prosody
0.11.12
plugins/mod_lastactivity.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

plugins/mod_lastactivity.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 9224:a84dbd2e08bc
child 10750:ff087f2d4cb6
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
2018
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
1 -- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2029
diff changeset
2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2029
diff changeset
3 -- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 2923
diff changeset
4 --
2018
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
5 -- This project is MIT/X11 licensed. Please see the
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
6 -- COPYING file in the source package for more information.
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
7 --
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
8
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
9 local st = require "util.stanza";
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
10 local is_contact_subscribed = require "core.rostermanager".is_contact_subscribed;
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
11 local jid_bare = require "util.jid".bare;
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
12 local jid_split = require "util.jid".split;
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
13
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
14 module:add_feature("jabber:iq:last");
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
15
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
16 local map = {};
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
17
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
18 module:hook("pre-presence/bare", function(event)
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
19 local stanza = event.stanza;
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
20 if not(stanza.attr.to) and stanza.attr.type == "unavailable" then
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
21 local t = os.time();
6302
76699a0ae4c4 mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
22 local s = stanza:get_child_text("status");
2018
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
23 map[event.origin.username] = {s = s, t = t};
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
24 end
2029
d2363643a5c0 mod_lastactivity: Gave a positive priority to the presence event hook.
Waqas Hussain <waqas20@gmail.com>
parents: 2026
diff changeset
25 end, 10);
2018
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
26
9224
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
27 module:hook("iq-get/bare/jabber:iq:last:query", function(event)
2018
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
28 local origin, stanza = event.origin, event.stanza;
9224
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
29 local username = jid_split(stanza.attr.to) or origin.username;
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
30 if not stanza.attr.to or is_contact_subscribed(username, module.host, jid_bare(stanza.attr.from)) then
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
31 local seconds, text = "0", "";
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
32 if map[username] then
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
33 seconds = tostring(os.difftime(os.time(), map[username].t));
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
34 text = map[username].s;
2018
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
35 end
9224
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
36 origin.send(st.reply(stanza):tag('query', {xmlns='jabber:iq:last', seconds=seconds}):text(text));
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
37 else
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
38 origin.send(st.error_reply(stanza, 'auth', 'forbidden'));
2018
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
39 end
9224
a84dbd2e08bc mod_lastactivity: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6302
diff changeset
40 return true;
2018
418c04834017 mod_lastactivity: Initial commit.
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
41 end);
2026
97b17187b29d mod_lastactivity: Persist data across reloads.
Waqas Hussain <waqas20@gmail.com>
parents: 2025
diff changeset
42
97b17187b29d mod_lastactivity: Persist data across reloads.
Waqas Hussain <waqas20@gmail.com>
parents: 2025
diff changeset
43 module.save = function()
97b17187b29d mod_lastactivity: Persist data across reloads.
Waqas Hussain <waqas20@gmail.com>
parents: 2025
diff changeset
44 return {map = map};
97b17187b29d mod_lastactivity: Persist data across reloads.
Waqas Hussain <waqas20@gmail.com>
parents: 2025
diff changeset
45 end
97b17187b29d mod_lastactivity: Persist data across reloads.
Waqas Hussain <waqas20@gmail.com>
parents: 2025
diff changeset
46 module.restore = function(data)
97b17187b29d mod_lastactivity: Persist data across reloads.
Waqas Hussain <waqas20@gmail.com>
parents: 2025
diff changeset
47 map = data.map or {};
97b17187b29d mod_lastactivity: Persist data across reloads.
Waqas Hussain <waqas20@gmail.com>
parents: 2025
diff changeset
48 end
97b17187b29d mod_lastactivity: Persist data across reloads.
Waqas Hussain <waqas20@gmail.com>
parents: 2025
diff changeset
49