d385ada853
If someone wants their website to score a good grade on a security vulnerability scanner like Mozilla Observatory, they will need to enable the Content Security Policy header. When using CSP, it is possible to explicitly allow inline JavaScript in `<script>` tags by specifying the sha256 of the snippet. However the same is _not_ true of any JavaScript included in a HTML attribute like `onload`. This changes moves the JavaScript form submission out of the `onload` HTML attribute and into a `<script>` tag so the user can add the hash of this script to their explicitly-allowed `script-src` list, and they can avoid using undesirable CSP rules like `unsafe-inline`. Without explicitly allowing this script when using CSP, the script would fail and the user would have to click the button to continue.
218 lines
7.7 KiB
Plaintext
218 lines
7.7 KiB
Plaintext
name: yesod-core
|
|
version: 1.6.15
|
|
license: MIT
|
|
license-file: LICENSE
|
|
author: Michael Snoyman <michael@snoyman.com>
|
|
maintainer: Michael Snoyman <michael@snoyman.com>
|
|
synopsis: Creation of type-safe, RESTful web applications.
|
|
description: API docs and the README are available at <http://www.stackage.org/package/yesod-core>
|
|
category: Web, Yesod
|
|
stability: Stable
|
|
cabal-version: >= 1.8
|
|
build-type: Simple
|
|
homepage: http://www.yesodweb.com/
|
|
extra-source-files:
|
|
test/YesodCoreTest.hs
|
|
test/YesodCoreTest/*.hs
|
|
test/YesodCoreTest/JsLoaderSites/Bottom.hs
|
|
test/en.msg
|
|
test/test.hs
|
|
test/fixtures/routes_with_line_continuations
|
|
ChangeLog.md
|
|
README.md
|
|
|
|
library
|
|
hs-source-dirs: src
|
|
|
|
build-depends: base >= 4.9 && < 5
|
|
, aeson >= 1.0
|
|
, auto-update
|
|
, blaze-html >= 0.5
|
|
, blaze-markup >= 0.7.1
|
|
, bytestring >= 0.10.2
|
|
, case-insensitive >= 0.2
|
|
, cereal >= 0.3
|
|
, clientsession >= 0.9.1 && < 0.10
|
|
, conduit >= 1.3
|
|
, conduit-extra
|
|
, containers >= 0.2
|
|
, cookie >= 0.4.3 && < 0.5
|
|
, deepseq >= 1.3
|
|
, fast-logger >= 2.2
|
|
, http-types >= 0.7
|
|
, memory
|
|
, monad-logger >= 0.3.10 && < 0.4
|
|
, mtl
|
|
, parsec >= 2 && < 3.2
|
|
, path-pieces >= 0.1.2 && < 0.3
|
|
, primitive >= 0.6
|
|
, random >= 1.0.0.2 && < 1.2
|
|
, resourcet >= 1.2
|
|
, rio
|
|
, shakespeare >= 2.0
|
|
, template-haskell >= 2.11
|
|
, text >= 0.7
|
|
, time >= 1.5
|
|
, transformers >= 0.4
|
|
, unix-compat
|
|
, unliftio
|
|
, unordered-containers >= 0.2
|
|
, vector >= 0.9 && < 0.13
|
|
, wai >= 3.2
|
|
, wai-extra >= 3.0.7
|
|
, wai-logger >= 0.2
|
|
, warp >= 3.0.2
|
|
, word8
|
|
|
|
exposed-modules: Yesod.Core
|
|
Yesod.Core.Content
|
|
Yesod.Core.Dispatch
|
|
Yesod.Core.Handler
|
|
Yesod.Core.Json
|
|
Yesod.Core.Widget
|
|
Yesod.Core.Internal
|
|
Yesod.Core.Types
|
|
Yesod.Core.Unsafe
|
|
Yesod.Routes.TH.Types
|
|
other-modules: Yesod.Core.Internal.Session
|
|
Yesod.Core.Internal.Request
|
|
Yesod.Core.Class.Handler
|
|
Yesod.Core.Internal.Util
|
|
Yesod.Core.Internal.Response
|
|
Yesod.Core.Internal.Run
|
|
Yesod.Core.Internal.TH
|
|
Yesod.Core.Internal.LiteApp
|
|
Yesod.Core.Class.Yesod
|
|
Yesod.Core.Class.Dispatch
|
|
Yesod.Core.Class.Breadcrumbs
|
|
Yesod.Core.TypeCache
|
|
Paths_yesod_core
|
|
|
|
Yesod.Routes.TH
|
|
Yesod.Routes.Class
|
|
Yesod.Routes.Parse
|
|
Yesod.Routes.Overlap
|
|
Yesod.Routes.TH.Dispatch
|
|
Yesod.Routes.TH.RenderRoute
|
|
Yesod.Routes.TH.ParseRoute
|
|
Yesod.Routes.TH.RouteAttrs
|
|
|
|
ghc-options: -Wall
|
|
-- Following line added due to: https://github.com/yesodweb/yesod/issues/545
|
|
-- This looks like a GHC bug
|
|
extensions: MultiParamTypeClasses
|
|
|
|
-- Workaround for: http://ghc.haskell.org/trac/ghc/ticket/8443
|
|
extensions: TemplateHaskell
|
|
|
|
test-suite test-routes
|
|
type: exitcode-stdio-1.0
|
|
main-is: RouteSpec.hs
|
|
hs-source-dirs: test, src
|
|
|
|
other-modules: Hierarchy
|
|
Yesod.Routes.Class
|
|
Yesod.Routes.Overlap
|
|
Yesod.Routes.Parse
|
|
Yesod.Routes.TH
|
|
Yesod.Routes.TH.Dispatch
|
|
Yesod.Routes.TH.ParseRoute
|
|
Yesod.Routes.TH.RenderRoute
|
|
Yesod.Routes.TH.RouteAttrs
|
|
Yesod.Routes.TH.Types
|
|
|
|
-- Workaround for: http://ghc.haskell.org/trac/ghc/ticket/8443
|
|
extensions: TemplateHaskell
|
|
|
|
build-depends: base
|
|
, hspec
|
|
, containers
|
|
, bytestring
|
|
, template-haskell
|
|
, text
|
|
, random
|
|
, path-pieces
|
|
, HUnit
|
|
|
|
test-suite tests
|
|
type: exitcode-stdio-1.0
|
|
main-is: test.hs
|
|
hs-source-dirs: test
|
|
|
|
other-modules: YesodCoreTest
|
|
YesodCoreTest.Auth
|
|
YesodCoreTest.Cache
|
|
YesodCoreTest.CleanPath
|
|
YesodCoreTest.Header
|
|
YesodCoreTest.Csrf
|
|
YesodCoreTest.ErrorHandling
|
|
YesodCoreTest.Exceptions
|
|
YesodCoreTest.InternalRequest
|
|
YesodCoreTest.JsLoader
|
|
YesodCoreTest.JsLoaderSites.Bottom
|
|
YesodCoreTest.Json
|
|
YesodCoreTest.Links
|
|
YesodCoreTest.LiteApp
|
|
YesodCoreTest.Media
|
|
YesodCoreTest.MediaData
|
|
YesodCoreTest.NoOverloadedStrings
|
|
YesodCoreTest.NoOverloadedStringsSub
|
|
YesodCoreTest.RawResponse
|
|
YesodCoreTest.Redirect
|
|
YesodCoreTest.Reps
|
|
YesodCoreTest.RequestBodySize
|
|
YesodCoreTest.Ssl
|
|
YesodCoreTest.Streaming
|
|
YesodCoreTest.StubLaxSameSite
|
|
YesodCoreTest.StubSslOnly
|
|
YesodCoreTest.StubStrictSameSite
|
|
YesodCoreTest.StubUnsecured
|
|
YesodCoreTest.WaiSubsite
|
|
YesodCoreTest.Widget
|
|
YesodCoreTest.YesodTest
|
|
|
|
cpp-options: -DTEST
|
|
if os(windows)
|
|
cpp-options: -DWINDOWS
|
|
build-depends: base
|
|
, async
|
|
, bytestring
|
|
, clientsession
|
|
, conduit
|
|
, conduit-extra
|
|
, containers
|
|
, cookie >= 0.4.1 && < 0.5
|
|
, hspec >= 1.3
|
|
, hspec-expectations
|
|
, http-types
|
|
, network
|
|
, random
|
|
, resourcet
|
|
, shakespeare
|
|
, streaming-commons
|
|
, text
|
|
, transformers
|
|
, unliftio
|
|
, wai >= 3.0
|
|
, wai-extra
|
|
, warp
|
|
, yesod-core
|
|
ghc-options: -Wall -threaded
|
|
extensions: TemplateHaskell
|
|
|
|
benchmark widgets
|
|
type: exitcode-stdio-1.0
|
|
hs-source-dirs: bench
|
|
build-depends: base
|
|
, blaze-html
|
|
, bytestring
|
|
, gauge
|
|
, shakespeare
|
|
, text
|
|
main-is: widget.hs
|
|
ghc-options: -Wall -O2
|
|
|
|
source-repository head
|
|
type: git
|
|
location: https://github.com/yesodweb/yesod
|