~/.cabal/config does not allow setting a http proxy
- Dominant language
- Haskell
- Stars
- 1.7k
- Forks
- 750
- Avg merge
- 4d 3h
- Merged PRs (30d)
- 28
Description
Cabal uses Network.HTTP.Proxy which looks up proxy settings via the `http_proxy` and `HTTP_PROXY` environment variables.
(Under Windows it also queries the registry for a proxy setting).
Thus, to use cabal behind a proxy one has to put all proxy information into an environment variable.
This is a security related issue when following conditions apply:
1. working on a multi-user system
2. a user is able to inspect the environment variables of other users (e.g. on Solaris this is the case)
3. Proxy access is restricted via username/password
Sure, one can argue that the issue is not that big because most users don't work on multi-user systems, even less use systems like Solaris and most proxy password are not that secret.
But still.
To fix this there are a few possibilities:
- add http proxy server/username/password options to ~/.cabal/config
- modify Network.HTTP.Proxy such that it also looks up possibly configured proxy settings via ~/.curlrc, ~/.wgetrc etc.
Contributor guide
Research direction
Start by reading Network.HTTP.Proxy and Cabal's ~/.cabal/config handling, then compare the current environment-variable and Windows registry lookup described in the issue. Decide which configuration source and proxy fields are in scope; done means Cabal can obtain proxy server and restricted credentials from user configuration without requiring environment variables.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- cli, security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100