Re: [Webmacro-devel] WM 2.0 strategy

[Harmeet B. <ha...@ko...>]

----- Original Message -----
From: "Eric B. Ridge" <eb...@tc...>
>
> Well, from a user perspective, what things do you think are necessary
> for WM 2.0?

Sorry about the huge delay in respone but here goes.

- Precompiled/Optimized templates: A mode to generate java code and classes
from wm files would be good. One example is jython. It is interpretted,
there can be a pool of interpretters to execute code but it has a tool to
generate java source and class files. I would like to use WM like
precompiled JSP files and not put wm source code on production server. I
would also like to profile these end precompiled templates and see if there
are any bottlenecks. For instance if a precompiled template does not have
any shared state and no need to reload, should ideally have no synchronized
calls.

- Sandbox. I realize that WM templates depends only on model, but it would
be nice to make the view as tight as possible, for instance if I need to
exposed, HttpServerletRequest object to WM, would it be better to instead
expose a ServletRequest Object inside a wrapper and allow server
administrator to control what can or cannot be invoked. Some support for
sandoxing say by automatically creating proxies and tying permissions to
user roles may be helpful. I don't have any concrete ideas but if you could
keep security/safety as you add more features that would be awesome.

- Safe. Loops and cyclic loops can be written in JSP. With webmacro it is
very hard. I use 1.0 with constraints on include directive to control
looping( I only allow templates in subfolders and no url include). WM
Templates should not be able to bring server down, either by intent or by
coding error. Of course this does depend on exposed model, but if model is
safe, templates should be safe too. I think this can be done by making some
changes to tools in 1.0 and Include directive. In later versions my
impression was that macros can cause loops. If this is true, from safety
perspective it may not be a step forward.

- Throttling. Would be cool to have a way to monitor long running threads
and maybe reduce priority or kill those threads. A threshold time check and
unchecked error if limit is reached may be one way I could think of.

- Powerful but documented. For a lot users security and safety may be less
important. If you do decide to add powerful features, please do document and
make it possible to disable features that could cause security/safety
issues.

thanks,
Harmeet