haskoin-store 0.50.1 → 0.50.2

raw patch · 3 files changed

+13/−7 lines, 3 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

CHANGELOG.md +4/−0
haskoin-store.cabal +2/−2
src/Haskoin/Store/Web.hs +7/−5

CHANGELOG.md view

@@ -4,6 +4,10 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html) +## 0.50.2+### Fixed+- Do not use lazy parsers for incoming data that may throw exceptions.+ ## 0.50.1 ### Fixed - Do not allow incoming POST requests of unlimited body size.

haskoin-store.cabal view

@@ -4,10 +4,10 @@ -- -- see: https://github.com/sol/hpack ----- hash: bd4a50aa77300f41f9483c3f6931ebf56585ffd7ff1d19040ba6b0323e5bc86e+-- hash: 827fba47671e7c0038fb903785a91426dd34287b9cc01615b5b05469647de51f  name:           haskoin-store-version:        0.50.1+version:        0.50.2 synopsis:       Storage and index for Bitcoin and Bitcoin Cash description:    Please see the README on GitHub at <https://github.com/haskoin/haskoin-store#readme> category:       Bitcoin, Finance, Network

src/Haskoin/Store/Web.hs view

@@ -46,10 +46,10 @@ import           Data.Aeson.Encoding                     (encodingToLazyByteString,                                                           list) import           Data.Aeson.Text                         (encodeToLazyText)+import qualified Data.ByteString.Base16                  as B16 import           Data.ByteString.Builder                 (lazyByteString)+import qualified Data.ByteString.Char8                   as C import qualified Data.ByteString.Lazy                    as L-import qualified Data.ByteString.Lazy.Base16             as BL16-import qualified Data.ByteString.Lazy.Char8              as C import           Data.Bytes.Get import           Data.Bytes.Put import           Data.Bytes.Serial@@ -1983,13 +1983,15 @@  parseBody :: (MonadIO m, Serial a) => WebT m a parseBody = do-    b <- S.body+    b <- L.toStrict <$> S.body     case hex b <> bin b of         Left _  -> raise_ $ UserError "Failed to parse request body"         Right x -> return x   where-    bin = runGetL deserialize-    hex = bin <=< BL16.decodeBase16 . C.filter (not . isSpace)+    bin = runGetS deserialize+    hex b = case B16.decodeBase16 $ C.filter (not . isSpace) b of+                Right x -> bin x+                Left s -> Left (T.unpack s)  parseOffset :: MonadIO m => WebT m OffsetParam parseOffset = do