haskell / haskell/cabal

Make cabal-install more resilient to incorrect cabal files in index

Open
#2,572 1 comment 0 reactions 0 assignees View on GitHub
type: bug
Dominant language
Haskell
Stars
1.7k
Forks
750
Avg merge
4d 3h
Merged PRs (30d)
28

Description

The most recent incarnation of this is:

https://github.com/haskell/hackage-server/issues/351

The problem there was a byte order marker (BOM) added to the front of the cabal file, which wasn't parsed (I'll open a separate issue about that). However, this raises an issue we've seen with cabal in the past: a single problematic file will block cabal-install from doing some activities until it is resolved. Instead, it seems like a more reasonable behavior would be:
- Print a warning about that file
- Ignore that file completely

As it stands, an attacker could detect a bug in Hackage Server and continually exploit it with broken cabal files until Hackage is fixed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.