34775b4 · typeable/pandoc

git.iko.soy/typeable/pandoc

Add an option to disable certificate validation (#6156)

This commit adds the option `--no-check-certificate`, which disables certificate checking when resources are fetched by HTTP. Co-authored-by: Cécile Chemin <cecile.chemin@insee.fr> Co-authored-by: Juliette Fourcot <juliette.fourcot@insee.fr>

commit34775b4128de2801e4d127064f012501ca18d208 authorCédric Couralet <cedric.couralet@gmail.com> dateMon 13 Apr 2020, 23:58 (7 years ago) parent21b1358

8 files changed+31−2

compare with master

unifiedsplit

MANUAL.txt+6 pandoc.cabal+1 src/Text/Pandoc/App.hs+2 src/Text/Pandoc/App/CommandLineOptions.hs+5 src/Text/Pandoc/App/Opt.hs+5 src/Text/Pandoc/Class/CommonState.hs+3 src/Text/Pandoc/Class/PandocIO.hs+4−2 src/Text/Pandoc/Class/PandocMonad.hs+5

MANUAL.txt+6

@@ -903,6 +903,12 @@ header when requesting a document from a URL:

903903 downloaded). If you're behind a proxy, you also need to set

904904 the environment variable `http_proxy` to `http://...`.

905905

906+`--no-check-certificate

907+

908+: Disable the certificate verification to allow access to

909+ unsecure HTTP resources (for example when the certificate

910+ is no longer valid or self signed).

911+

906912## Options affecting specific writers {.options}

907913

908914`--self-contained`

pandoc.cabal+1

@@ -426,6 +426,7 @@ library

426426 doctemplates >= 0.8.2 && < 0.9,

427427 network-uri >= 2.6 && < 2.7,

428428 network >= 2.6,

429+ connection >= 0.3.1,

429430 http-client >= 0.4.30 && < 0.7,

430431 http-client-tls >= 0.2.4 && < 0.4,

431432 http-types >= 0.8 && < 0.13,

src/Text/Pandoc/App.hs+2

@@ -270,6 +270,8 @@ convertWithOpts opts = do

270270

271271 mapM_ (uncurry setRequestHeader) (optRequestHeaders opts)

272272

273+ setNoCheckCertificate (optNoCheckCertificate opts)

274+

273275 doc <- sourceToDoc sources >>=

274276 ( (if isJust (optExtractMedia opts)

275277 then fillMediaBag

src/Text/Pandoc/App/CommandLineOptions.hs+5

@@ -414,6 +414,11 @@ options =

414414 "NAME:VALUE")

415415 ""

416416

417+ , Option "" ["no-check-certificate"]

418+ (NoArg

419+ (\opt -> return opt { optNoCheckCertificate = True }))

420+ "" -- "Disable certificate validation"

421+

417422 , Option "" ["abbreviations"]

418423 (ReqArg

419424 (\arg opt -> return opt { optAbbreviations = Just arg })

src/Text/Pandoc/App/Opt.hs+5

@@ -140,6 +140,7 @@ data Opt = Opt

140140 , optIncludeInHeader :: [FilePath] -- ^ Files to include in header

141141 , optResourcePath :: [FilePath] -- ^ Path to search for images etc

142142 , optRequestHeaders :: [(Text, Text)] -- ^ Headers for HTTP requests

143+ , optNoCheckCertificate :: Bool -- ^ Disable certificate validation

143144 , optEol :: LineEnding -- ^ Style of line-endings to use

144145 , optStripComments :: Bool -- ^ Skip HTML comments

145146 } deriving (Generic, Show)

@@ -390,6 +391,9 @@ doOpt (k',v) = do

390391 "request-headers" ->

391392 parseYAML v >>= \x ->

392393 return (\o -> o{ optRequestHeaders = x })

394+ "no-check-certificate" ->

395+ parseYAML v >>= \x ->

396+ return (\o -> o{ optNoCheckCertificate = x })

393397 "eol" ->

394398 parseYAML v >>= \x -> return (\o -> o{ optEol = x })

395399 "strip-comments" ->

@@ -466,6 +470,7 @@ defaultOpts = Opt

466470 , optIncludeInHeader = []

467471 , optResourcePath = ["."]

468472 , optRequestHeaders = []

473+ , optNoCheckCertificate = False

469474 , optEol = Native

470475 , optStripComments = False

471476 }

src/Text/Pandoc/Class/CommonState.hs+3

@@ -37,6 +37,8 @@ data CommonState = CommonState

3737 -- ^ Absolute URL + dir of 1st source file

3838 , stRequestHeaders :: [(Text, Text)]

3939 -- ^ Headers to add for HTTP requests

40+ , stNoCheckCertificate :: Bool

41+ -- ^ Controls whether certificate validation is disabled

4042 , stMediaBag :: MediaBag

4143 -- ^ Media parsed from binary containers

4244 , stTranslations :: Maybe (Lang, Maybe Translations)

@@ -67,6 +69,7 @@ defaultCommonState = CommonState

6769 , stUserDataDir = Nothing

6870 , stSourceURL = Nothing

6971 , stRequestHeaders = []

72+ , stNoCheckCertificate = False

7073 , stMediaBag = mempty

7174 , stTranslations = Nothing

7275 , stInputFiles = []

src/Text/Pandoc/Class/PandocIO.hs+4−2

@@ -54,7 +54,8 @@ import Network.HTTP.Client

5454 (httpLbs, responseBody, responseHeaders,

5555 Request(port, host, requestHeaders), parseRequest, newManager)

5656import Network.HTTP.Client.Internal (addProxy)

57−import Network.HTTP.Client.TLS (tlsManagerSettings)

57+import Network.HTTP.Client.TLS (mkManagerSettings)

58+import Network.Connection (TLSSettings (..))

5859import Network.HTTP.Types.Header ( hContentType )

5960import Network.Socket (withSocketsDo)

6061import Network.URI ( unEscapeString )

@@ -139,6 +140,7 @@ instance PandocMonad PandocIO where

139140 | otherwise = do

140141 let toReqHeader (n, v) = (CI.mk (UTF8.fromText n), UTF8.fromText v)

141142 customHeaders <- map toReqHeader <$> getsCommonState stRequestHeaders

143+ disableCertificateValidation <- getsCommonState stNoCheckCertificate

142144 report $ Fetching u

143145 res <- liftIO $ E.try $ withSocketsDo $ do

144146 let parseReq = parseRequest

@@ -149,7 +151,7 @@ instance PandocMonad PandocIO where

149151 return (addProxy (host r) (port r) x)

150152 req <- parseReq (T.unpack u) >>= addProxy'

151153 let req' = req{requestHeaders = customHeaders ++ requestHeaders req}

152− resp <- newManager tlsManagerSettings >>= httpLbs req'

154+ resp <- newManager (mkManagerSettings (TLSSettingsSimple disableCertificateValidation False False) Nothing) >>= httpLbs req'

153155 return (B.concat $ toChunks $ responseBody resp,

154156 UTF8.toText `fmap` lookup hContentType (responseHeaders resp))

155157

src/Text/Pandoc/Class/PandocMonad.hs+5

@@ -27,6 +27,7 @@ module Text.Pandoc.Class.PandocMonad

2727 , report

2828 , setTrace

2929 , setRequestHeader

30+ , setNoCheckCertificate

3031 , getLog

3132 , setVerbosity

3233 , getVerbosity

@@ -189,6 +190,10 @@ setRequestHeader name val = modifyCommonState $ \st ->

189190 st{ stRequestHeaders =

190191 (name, val) : filter (\(n,_) -> n /= name) (stRequestHeaders st) }

191192

193+-- | Determine whether certificate validation is disabled

194+setNoCheckCertificate :: PandocMonad m => Bool -> m ()

195+setNoCheckCertificate noCheckCertificate = modifyCommonState $ \st -> st{stNoCheckCertificate = noCheckCertificate}

196+

192197-- | Initialize the media bag.

193198setMediaBag :: PandocMonad m => MediaBag -> m ()

194199setMediaBag mb = modifyCommonState $ \st -> st{stMediaBag = mb}