2019-06-14 02:24:10 +03:00
|
|
|
# stack build plan using GHC 8.6.5
|
2018-10-08 08:47:28 +03:00
|
|
|
|
2020-03-02 02:01:09 +03:00
|
|
|
nix:
|
|
|
|
|
pure: false
|
|
|
|
|
packages: [perl gmp ncurses zlib]
|
|
|
|
|
|
2021-11-12 04:48:21 +03:00
|
|
|
resolver: lts-14.27
|
2018-10-08 08:47:28 +03:00
|
|
|
|
|
|
|
|
packages:
|
|
|
|
|
- hledger-lib
|
|
|
|
|
- hledger
|
|
|
|
|
- hledger-ui
|
|
|
|
|
- hledger-web
|
|
|
|
|
|
|
|
|
|
extra-deps:
|
2019-11-29 18:48:03 +03:00
|
|
|
# for Shake.hs (regex doesn't support base-compat-0.11):
|
|
|
|
|
- regex-1.0.2.0@rev:1
|
2021-11-12 04:49:26 +03:00
|
|
|
- doclayout-0.3.1.1
|
|
|
|
|
- emojis-0.1.2
|
2019-11-29 18:48:03 +03:00
|
|
|
# for testing base-compat 0.11 compatibility (mutually exclusive with the above):
|
|
|
|
|
# - aeson-1.4.6.0
|
|
|
|
|
# - aeson-compat-0.3.9
|
|
|
|
|
# - attoparsec-iso8601-1.0.1.0
|
|
|
|
|
# - base-compat-batteries-0.11.0
|
|
|
|
|
# - base-compat-0.11.0
|
|
|
|
|
# - http-api-data-0.4.1.1
|
2019-07-24 20:04:58 +03:00
|
|
|
# for hledger-lib:
|
lib: replace pretty-show with pretty-simple
pretty-simple, already used in .ghci, will hopefully give nicer debug
output, including for values which don't have Read-able Show output.
This should mean that we can start removing custom string-like Show
instances that were a workaround for pretty-show.
We are using the latest version (4.0.0.0) to get compact output.
Here's some old pretty-show output:
CsvRules
{ rdirectives = [ ( "skip" , "1" ) ]
, rcsvfieldindexes = [ ( "date" , 1 ) , ( "amount" , 2 ) ]
, rassignments = [ ( "amount" , "%2" ) , ( "date" , "%1" ) ]
, rconditionalblocks = []
}
And the new pretty-simple output:
CsvRules
{ rdirectives=
[ ( "skip", "1" ) ]
, rcsvfieldindexes=
[ ( "date", 1 ), ( "amount", 2 ) ]
, rassignments=
[ ( "amount", "%2" ), ( "date", "%1" ) ]
, rconditionalblocks= []
}
Non-compact pretty-simple output would be:
CsvRules
{ rdirectives=
[
( "skip"
, "1B"
)
]
, rcsvfieldindexes=
[
( "date"
, 1
)
,
( "amount"
, 2
)
]
, rassignments=
[
( "amount"
, "%2"
)
,
( "date"
, "%1"
)
]
, rconditionalblocks=[]
}
Also:
- Account's Show instance no longer converts : to _ in account names
- drop unused pretty-show dependency from hledger, hledger-ui packages
- regenerate hledger-lib with the older hpack that's shipped in stack
2020-11-10 18:08:29 +03:00
|
|
|
- pretty-simple-4.0.0.0
|
|
|
|
|
- prettyprinter-1.7.0
|
2020-11-11 23:52:44 +03:00
|
|
|
- prettyprinter-ansi-terminal-1.1.2
|
2021-07-17 06:58:57 +03:00
|
|
|
- doctest-0.18.1
|
2019-07-24 20:04:58 +03:00
|
|
|
# for hledger:
|
2021-08-06 11:04:20 +03:00
|
|
|
- githash-0.1.4.0
|
2019-07-24 20:04:58 +03:00
|
|
|
# for hledger-ui:
|
|
|
|
|
# for hledger-web:
|
fix: web: b64 encode user controlled input (#1525)
This fixes a reported Stored XSS vulnerability in toBloodhoundJson by
encoding the user-controlled values in this payload into base64 and
parsing them with atob.
In my exploration of the vulnerability with various payloads I and
others crafted, it would appear that this is the only available XSS in
hledger-web in relation to stored accounts and transaction details. If
there is other parts of the UI which may contain user-controlled data,
they should be examined for similar things. In this instance,
protections provided by yesod and other libraries worked fine, but in a
bit of code that hledger-web was generating, the user could insert a
</Script> tag (which is valid HTML and equivalent to </script> but not
caught by the T.Replace that existed in toBloodhoundJson) in order to
switch out of a script context, allowing the parser to be reset, and for
arbitrary JavaScript to run.
The real fix is a bit more involved, but produces much better results:
Content-Security-Policy headers should be introduced, and using
sha256-<hash of script> or a different algorithm, they should be marked
as trusted in the header. This way, if the (in-browser) parser and
hledger-web generator disagree on the source code of the script, the
script won't run. Note that this would still be susceptible to attacks
that involve changing the script by escaping from the string inside it
or something similar to that, which can be avoided additionally by using
either the method used in this commit, or a proper JSON encoder.
The second approach has the advantage of preventing further XSS, to the
extent specified above, in practice, a combination of both should be
used, b64 for embedded data and the CSP sha256-hash script-src over
everything else, which will eliminate all injected or malformed script
blocks (via CSP), in combination with eliminating any HTML closing tags
which might occur in stored data (via b64).
This vulnerability appears to have been first introduced when
autocompletion was added in hledger-web, git tag hledger-0.24, commit
hash: ec51d28839b2910eea360b1b8c72904b51cf7821
Test payload: </Script><svg onload=alert(1)//>
Closes #1525
2021-08-22 14:58:46 +03:00
|
|
|
- ghc-byteorder-4.11.0.0.10
|
|
|
|
|
- base64-0.4.2.3
|
2019-06-10 01:43:06 +03:00
|
|
|
|
2019-06-14 02:25:21 +03:00
|
|
|
# Workaround for https://github.com/commercialhaskell/stack/issues/3922
|
|
|
|
|
# Try dropping this.. after stack 2 has been out a while ? Or now ? How about now ?
|
|
|
|
|
#- haskell-src-exts-1.21.0
|
2019-06-10 01:43:06 +03:00
|
|
|
|
2019-07-11 09:20:14 +03:00
|
|
|
# Use at least 0.46 to work around https://github.com/simonmichael/hledger/issues/1039
|
2019-06-14 02:24:43 +03:00
|
|
|
# (hledger-web build failure with GHC 8.6 on Windows 7)
|
|
|
|
|
# Might also be fixed by using GHC 8.6.5+, mixed reports
|
2019-07-11 09:20:14 +03:00
|
|
|
#- unix-time-0.4.6
|
2020-03-02 02:01:09 +03:00
|
|
|
|
|
|
|
|
- wai-handler-launch-3.0.3.1
|
|
|
|
|
# - streaming-commons-0.2.1.2
|
|
|
|
|
# - network-2.7.0.0
|
