prosody
0.11.12
spec/muc_util_spec.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

spec/muc_util_spec.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 9213:172f93f752b8
child 10715:ad86b93093a3
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
9213
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 local muc_util;
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 local st = require "util.stanza";
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 do
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 local old_pp = package.path;
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 package.path = "./?.lib.lua;"..package.path;
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8 muc_util = require "plugins.muc.util";
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 package.path = old_pp;
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 end
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 describe("muc/util", function ()
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13 describe("filter_muc_x()", function ()
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 it("correctly filters muc#user", function ()
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 local stanza = st.message({ to = "to", from = "from", id = "foo" })
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 :tag("x", { xmlns = "http://jabber.org/protocol/muc#user" })
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 :tag("invite", { to = "user@example.com" });
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 assert.equal(1, #stanza.tags);
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 assert.equal(stanza, muc_util.filter_muc_x(stanza));
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 assert.equal(0, #stanza.tags);
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22 end);
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 it("correctly filters muc#user on a cloned stanza", function ()
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 local stanza = st.message({ to = "to", from = "from", id = "foo" })
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26 :tag("x", { xmlns = "http://jabber.org/protocol/muc#user" })
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 :tag("invite", { to = "user@example.com" });
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 assert.equal(1, #stanza.tags);
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
30 local filtered = muc_util.filter_muc_x(st.clone(stanza));
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
31 assert.equal(1, #stanza.tags);
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
32 assert.equal(0, #filtered.tags);
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
33 end);
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
34 end);
172f93f752b8 tests: Add muc/util tests for filtering MUC elements
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
35 end);