summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/Main.hs24
1 files changed, 22 insertions, 2 deletions
diff --git a/src/Main.hs b/src/Main.hs
index d91aee3..5b8b66f 100644
--- a/src/Main.hs
+++ b/src/Main.hs
@@ -6,17 +6,18 @@
module Main where
+import Control.Monad.Identity (Identity)
import Data.Aeson (eitherDecode, encode)
import Data.Aeson.Encode.Pretty (encodePretty)
+import Data.Aeson.KeyMap (coercionToHashMap)
import qualified Data.ByteString.Char8 as C8
import qualified Data.ByteString.Lazy as LB
import Data.Maybe (fromMaybe)
+import System.Exit (exitWith)
import WithCli
import CheckDir (recursiveCheckDir)
-import Control.Monad.Identity (Identity)
import LintConfig (LintConfig (..), patch)
-import System.Exit (exitWith)
import Types (Level (..))
import Util (printPretty)
import WriteRepo (writeAdjustedRepository)
@@ -46,6 +47,8 @@ main = withCli run
run :: Options -> IO ()
run options = do
+ aesonWarning
+
let repo = fromMaybe "." (repository options)
let entry = fromMaybe "main.json" (entrypoint options)
let level = fromMaybe Suggestion (lintlevel options)
@@ -74,3 +77,20 @@ run options = do
-- | haskell's many string types are FUN …
printLB :: LB.ByteString -> IO ()
printLB a = putStrLn $ C8.unpack $ LB.toStrict a
+
+
+-- if Aesons's internal map and HashMap are the same type, then coercionToHashMap
+-- will contain a proof of that, and we can print a warning. Otherwise we're not
+-- using HashMaps in Aeson and everything is fine.
+--
+-- cf. https://frasertweedale.github.io/blog-fp/posts/2021-10-12-aeson-hash-flooding-protection.html
+aesonWarning :: IO ()
+aesonWarning = case coercionToHashMap of
+ Just _ -> putStrLn
+ "Warning: this program was compiled using an older version of the Aeson Library\n\
+ \used for parsing JSON, which is susceptible to hash flooding attacks.\n\
+ \n\
+ \Recompiling with a newer version is recommended when handling untrusted inputs.\n\
+ \n\
+ \See https://cs-syd.eu/posts/2021-09-11-json-vulnerability for details."
+ _ -> pure ()