prosody
0.11.12
plugins/muc/password.lib.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

plugins/muc/password.lib.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 9455:c62c983b8be3
child 10447:b5fd1637f15c
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6208
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
1 -- Prosody IM
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
2 -- Copyright (C) 2008-2010 Matthew Wild
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
3 -- Copyright (C) 2008-2010 Waqas Hussain
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
4 -- Copyright (C) 2014 Daurnimator
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
5 --
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
6 -- This project is MIT/X11 licensed. Please see the
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
7 -- COPYING file in the source package for more information.
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
8 --
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
9
6329
6b3eb1611587 mod_muc: Import util.stanza into the config handler modules that need it. Fixes #432.
Matthew Wild <mwild1@gmail.com>
parents: 6208
diff changeset
10 local st = require "util.stanza";
6b3eb1611587 mod_muc: Import util.stanza into the config handler modules that need it. Fixes #432.
Matthew Wild <mwild1@gmail.com>
parents: 6208
diff changeset
11
6208
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
12 local function get_password(room)
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
13 return room._data.password;
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
14 end
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
15
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
16 local function set_password(room, password)
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
17 if password == "" then password = nil; end
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
18 if room._data.password == password then return false; end
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
19 room._data.password = password;
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
20 return true;
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
21 end
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
22
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
23 module:hook("muc-disco#info", function(event)
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
24 event.reply:tag("feature", {var = get_password(event.room) and "muc_passwordprotected" or "muc_unsecured"}):up();
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
25 end);
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
26
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
27 module:hook("muc-config-form", function(event)
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
28 table.insert(event.form, {
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
29 name = "muc#roomconfig_roomsecret";
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
30 type = "text-private";
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
31 label = "Password";
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
32 value = get_password(event.room) or "";
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
33 });
9035
173c0e16e704 MUC: Add sections in room config form
Matthew Wild <mwild1@gmail.com>
parents: 8997
diff changeset
34 end, 90-2);
6208
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
35
6991
84e01dbb739e MUC: Update all config form handlers to take advantage of the new per-option events
Matthew Wild <mwild1@gmail.com>
parents: 6329
diff changeset
36 module:hook("muc-config-submitted/muc#roomconfig_roomsecret", function(event)
84e01dbb739e MUC: Update all config form handlers to take advantage of the new per-option events
Matthew Wild <mwild1@gmail.com>
parents: 6329
diff changeset
37 if set_password(event.room, event.value) then
6208
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
38 event.status_codes["104"] = true;
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
39 end
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
40 end);
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
41
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
42 -- Don't allow anyone to join room unless they provide the password
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
43 module:hook("muc-occupant-pre-join", function(event)
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
44 local room, stanza = event.room, event.stanza;
9455
c62c983b8be3 MUC: Check that a room password is set before verifying password supplied by user
Michel Le Bihan <michel@lebihan.pl>
parents: 9035
diff changeset
45 if not get_password(room) then return end
8996
2df7dc99566a MUC/password: Rename variable for clarity [luacheck]
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
46 local muc_x = stanza:get_child("x", "http://jabber.org/protocol/muc");
2df7dc99566a MUC/password: Rename variable for clarity [luacheck]
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
47 if not muc_x then return end
2df7dc99566a MUC/password: Rename variable for clarity [luacheck]
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
48 local password = muc_x:get_child_text("password", "http://jabber.org/protocol/muc");
6208
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
49 if not password or password == "" then password = nil; end
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
50 if get_password(room) ~= password then
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
51 local from, to = stanza.attr.from, stanza.attr.to;
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
52 module:log("debug", "%s couldn't join due to invalid password: %s", from, to);
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
53 local reply = st.error_reply(stanza, "auth", "not-authorized"):up();
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
54 reply.tags[1].attr.code = "401";
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
55 event.origin.send(reply:tag("x", {xmlns = "http://jabber.org/protocol/muc"}));
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
56 return true;
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
57 end
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
58 end, -20);
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
59
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
60 -- Add password to outgoing invite
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
61 module:hook("muc-invite", function(event)
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
62 local password = get_password(event.room);
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
63 if password then
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
64 local x = event.stanza:get_child("x", "http://jabber.org/protocol/muc#user");
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
65 x:tag("password"):text(password):up();
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
66 end
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
67 end);
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
68
8997
8c4dd4375823 MUC/password: Set room password on creation if included in join stanza
Kim Alvefur <zash@zash.se>
parents: 8996
diff changeset
69 module:hook("muc-room-pre-create", function (event)
8c4dd4375823 MUC/password: Set room password on creation if included in join stanza
Kim Alvefur <zash@zash.se>
parents: 8996
diff changeset
70 local stanza, room = event.stanza, event.room;
8c4dd4375823 MUC/password: Set room password on creation if included in join stanza
Kim Alvefur <zash@zash.se>
parents: 8996
diff changeset
71 local muc_x = stanza:get_child("x", "http://jabber.org/protocol/muc");
8c4dd4375823 MUC/password: Set room password on creation if included in join stanza
Kim Alvefur <zash@zash.se>
parents: 8996
diff changeset
72 if not muc_x then return end
8c4dd4375823 MUC/password: Set room password on creation if included in join stanza
Kim Alvefur <zash@zash.se>
parents: 8996
diff changeset
73 local password = muc_x:get_child_text("password", "http://jabber.org/protocol/muc");
8c4dd4375823 MUC/password: Set room password on creation if included in join stanza
Kim Alvefur <zash@zash.se>
parents: 8996
diff changeset
74 set_password(room, password);
8c4dd4375823 MUC/password: Set room password on creation if included in join stanza
Kim Alvefur <zash@zash.se>
parents: 8996
diff changeset
75 end);
8c4dd4375823 MUC/password: Set room password on creation if included in join stanza
Kim Alvefur <zash@zash.se>
parents: 8996
diff changeset
76
6208
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
77 return {
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
78 get = get_password;
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
79 set = set_password;
d724289a5226 plugins/muc: Move password functions to seperate module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
80 };