keter 1.8.1 → 1.8.2
raw patch · 3 files changed
+12/−3 lines, 3 filesPVP ok
version bump matches the API change (PVP)
API changes (from Hackage documentation)
Files
- ChangeLog.md +5/−0
- Keter/Proxy.hs +6/−2
- keter.cabal +1/−1
ChangeLog.md view
@@ -1,3 +1,8 @@+## 1.8.2 +++ Fix XSS issue in the default response.+ (special thanks to Max @ulidtko for spotting and fixing this)+ ## 1.8.1 + Fix haddock build
Keter/Proxy.hs view
@@ -13,7 +13,8 @@ import qualified Network.HTTP.Conduit as HTTP import qualified Data.CaseInsensitive as CI import qualified Keter.HostManager as HostMan-import Blaze.ByteString.Builder (copyByteString)+import Blaze.ByteString.Builder (copyByteString, toByteString)+import Blaze.ByteString.Builder.Html.Word(fromHtmlEscapedByteString) import Control.Applicative ((<$>), (<|>)) import Control.Monad.IO.Class (liftIO) import qualified Data.ByteString as S@@ -284,10 +285,13 @@ defaultUnknownHostBody :: ByteString -> ByteString defaultUnknownHostBody host = "<!DOCTYPE html>\n<html><head><title>Welcome to Keter</title></head><body><h1>Welcome to Keter</h1><p>The hostname you have provided, <code>"- <> host <> "</code>, is not recognized.</p></body></html>"+ <> escapeHtml host <> "</code>, is not recognized.</p></body></html>" unknownHostResponse :: ByteString -> ByteString -> Wai.Response unknownHostResponse host body = Wai.responseBuilder status200 [("Content-Type", "text/html; charset=utf-8"), ("X-Forwarded-Host", host)] (copyByteString body)++escapeHtml :: ByteString -> ByteString+escapeHtml = toByteString . fromHtmlEscapedByteString
keter.cabal view
@@ -1,6 +1,6 @@ Cabal-version: >=1.10 Name: keter-Version: 1.8.1+Version: 1.8.2 Synopsis: Web application deployment manager, focusing on Haskell web frameworks Description: Hackage documentation generation is not reliable. For up to date documentation, please see: <http://www.stackage.org/package/keter>. Homepage: http://www.yesodweb.com/