prosody
0.11.12
plugins/muc/description.lib.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

plugins/muc/description.lib.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 9034:1c709e3d2e5e
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6204
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
1 -- Prosody IM
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
2 -- Copyright (C) 2008-2010 Matthew Wild
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
3 -- Copyright (C) 2008-2010 Waqas Hussain
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
4 -- Copyright (C) 2014 Daurnimator
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
5 --
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
6 -- This project is MIT/X11 licensed. Please see the
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
7 -- COPYING file in the source package for more information.
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
8 --
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
9
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
10 local function get_description(room)
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
11 return room._data.description;
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
12 end
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
13
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
14 local function set_description(room, description)
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
15 if description == "" then description = nil; end
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
16 if get_description(room) == description then return false; end
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
17 room._data.description = description;
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
18 return true;
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
19 end
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
20
8829
6dd7fea941f6 MUC: Use correct field name for description in disco#info (fixes #1148)
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
21 local function add_disco_form(event)
6dd7fea941f6 MUC: Use correct field name for description in disco#info (fixes #1148)
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
22 table.insert(event.form, {
6dd7fea941f6 MUC: Use correct field name for description in disco#info (fixes #1148)
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
23 name = "muc#roominfo_description";
6dd7fea941f6 MUC: Use correct field name for description in disco#info (fixes #1148)
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
24 label = "Description";
8830
5d7db3c7c026 MUC: Pass description via formdata field where it should be
Kim Alvefur <zash@zash.se>
parents: 8829
diff changeset
25 value = "";
8829
6dd7fea941f6 MUC: Use correct field name for description in disco#info (fixes #1148)
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
26 });
8830
5d7db3c7c026 MUC: Pass description via formdata field where it should be
Kim Alvefur <zash@zash.se>
parents: 8829
diff changeset
27 event.formdata["muc#roominfo_description"] = get_description(event.room);
8829
6dd7fea941f6 MUC: Use correct field name for description in disco#info (fixes #1148)
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
28 end
6dd7fea941f6 MUC: Use correct field name for description in disco#info (fixes #1148)
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
29
6204
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
30 local function add_form_option(event)
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
31 table.insert(event.form, {
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
32 name = "muc#roomconfig_roomdesc";
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
33 type = "text-single";
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
34 label = "Description";
9034
1c709e3d2e5e MUC: Improve labels of all config form items
Matthew Wild <mwild1@gmail.com>
parents: 8831
diff changeset
35 desc = "A brief description of the room";
7124
a0764a8d6b26 MUC: Roll back parts of 50b9a7e86de9 that were not in the disco#info event
Kim Alvefur <zash@zash.se>
parents: 7119
diff changeset
36 value = get_description(event.room) or "";
6204
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
37 });
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
38 end
8831
f25fa63750fb MUC: Some spacing to improve readability
Kim Alvefur <zash@zash.se>
parents: 8830
diff changeset
39
8829
6dd7fea941f6 MUC: Use correct field name for description in disco#info (fixes #1148)
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
40 module:hook("muc-disco#info", add_disco_form);
7401
e16b3fd0bd80 MUC: Assign priorities to config form hooks so they have a consistent order on each start
Kim Alvefur <zash@zash.se>
parents: 7353
diff changeset
41 module:hook("muc-config-form", add_form_option, 100-2);
6204
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
42
6991
84e01dbb739e MUC: Update all config form handlers to take advantage of the new per-option events
Matthew Wild <mwild1@gmail.com>
parents: 6204
diff changeset
43 module:hook("muc-config-submitted/muc#roomconfig_roomdesc", function(event)
84e01dbb739e MUC: Update all config form handlers to take advantage of the new per-option events
Matthew Wild <mwild1@gmail.com>
parents: 6204
diff changeset
44 if set_description(event.room, event.value) then
6204
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
45 event.status_codes["104"] = true;
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
46 end
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
47 end);
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
48
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
49 return {
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
50 get = get_description;
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
51 set = set_description;
c3254827698d plugins/muc/muc.lib: Move description functions out to own file
daurnimator <quae@daurnimator.com>
parents:
diff changeset
52 };