rest-core 0.36.0.5 → 0.36.0.6

raw patch · 3 files changed

+15/−6 lines, 3 filesdep ~aesonPVP: major bump suggested

API removals or changes: PVP suggests a major version bump

Dependency ranges changed: aeson

API changes (from Hackage documentation)

- Rest.Dictionary.Types: data Dict h_abdk p_abdl i_abdm o_abdn e_abdo

+ Rest.Dictionary.Types: data Dict h_abgy p_abgz i_abgA o_abgB e_abgC

Files

CHANGELOG.md +5/−0
rest-core.cabal +2/−2
src/Rest/Driver/Perform.hs +8/−4

CHANGELOG.md view

@@ -1,8 +1,13 @@ # Changelog +#### 0.36.0.6++* Security: don't allow newlines in filenames.+ #### 0.36.0.5  * Fix documentation for `fileO`.+* Allow `HUnit 1.3.*`.  #### 0.36.0.4

rest-core.cabal view

@@ -1,5 +1,5 @@ name:                rest-core-version:             0.36.0.5+version:             0.36.0.6 description:         Rest API library. synopsis:            Rest API library. maintainer:          code@silk.co@@ -72,7 +72,7 @@   type:              exitcode-stdio-1.0   build-depends:       base >= 4.5 && < 4.9-    , HUnit == 1.2.*+    , HUnit >= 1.2 && < 1.4     , bytestring >= 0.9 && < 0.11     , mtl >= 2.0 && < 2.3     , rest-core

src/Rest/Driver/Perform.hs view

@@ -24,7 +24,7 @@ import Control.Monad.Trans.Maybe (MaybeT (..)) import Control.Monad.Writer import Data.Aeson.Utils-import Data.Char (isSpace, toLower)+import Data.Char (isSpace, toLower, ord) import Data.List import Data.List.Split import Data.Maybe@@ -325,14 +325,18 @@              setHeader "Content-Type" mime              setHeader "Cache-Control" "max-age=604800"              setHeader "Content-Disposition" (  (if isAttachment then "attachment; " else "")-                                             ++ "filename=\"" ++ escapeQuotes filename ++ "\""+                                             ++ "filename=\"" ++ headerEscape filename ++ "\""                                              )              ok content         tryD []                t            = unsupportedFormat t         tryD (_          : xs) t            = tryD xs t     ok r = setResponseCode 200 >> return r-    escapeQuotes :: String -> String-    escapeQuotes = intercalate "\\\"" . splitOn "\""+    -- Escape double quotes with a backslash, since we quote the+    -- values with double quotes, and filter out characters below+    -- space. The latter prevents e.g. newlines ending up in the file+    -- name, which can cause 'response splitting' security issues.+    headerEscape :: String -> String+    headerEscape = filter ((>=32) . ord) . intercalate "\\\"" . splitOn "\""  unsupportedFormat :: (Monad m, Show a) => a -> ExceptT (Last DataError) m a1 unsupportedFormat = throwError . Last . Just . UnsupportedFormat . show