haskell / haskell/cabal

~/.cabal/config does not allow setting a http proxy

Open
#1,138 0 comments 0 reactions 0 assignees View on GitHub
cabal-install: other old-milestone: ⊥ type: enhancement
Dominant language
Haskell
Stars
1.7k
Forks
750
Avg merge
4d 3h
Merged PRs (30d)
28

Description

Cabal uses Network.HTTP.Proxy which looks up proxy settings via the `http_proxy` and `HTTP_PROXY` environment variables.

(Under Windows it also queries the registry for a proxy setting).

Thus, to use cabal behind a proxy one has to put all proxy information into an environment variable.

This is a security related issue when following conditions apply:
1. working on a multi-user system
2. a user is able to inspect the environment variables of other users (e.g. on Solaris this is the case)
3. Proxy access is restricted via username/password

Sure, one can argue that the issue is not that big because most users don't work on multi-user systems, even less use systems like Solaris and most proxy password are not that secret.

But still.

To fix this there are a few possibilities:
- add http proxy server/username/password options to ~/.cabal/config
- modify Network.HTTP.Proxy such that it also looks up possibly configured proxy settings via ~/.curlrc, ~/.wgetrc etc.

Contributor guide

Open the contributing guide

Research direction

Start by reading Network.HTTP.Proxy and Cabal's ~/.cabal/config handling, then compare the current environment-variable and Windows registry lookup described in the issue. Decide which configuration source and proxy fields are in scope; done means Cabal can obtain proxy server and restricted credentials from user configuration without requiring environment variables.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell
Domain
cli, security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.