diff options
| author | Thomas Gerbet <thomas.gerbet@enalean.com> | 2024-06-26 17:59:01 +0200 |
|---|---|---|
| committer | maralorn <mail@maralorn.de> | 2024-06-26 23:06:44 +0200 |
| commit | 08c21134cdf4852f251a71bac0b859f9e3237ba2 (patch) | |
| tree | 65b5381c3b9601e41b01c71cc2e82b0a86018fea /pkgs | |
| parent | 00ba4c2c35f5e450f28e13e931994c730df05563 (diff) | |
pandoc: apply patch removing the usage of polyfill.io in the templates
If you output HTML with MathJax content Pandoc might uses a JS library
provided by cdn.polyfill.io which is now considered to be a bad actor.
https://sansec.io/research/polyfill-supply-chain-attack
Pandoc does not use this domain in recent versions but upgrading it
seems more complex right now especially if we consider backports to
the stable releases.
Diffstat (limited to 'pkgs')
| -rw-r--r-- | pkgs/development/haskell-modules/configuration-common.nix | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix index e1efb46422a3..fb6f9608b76d 100644 --- a/pkgs/development/haskell-modules/configuration-common.nix +++ b/pkgs/development/haskell-modules/configuration-common.nix @@ -1962,7 +1962,17 @@ self: super: { readline = appendPatch ./patches/readline-fix-for-cabal-3.patch super.readline; # https://github.com/jgm/pandoc/issues/9589 - pandoc = assert super.pandoc.version == "3.1.11.1"; dontCheck super.pandoc; + pandoc = assert super.pandoc.version == "3.1.11.1"; lib.pipe super.pandoc + [ + dontCheck + (appendPatch + (pkgs.fetchpatch { + name = "drop-usage-known-bad-actor-cdn.patch"; + url = "https://github.com/jgm/pandoc/commit/5877ec546df29115163b36de32837f5e08506092.patch"; + hash = "sha256-2ffdL2dS/hHWBjJcIHbae5OdL/VKlHNKUMDHRy3hqvc="; + }) + ) + ]; # 2020-12-06: Restrictive upper bounds w.r.t. pandoc-types (https://github.com/owickstrom/pandoc-include-code/issues/27) pandoc-include-code = doJailbreak super.pandoc-include-code; |