, scripts and
restricted the attributes of <a> to just
href. I wish the DTD was readable; it is merely an algebraic data type afterall.
Combined with some thorough string-escaping for the other inputs and a tendency to cop-out (crash) on anything that doesn't completely conform to expectations, I think we will be all right.
You can try your hand here. Any and all feedback is much appreciated.
In related news I've uploaded my FCKeditor "server-side integration" Haskell library to Hackage. Find that here.
