prosody
0.11.12
net/httpserver.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

net/httpserver.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 8679:adc17a2bd6fd
child 12974:ba409c67353b
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
4784
e10b623ccecb net.httpserver: Add compatibility stub
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 -- COMPAT w/pre-0.9
e10b623ccecb net.httpserver: Add compatibility stub
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2 local log = require "util.logger".init("net.httpserver");
e10b623ccecb net.httpserver: Add compatibility stub
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 local traceback = debug.traceback;
e10b623ccecb net.httpserver: Add compatibility stub
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4
6780
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 4797
diff changeset
5 local _ENV = nil;
8555
4f0f5b49bb03 vairious: Add annotation when an empty environment is set [luacheck]
Kim Alvefur <zash@zash.se>
parents: 7359
diff changeset
6 -- luacheck: std none
4784
e10b623ccecb net.httpserver: Add compatibility stub
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7
8679
adc17a2bd6fd net.httpserver: Make function local, fixes loading since there is no environment [luacheck]
Kim Alvefur <zash@zash.se>
parents: 8555
diff changeset
8 local function fail()
7359
a5a080c12c96 Update every link to the documentation to use HTTPS
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6780
diff changeset
9 log("error", "Attempt to use legacy HTTP API. For more info see https://prosody.im/doc/developers/legacy_http");
4784
e10b623ccecb net.httpserver: Add compatibility stub
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 log("error", "Legacy HTTP API usage, %s", traceback("", 2));
e10b623ccecb net.httpserver: Add compatibility stub
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 end
e10b623ccecb net.httpserver: Add compatibility stub
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12
6780
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 4797
diff changeset
13 return {
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 4797
diff changeset
14 new = fail;
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 4797
diff changeset
15 new_from_config = fail;
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 4797
diff changeset
16 set_default_handler = fail;
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 4797
diff changeset
17 };