Make cabal-install more resilient to incorrect cabal files in index
- Dominant language
- Haskell
- Stars
- 1.7k
- Forks
- 750
- Avg merge
- 4d 3h
- Merged PRs (30d)
- 28
Description
The most recent incarnation of this is:
https://github.com/haskell/hackage-server/issues/351
The problem there was a byte order marker (BOM) added to the front of the cabal file, which wasn't parsed (I'll open a separate issue about that). However, this raises an issue we've seen with cabal in the past: a single problematic file will block cabal-install from doing some activities until it is resolved. Instead, it seems like a more reasonable behavior would be:
- Print a warning about that file
- Ignore that file completely
As it stands, an attacker could detect a bug in Hackage Server and continually exploit it with broken cabal files until Hackage is fixed.
Contributor guide
Assessment
This issue has not been assessed yet.