PHV v0.5.1

PHV 0.5.1 closes the residual risks listed in the 0.5.0 security assessment, and three related problems found while fixing them. Upgrading is recommended. The details are in docs/security-audit.md §12.

PHV is pre-1.0: the language and its tools may still change between releases.

Fixes

Templates

• An Html value placed in a quoted attribute value now has its " and ' encoded (", '), so no Html can end the attribute: not a json_html() value that reached it through any, nor a template's output. escape() output and element text are unchanged.

JIT

• A call whose native code runs out of stack (deep recursion of a function with a large frame) is now run by the interpreter instead of failing, so the result is the same with and without the JIT.
• Registers are checked against memory_limit_mb before they are allocated: a deep recursion of a function with many registers could reach hundreds of MB under a 16 MB limit. Functions with more than 1,024 registers or 16,384 instructions are no longer compiled (compiling them took much memory).

Limits

• After comparing or joining strings of 64 KB or more, the time and memory limits are checked at the next loop step or call. Before, a loop of such operations could run well past the time limit (4 s under a 2 s limit), in both the interpreter and the JIT.

Install

Download the archive for your platform below, check it against SHA256SUMS, and put phv (phv.exe on Windows) on your PATH.

Platform	Archive
Windows x64	phv-0.5.1-x86_64-pc-windows-msvc.zip
Linux x64	phv-0.5.1-x86_64-unknown-linux-gnu.tar.gz
macOS (Apple Silicon)	phv-0.5.1-aarch64-apple-darwin.tar.gz
macOS (Intel)	phv-0.5.1-x86_64-apple-darwin.tar.gz
VS Code extension	phv-0.5.1.vsix (or install PHV Language from the Marketplace)

PHV v0.5.0

PHV 0.5.0 adds generic classes, annotations, asynchronous I/O, sessions in a database, packages of packages with a registry, and phv build, which turns a site or a script into one executable. The JIT now also compiles functions that use floats and strings, and phv fmt wraps long lines.

Everything in this release went through a fifth security assessment before it was published; all of its findings are fixed. The full report is in docs/security-audit.md §10–§11.

PHV is pre-1.0: the language and its tools may still change between releases.

Breaking changes

• #[ starts an annotation, not a comment. #[Deprecated("...")], #[Override], #[Test] and #[Skip("...")] go before declarations; other names are errors. A # comment that starts with [ must be rewritten (for example as # [ or //).
• A template must end outside every tag, attribute, comment, <script> / <style> and <svg>. A template that ends inside one is a compile error.
• break, continue, return and throw cannot leave the HTML inside a tag or attribute (the output after the jump would land there).
• A json_html() value (SafeJs) is no longer an Html: declare template parameters that take one as SafeJs.
• Package names are lowercase letters, digits and _, and packages' own dependencies must use https:// URLs.

New

Language

• Generic classes and interfaces: class Box<T>, interface Repo<T>, extends Base<int>, new Box<int>(1) (type arguments are inferred when they can be). $x is Box gives a Box<?>, which can be read but not written.
• Annotations: #[Deprecated] warns where the declaration is used, #[Override] checks that a method overrides one, #[Test] / #[Skip] mark tests for phv test.
• Asynchronous I/O (std.async): getAsync / postAsync / postJsonAsync / requestAsync on HttpClient, queryAsync / executeAsync on Database, getAsync / setAsync on Redis return a Future<T>; await() and await_all() wait for them. Up to 16 at once per script.

Web server

• Sessions in a database: [security] session_store = "db:<name>" keeps them in Redis, PostgreSQL or MySQL, shared by every server process.
• Rate limits shared between processes: [security] rate_limit_store = "<name>" counts rate_limit() and requests_per_minute on a Redis server.
• [server] workers caps the scripts that run at once (two per CPU, at least 8); output waiting to be sent counts toward it.

Tools

• phv build site -o app / phv build script.phv -o tool: one executable with the compiled pages, the static files and phv.toml.
• phv install installs the packages that packages need, resolves versions (^1.2, ~0.3, ...) from git tags, and finds packages by name in the package registry. phv install --locked installs exactly what phv.lock records.
• The JIT compiles functions whose locals are floats and strings, too.
• phv fmt wraps lines longer than 100 characters (--width N, [fmt] width).
• phv lsp batches edits and honours cancellation.

Security

Fixed before release (§11 of the report):

• Sessions: a request that finished after a logout could bring the session back (file, Redis and SQL stores, also across processes). Saving is now atomic in every store, and the Redis store has count and size limits.
• Generics: four ways to turn a value of one type into another (and so a string into SafeUrl or SafeJs) through type parameters, is, interfaces reached twice and overrides.
• Templates: jumps inside a tag, and json_html() used as Html in an attribute.
• phv install: links at vendor/ or phv.lock, shell characters and UNC paths in git URLs, package names differing only in case, oversized or linked phv.toml files, links out of a package, and package names that shadow project directories.
• Async work left running after its request, rate_limit_reset() scanning all Redis keys, a stalled MySQL server blocking other services' name lookups, deep JIT recursion overflowing a worker's stack, and phv fmt changing string contents.

Also in this release (§10): name lookups have a deadline, SQLite's journal files are checked when SQLite opens them, the file session store evicts sessions that never came back first, and the CI actions and deploy tooling are pinned.

Install

Download the archive for your platform below, check it against SHA256SUMS, and put phv (phv.exe on Windows) on your PATH.

Platform	Archive
Windows x64	phv-0.5.0-x86_64-pc-windows-msvc.zip
Linux x64	phv-0.5.0-x86_64-unknown-linux-gnu.tar.gz
macOS (Apple Silicon)	phv-0.5.0-aarch64-apple-darwin.tar.gz
macOS (Intel)	phv-0.5.0-x86_64-apple-darwin.tar.gz
VS Code extension	phv-0.5.0.vsix (or install PHV Language from the Marketplace)

PHV v0.4.1

PHV 0.4.1 is a security release. A fourth security assessment covered everything added up to 0.4.0 (the HTTP and WebSocket clients, PostgreSQL / MySQL / Redis, the web server additions, editor support, CI and the example sites); this release fixes all of its findings. Upgrading is recommended, especially for sites that use database servers or std.net.

PHV is pre-1.0: the language and its tools may still change between releases.

The full report is in docs/security-audit.md §9.

Fixes

Database servers (std.db)

• Query results, Redis replies and PostgreSQL notifications can no longer grow the process past memory_limit_mb. Before, one query with a 16 MB limit could take 1.9 GB, and LISTEN notifications piled up in pooled connections.
• Statements stop at the script's time limit even when the script turns the server's timeout off (SET statement_timeout = 0, DO SLEEP()), or the server stops answering.
• The pool reset now also clears MySQL's active role and current database, and no longer breaks PostgreSQL queries on custom types (enums, domains) after the first reset.
• sslmode=require / require_ssl in a URL is always honoured.

HTTP and WebSocket clients (std.net)

• A server can no longer hold a request past the time limit by sending one byte at a time, endless 100 Continue responses or pings.
• A huge chunk size no longer crashes the request; Content-Length and chunks are parsed strictly.
• Paths with ..; or double encoding (%252e) are refused, a headers_env credential cannot be shadowed as X_Api_Key, and query keys of the base URL cannot be given twice.
• Error messages no longer name the service's host.

Templates

• Values can no longer be inserted into the URL of a <script> (the tag gets the CSP nonce), or into the content of a <meta> such as http-equiv="refresh" (except numbers, and name / property / itemprop metas).
• safe_url() also refuses \/host.

Web server

• Static files and response()->file() are streamed from disk instead of read into memory; clients that stop reading are disconnected after 30 seconds.
• Pages with a CSRF token are sent with Cache-Control: private, no-store.
• When the session store is full, sessions whose visitor never came back are evicted first.
• A phv.toml at a filesystem root, in the shared temporary directory, or (on Unix) owned by another user is no longer picked up as the project file.
• Opening a new SQLite file from several requests at once no longer fails on Windows.
• In development mode (the default on 127.0.0.1) the server prints a note at startup: behind a reverse proxy, use --prod.

Checker and editor

• Very large class hierarchies (inherited members are capped at 200,000) and source files over 8 MB are refused instead of using gigabytes of memory; phv lsp survives internal errors.

New

• ip_group($ip): an IPv6 address as its /64 (IPv4 unchanged), for rate_limit() keys: rate_limit("login:" . ip_group(request()->ip), 5, 60).

Install

Download the archive for your platform below, check it against SHA256SUMS, and put phv (phv.exe on Windows) on your PATH.

Platform	Archive
Windows x64	phv-0.4.1-x86_64-pc-windows-msvc.zip
Linux x64	phv-0.4.1-x86_64-unknown-linux-gnu.tar.gz
macOS (Apple Silicon)	phv-0.4.1-aarch64-apple-darwin.tar.gz
macOS (Intel)	phv-0.4.1-x86_64-apple-darwin.tar.gz
VS Code extension	phv-0.4.1.vsix (or install PHV Language from the Marketplace)

PHV v0.4.0

PHV 0.4.0 lets scripts talk to other servers over HTTP and WebSocket, and the language server now completes names and jumps to definitions.

PHV is pre-1.0: the language and its tools may still change between releases.

HTTP client (std.net)

Name the services a site may call in phv.toml; scripts give only the name and a path, so URLs and API keys never appear in code or messages, and scripts cannot reach any other host.

[http.weather]
url = "https://api.example.com/v1"
headers_env = { Authorization = "WEATHER_AUTH" }   # API keys come from environment variables

import std.net.HttpClient;

$api = HttpClient::connect("weather");
$res = $api->get("/forecast", ["city" => "Tokyo"]);
if ($res->ok()) {
    $data = $res->json();
}
$api->postJson("/reports", ["city" => "Tokyo", "temp" => 21]);

• get, delete, post, put, patch, postJson, putJson, postForm and request return an HttpResponse (status, headers, body, ok(), header(), json()).
• Paths cannot leave the base URL (//host, .., encoded slashes), header values cannot contain line breaks, and headers from headers_env cannot be replaced by scripts.
• https:// is required for every host except localhost (tls = false allows http://). Redirects are not followed, bodies are limited to 16 MB, and a request waits at most until the script's time limit.

See HTTP client (std.net) in the spec.

WebSocket client (std.net)

WebSocket::connect("game") connects to a [websockets.game] server from phv.toml, with send(), receive($timeout) and close() for text messages. wss:// is required except for localhost; failures raise the new NetworkError.

Editor support

phv lsp (and so the PHV Language extension for VS Code) now offers:

• Completion of variables after $, properties and methods after -> and ?-> (by the receiver's type, including string, list and map methods), enum cases, constants and static methods after ::, and functions, classes and keywords. It works on half-written lines, and not inside HTML, strings or comments.
• Go to definition (F12) for variables, functions, classes, methods, properties, enum cases, constants, imports and the templates passed to render().
• Templates (.phv.html) opened on their own know their params(...).

Fixes

• phv check crashed on an interface that redeclares a method of the interface it extends.
• phv check crashed on a static constructor; it now reports "constructors cannot be static".

Install

Download the archive for your platform below, check it against SHA256SUMS, and put phv (phv.exe on Windows) on your PATH.

Platform	Archive
Windows x64	phv-0.4.0-x86_64-pc-windows-msvc.zip
Linux x64	phv-0.4.0-x86_64-unknown-linux-gnu.tar.gz
macOS (Apple Silicon)	phv-0.4.0-aarch64-apple-darwin.tar.gz
macOS (Intel)	phv-0.4.0-x86_64-apple-darwin.tar.gz
VS Code extension	phv-0.4.0.vsix (or install PHV Language from the Marketplace)

PHV v0.3.0

PHX is now PHV. The name PHX was already taken, so the language has a new name, website and repository: https://phv-lang.org and https://github.com/miyagawayuu/phv. The language itself is the same as PHX v0.2.7; only the names changed.

PHV is pre-1.0: the language and its tools may still change between releases.

Upgrading from PHX

The rename touches file names and settings, so a PHX project needs these changes:

PHX	PHV
phx command	phv
*.phx, *.phx.html	*.phv, *.phv.html
<?phx	<?phv
phx.toml, phx.lock	phv.toml, phv.lock
.phx-cache/	.phv-cache/ (the old folder can be deleted)
PHX_JIT	PHV_JIT
Cookies PHXSESSID, PHXCSRF	PHVSESSID, PHVCSRF

Because the cookie names changed, users of a running site are signed out once after the upgrade, and forms opened before it must be reloaded.

VS Code extension

The extension is now PHV Language (phv-lang.phv-language): run code --install-extension phv-lang.phv-language, then uninstall the old PHX Language (phx-lang.phx-language) if you have it. phv-0.3.0.vsix is attached below for installing by hand.

Also in this release

Everything from the last PHX releases, including PostgreSQL, MySQL and Redis connections (Database::connect(), Redis::connect(), [databases] in phv.toml): see Database (std.db) in the spec.

Install

Download the archive for your platform below, check it against SHA256SUMS, and put phv (phv.exe on Windows) on your PATH.

Platform	Archive
Windows x64	phv-0.3.0-x86_64-pc-windows-msvc.zip
Linux x64	phv-0.3.0-x86_64-unknown-linux-gnu.tar.gz
macOS (Apple Silicon)	phv-0.3.0-aarch64-apple-darwin.tar.gz
macOS (Intel)	phv-0.3.0-x86_64-apple-darwin.tar.gz
VS Code extension	phv-0.3.0.vsix