{"action":"created","issue":{"url":"https://api.github.com/repos/commercialhaskell/stack/issues/2431","repository_url":"https://api.github.com/repos/commercialhaskell/stack","labels_url":"https://api.github.com/repos/commercialhaskell/stack/issues/2431/labels{/name}","comments_url":"https://api.github.com/repos/commercialhaskell/stack/issues/2431/comments","events_url":"https://api.github.com/repos/commercialhaskell/stack/issues/2431/events","html_url":"https://github.com/commercialhaskell/stack/issues/2431","id":169119756,"number":2431,"title":"URL in config files can specify request method","user":{"login":"Blaisorblade","id":289960,"avatar_url":"https://avatars.githubusercontent.com/u/289960?v=3","gravatar_id":"","url":"https://api.github.com/users/Blaisorblade","html_url":"https://github.com/Blaisorblade","followers_url":"https://api.github.com/users/Blaisorblade/followers","following_url":"https://api.github.com/users/Blaisorblade/following{/other_user}","gists_url":"https://api.github.com/users/Blaisorblade/gists{/gist_id}","starred_url":"https://api.github.com/users/Blaisorblade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Blaisorblade/subscriptions","organizations_url":"https://api.github.com/users/Blaisorblade/orgs","repos_url":"https://api.github.com/users/Blaisorblade/repos","events_url":"https://api.github.com/users/Blaisorblade/events{/privacy}","received_events_url":"https://api.github.com/users/Blaisorblade/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/commercialhaskell/stack/labels/type:%20enhancement","name":"type: enhancement","color":"fad8c7"}],"state":"open","locked":false,"assignee":{"login":"Blaisorblade","id":289960,"avatar_url":"https://avatars.githubusercontent.com/u/289960?v=3","gravatar_id":"","url":"https://api.github.com/users/Blaisorblade","html_url":"https://github.com/Blaisorblade","followers_url":"https://api.github.com/users/Blaisorblade/followers","following_url":"https://api.github.com/users/Blaisorblade/following{/other_user}","gists_url":"https://api.github.com/users/Blaisorblade/gists{/gist_id}","starred_url":"https://api.github.com/users/Blaisorblade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Blaisorblade/subscriptions","organizations_url":"https://api.github.com/users/Blaisorblade/orgs","repos_url":"https://api.github.com/users/Blaisorblade/repos","events_url":"https://api.github.com/users/Blaisorblade/events{/privacy}","received_events_url":"https://api.github.com/users/Blaisorblade/received_events","type":"User","site_admin":false},"assignees":[{"login":"Blaisorblade","id":289960,"avatar_url":"https://avatars.githubusercontent.com/u/289960?v=3","gravatar_id":"","url":"https://api.github.com/users/Blaisorblade","html_url":"https://github.com/Blaisorblade","followers_url":"https://api.github.com/users/Blaisorblade/followers","following_url":"https://api.github.com/users/Blaisorblade/following{/other_user}","gists_url":"https://api.github.com/users/Blaisorblade/gists{/gist_id}","starred_url":"https://api.github.com/users/Blaisorblade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Blaisorblade/subscriptions","organizations_url":"https://api.github.com/users/Blaisorblade/orgs","repos_url":"https://api.github.com/users/Blaisorblade/repos","events_url":"https://api.github.com/users/Blaisorblade/events{/privacy}","received_events_url":"https://api.github.com/users/Blaisorblade/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/commercialhaskell/stack/milestones/6","html_url":"https://github.com/commercialhaskell/stack/milestones/P2:%20Should","labels_url":"https://api.github.com/repos/commercialhaskell/stack/milestones/6/labels","id":1191309,"number":6,"title":"P2: Should","description":"Arbitrary date chosen, just to get the milestones to order nicely","creator":{"login":"snoyberg","id":49415,"avatar_url":"https://avatars.githubusercontent.com/u/49415?v=3","gravatar_id":"","url":"https://api.github.com/users/snoyberg","html_url":"https://github.com/snoyberg","followers_url":"https://api.github.com/users/snoyberg/followers","following_url":"https://api.github.com/users/snoyberg/following{/other_user}","gists_url":"https://api.github.com/users/snoyberg/gists{/gist_id}","starred_url":"https://api.github.com/users/snoyberg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snoyberg/subscriptions","organizations_url":"https://api.github.com/users/snoyberg/orgs","repos_url":"https://api.github.com/users/snoyberg/repos","events_url":"https://api.github.com/users/snoyberg/events{/privacy}","received_events_url":"https://api.github.com/users/snoyberg/received_events","type":"User","site_admin":false},"open_issues":173,"closed_issues":223,"state":"open","created_at":"2015-07-02T18:20:49Z","updated_at":"2016-08-04T17:08:57Z","due_on":"2016-12-31T08:00:00Z","closed_at":null},"comments":2,"created_at":"2016-08-03T12:29:47Z","updated_at":"2016-08-04T18:47:50Z","closed_at":null,"body":"While reviewing #2412, I double-checked that the URL-parser `parseRequest` in `FromJSON PackageLocation` did the right thing. But it seems it doesn't quite do that. It allows specifying a method: `parseRequest \"POST http://httpbin.org/post\"` [1].\r\nPotentially worse, I can ship somebody a stack.yaml that will trigger POST requests upon install. I don't see how to actually exploit this, but someone might. Switching to another URI parser should prevent this, and should be easy since the parsed URI is thrown away. One should probably also review the parsing that is used to actually access the URI though.\r\n\r\n[1] https://hackage.haskell.org/package/http-client-0.5.0/docs/Network-HTTP-Client.html#v:parseRequest\r\n\r\n[2] http://hackage.haskell.org/package/network-uri-2.6.1.0/docs/Network-URI.html#v:parseURI"},"comment":{"url":"https://api.github.com/repos/commercialhaskell/stack/issues/comments/237646861","html_url":"https://github.com/commercialhaskell/stack/issues/2431#issuecomment-237646861","issue_url":"https://api.github.com/repos/commercialhaskell/stack/issues/2431","id":237646861,"user":{"login":"borsboom","id":2164261,"avatar_url":"https://avatars.githubusercontent.com/u/2164261?v=3","gravatar_id":"","url":"https://api.github.com/users/borsboom","html_url":"https://github.com/borsboom","followers_url":"https://api.github.com/users/borsboom/followers","following_url":"https://api.github.com/users/borsboom/following{/other_user}","gists_url":"https://api.github.com/users/borsboom/gists{/gist_id}","starred_url":"https://api.github.com/users/borsboom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/borsboom/subscriptions","organizations_url":"https://api.github.com/users/borsboom/orgs","repos_url":"https://api.github.com/users/borsboom/repos","events_url":"https://api.github.com/users/borsboom/events{/privacy}","received_events_url":"https://api.github.com/users/borsboom/received_events","type":"User","site_admin":false},"created_at":"2016-08-04T18:47:50Z","updated_at":"2016-08-04T18:47:50Z","body":"There are a lot of ways that building Haskell code is insecure.  For example, TemplateHaskell code can basically issue any HTTP request it wants to (or do anything else on your system), so security issues in stack.yaml, while unfortunate, probably don't make much difference to overall security."}}
{"actor":{"display_login":"borsboom"}}