Support for lua filters in pandoc-server

[aslakhellesoy]

I understand that filters are not implemented in pandoc-server for security reasons.

Would it still be possible to implement, perhaps with a --allow-filters option to explicitly enable them?
I understand that the PandocPure monad prevents any IO, but it isn't clear to me whether lua filters would require disk IO or not.
Does the Lua engine require Lua scripts to be on disk or can they be supplied as strings?

If this is possible (and wanted) I could try to provide a patch, but I would love some pointers as I am new to both Haskell and the Pandoc codebase.

FWIW, we're hosting pandoc-server in a private network behind an nginx that performs basic auth.
In other words, we could live with the security implications since we're in control over who calls the server.

[jgm]

Yes, the filters need IO.

See here for the relevant bit of code and a relevant comment:
https://github.com/jgm/pandoc/blob/main/pandoc-server/src/Text/Pandoc/Server.hs#L230-L251

The changes needed to make this subject to an option may be tricky, especially for someone new to Haskell.

[jgm]

And don't take the comment too literally; I suspect the code has changed since that comment was written since it has the wrong number of parameters.

[jgm]

I guess one approach would be to replace runPure with a parameter of these functions, which can be filled with runPure or runIO depending on the setting of an option.

[aslakhellesoy]

Thanks for your reply @jgm - much appreciated.

I'll give it a stab!