Forbid annotations when Safe Haskell safe mode is enabled.

For now, this fails compliation immediately with an error. If desired, this
can be a warning that annotations in Safe Haskell are ignored.

Signed-off-by: David Kraeutmann <kane@kane.cx>

Reviewed By: goldfire, austin

Differential Revision: https://phabricator.haskell.org/D1226

GHC Trac Issues: #10826

6 files changed, 114 insertions, 2 deletions

diff --git a/compiler/typecheck/TcAnnotations.hs b/compiler/typecheck/TcAnnotations.hs
index 474630b789..688a1e9370 100644
--- a/compiler/typecheck/TcAnnotations.hs
+++ b/compiler/typecheck/TcAnnotations.hs
@@ -12,6 +12,8 @@ module TcAnnotations ( tcAnnotations, annCtxt ) where
 #ifdef GHCI
 import {-# SOURCE #-} TcSplice ( runAnnotation )
 import Module
+import DynFlags
+import Control.Monad ( when )
 #endif
 
 import HsSyn
@@ -47,7 +49,14 @@ tcAnnotation (L loc ann@(HsAnnotation _ provenance expr)) = do
     let target = annProvenanceToTarget mod provenance
 
     -- Run that annotation and construct the full Annotation data structure
-    setSrcSpan loc $ addErrCtxt (annCtxt ann) $ runAnnotation target expr
+    setSrcSpan loc $ addErrCtxt (annCtxt ann) $ do
+      -- See #10826 -- Annotations allow one to bypass Safe Haskell.
+      dflags <- getDynFlags
+      when (safeLanguageOn dflags) $ failWithTc safeHsErr
+      runAnnotation target expr
+    where
+      safeHsErr = vcat [ ptext (sLit "Annotations are not compatible with Safe Haskell.")
+                  , ptext (sLit "See https://ghc.haskell.org/trac/ghc/ticket/10826") ]
 
 annProvenanceToTarget :: Module -> AnnProvenance Name -> AnnTarget Name
 annProvenanceToTarget _   (ValueAnnProvenance (L _ name)) = NamedTarget name
diff --git a/docs/users_guide/7.10.3-notes.xml b/docs/users_guide/7.10.3-notes.xml
new file mode 100644
index 0000000000..d75eb337db
--- /dev/null
+++ b/docs/users_guide/7.10.3-notes.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<sect1 id="release-7-10-3">
+  <title>Release notes for version 7.10.3</title>
+
+  <para>
+    The 7.10.3 release is a bugfix release, with over 70+ bug fixes
+    relative to 7.10.1. The major fixes are listed below. For the full
+    list with more detail, see the <ulink
+    url="https://ghc.haskell.org/trac/ghc/milestone/7.10.3">GHC 7.10.3
+    milestone</ulink> on our bug tracker.
+  </para>
+
+  <sect2>
+    <title>GHC</title>
+
+    <itemizedlist>
+      <listitem>
+        <para>
+          Due to a <ulink href="https://ghc.haskell.org/trac/ghc/ticket/10826">
+          security issue
+          </ulink>, Safe Haskell now forbids annotations in programs marked as
+          <literal>-XSafe</literal>
+        </para>
+      </listitem>
+    </itemizedlist>
+  </sect2>
+
+
+  <sect2>
+    <title>Libraries</title>
+
+    <sect3>
+        <title>base</title>
+        <itemizedlist>
+            <listitem>
+                <para>
+                    Version number 4.8.1.0 (was 4.8.0.0)
+               </para>
+           </listitem>
+            <listitem>
+                <para>
+                    The <literal>Lifetime</literal> datatype (and its
+                    constructors) are now exported from
+                    <literal>GHC.Event</literal>.
+                </para>
+           </listitem>
+       </itemizedlist>
+    </sect3>
+
+    <sect3>
+        <title>binary</title>
+        <itemizedlist>
+            <listitem>
+                <para>
+                    Version number 0.7.5.0 (was 0.7.3.0)
+               </para>
+           </listitem>
+       </itemizedlist>
+    </sect3>
+
+    <sect3>
+        <title>Cabal</title>
+        <itemizedlist>
+            <listitem>
+                <para>
+                    Version number 1.22.4.0 (was 1.22.2.0).
+               </para>
+           </listitem>
+       </itemizedlist>
+    </sect3>
+
+    <sect3>
+        <title>ghc</title>
+        <itemizedlist>
+       </itemizedlist>
+    </sect3>
+  </sect2>
+
+  <sect2>
+    <title>Known bugs</title>
+    <itemizedlist>
+   </itemizedlist>
+  </sect2>
+</sect1>
diff --git a/docs/users_guide/safe_haskell.xml b/docs/users_guide/safe_haskell.xml
index 634482a42c..16f2bbd7bd 100644
--- a/docs/users_guide/safe_haskell.xml
+++ b/docs/users_guide/safe_haskell.xml
@@ -776,6 +776,12 @@
       Wiki</ulink>.
     </para>
 
+    <para>
+    Additionally, the use of <link linkend="annotations">annotations</link>
+    is forbidden, as that would allow bypassing Safe Haskell restrictions.
+    See <ulink url="https://ghc.haskell.org/trac/ghc/ticket/10826">ticket #10826</ulink>.
+    </para>
+
   </sect2>
 
 </sect1>
diff --git a/testsuite/tests/annotations/should_fail/T10826.hs b/testsuite/tests/annotations/should_fail/T10826.hs
new file mode 100644
index 0000000000..cddf33ca6f
--- /dev/null
+++ b/testsuite/tests/annotations/should_fail/T10826.hs
@@ -0,0 +1,7 @@
+{-# LANGUAGE Safe #-}
+module Test (hook) where
+
+import System.IO.Unsafe
+
+{-# ANN hook (unsafePerformIO (putStrLn "Woops.")) #-}
+hook = undefined
diff --git a/testsuite/tests/annotations/should_fail/T10826.stderr b/testsuite/tests/annotations/should_fail/T10826.stderr
new file mode 100644
index 0000000000..0e2bed5d8b
--- /dev/null
+++ b/testsuite/tests/annotations/should_fail/T10826.stderr
@@ -0,0 +1,6 @@
+
+T10826.hs:6:1: error:
+    Annotations are not compatible with Safe Haskell.
+    See https://ghc.haskell.org/trac/ghc/ticket/10826
+    In the annotation:
+      {-# ANN hook (unsafePerformIO (putStrLn "Woops.")) #-}
diff --git a/testsuite/tests/annotations/should_fail/all.T b/testsuite/tests/annotations/should_fail/all.T
index 21eaa765c3..0b10d8394a 100644
--- a/testsuite/tests/annotations/should_fail/all.T
+++ b/testsuite/tests/annotations/should_fail/all.T
@@ -18,7 +18,7 @@ test('annfail10', req_interp, compile_fail, [''])
 test('annfail11', normal, compile_fail, [''])
 test('annfail12', req_interp, compile_fail, ['-v0'])
 test('annfail13', normal, compile_fail, [''])
-
+test('T10826', normal, compile_fail, [''])
 """"
 Helpful things to C+P: