Relax tar upper bound

ffaf1 · Dec 24, 2023 · 8926552 · 8926552
1 parent 52d1fb6
commit 8926552
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 4 deletions.
diff --git a/Cabal-tests/Cabal-tests.cabal b/Cabal-tests/Cabal-tests.cabal
@@ -167,7 +167,7 @@ test-suite hackage-tests
     , clock                 >=0.8      && <0.9
     , optparse-applicative  >=0.13.2.0 && <0.19
     , stm                   >=2.4.5.0  && <2.6
-    , tar                   >=0.5.0.3  && <0.6
+    , tar                   >=0.5.0.3  && <0.7
     , tree-diff             >=0.1      && <0.4
 
   ghc-options:        -Wall -rtsopts -threaded

diff --git a/cabal-install/cabal-install.cabal b/cabal-install/cabal-install.cabal
@@ -227,7 +227,7 @@ library
         process    >= 1.2.3.0  && < 1.7,
         random     >= 1.2      && < 1.3,
         stm        >= 2.0      && < 2.6,
-        tar        >= 0.5.0.3  && < 0.6,
+        tar        >= 0.5.0.3  && < 0.7,
         time       >= 1.5.0.1  && < 1.13,
         zlib       >= 0.5.3    && < 0.7,
         hackage-security >= 0.6.2.0 && < 0.7,

diff --git a/cabal-install/src/Distribution/Client/Tar.hs b/cabal-install/src/Distribution/Client/Tar.hs
@@ -69,8 +69,12 @@ extractTarGzFile
   -- ^ Tarball
   -> IO ()
 extractTarGzFile dir expected tar =
-  Tar.unpack dir
-    . Tar.checkTarbomb expected
+  Tar.unpackAndCheck
+    ( \x ->
+        SomeException <$> Tar.checkEntryTarbomb expected x
+          <|> SomeException <$> Tar.checkEntrySecurity x
+    )
+    dir
     . Tar.read
     . GZipUtils.maybeDecompress
     =<< BS.readFile tar