# HG changeset patch # User Kim Alvefur # Date 1577895400 -3600 # Node ID 937f8c463be643e16df669d914b64d9fa8091fa1 # Parent 8473fd2d09c1ddf16076b745d3f3157e38d40071 mod_rest: Stricter type checks in JSON mapping diff -r 8473fd2d09c1 -r 937f8c463be6 mod_rest/jsonmap.lib.lua --- a/mod_rest/jsonmap.lib.lua Wed Jan 01 16:40:10 2020 +0100 +++ b/mod_rest/jsonmap.lib.lua Wed Jan 01 17:16:40 2020 +0100 @@ -31,7 +31,9 @@ return tostring(s:get_child("body", "http://www.w3.org/1999/xhtml")); end; function (s) --> xml - return xml.parse([[]]..s..[[]]); + if type(s) == "string" then + return xml.parse([[]]..s..[[]]); + end end; }; @@ -95,7 +97,9 @@ return s:get_child_text("url"); end; function (s) - return st.stanza("query", { xmlns = "jabber:iq:oob" }):text_tag("url", s); + if type(s) == "string" then + return st.stanza("query", { xmlns = "jabber:iq:oob" }):text_tag("url", s); + end end; }; }; @@ -188,8 +192,17 @@ return t; end +local function str(s) + if type(s) == "string" then + return s; + end +end + local function json2st(t) - local kind = t.kind or kind_by_type[t.type]; + if type(t) ~= "table" or not str(next(t)) then + return nil, "invalid-json"; + end + local kind = str(t.kind) or kind_by_type[str(t.type)]; if not kind then for k, implied in pairs(implied_kinds) do if t[k] then @@ -200,10 +213,10 @@ end local s = st.stanza(kind or "message", { - type = t.type ~= "available" and t.type or nil, - to = jid.prep(t.to); - from = jid.prep(t.from); - id = t.id, + type = t.type ~= "available" and str(t.type) or nil, + to = str(t.to) and jid.prep(t.to); + from = str(t.to) and jid.prep(t.from); + id = str(t.id), }); if t.to and not s.attr.to then @@ -213,8 +226,8 @@ return nil, "invalid-jid-from"; end - if t.error then - return st.error_reply(st.reply(s), t.error.type, t.error.condition, t.error.text); + if type(t.error) == "table" then + return st.error_reply(st.reply(s), str(t.error.type), str(t.error.condition), str(t.error.text)); elseif t.type == "error" then s:text_tag("error", t.body, { code = t.error_code and tostring(t.error_code) }); return s;