prosody
0.11.12
spec/net_websocket_frames_spec.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

spec/net_websocket_frames_spec.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 11165:eae8046d51fc
child 11166:51e5149ed0ad
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
9660
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 describe("net.websocket.frames", function ()
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2 local nwf = require "net.websocket.frames";
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 local test_frames = {
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 simple_empty = {
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 ["opcode"] = 0;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7 ["length"] = 0;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 ["data"] = "";
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 ["FIN"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 ["MASK"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 ["RSV1"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 ["RSV2"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 ["RSV3"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 };
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 simple_data = {
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 ["opcode"] = 0;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 ["length"] = 5;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18 ["data"] = "hello";
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 ["FIN"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 ["MASK"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 ["RSV1"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 ["RSV2"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 ["RSV3"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 };
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 simple_fin = {
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26 ["opcode"] = 0;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27 ["length"] = 0;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 ["data"] = "";
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 ["FIN"] = true;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 ["MASK"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 ["RSV1"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32 ["RSV2"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 ["RSV3"] = false;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34 };
11162
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
35 with_mask = {
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
36 ["opcode"] = 0;
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
37 ["length"] = 5;
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
38 ["data"] = "hello";
11164
4e5a2af9dd19 net.websocket.frames: Use C string XOR implementation
Kim Alvefur <zash@zash.se>
parents: 11162
diff changeset
39 ["key"] = " \0 \0";
11162
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
40 ["FIN"] = true;
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
41 ["MASK"] = true;
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
42 ["RSV1"] = false;
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
43 ["RSV2"] = false;
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
44 ["RSV3"] = false;
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
45 };
11165
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
46 empty_with_mask = {
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
47 ["opcode"] = 0;
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
48 ["key"] = " \0 \0";
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
49 ["FIN"] = true;
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
50 ["MASK"] = true;
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
51 ["RSV1"] = false;
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
52 ["RSV2"] = false;
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
53 ["RSV3"] = false;
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
54 };
9660
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
55 }
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
56
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
57 describe("build", function ()
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
58 local build = nwf.build;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
59 it("works", function ()
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
60 assert.equal("\0\0", build(test_frames.simple_empty));
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
61 assert.equal("\0\5hello", build(test_frames.simple_data));
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
62 assert.equal("\128\0", build(test_frames.simple_fin));
11162
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
63 assert.equal("\128\133 \0 \0HeLlO", build(test_frames.with_mask))
11165
eae8046d51fc net.websocket.frames: Add test for empty frame with MASK and key set
Matthew Wild <mwild1@gmail.com>
parents: 11164
diff changeset
64 assert.equal("\128\128 \0 \0", build(test_frames.empty_with_mask))
9660
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
65 end);
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
66 end);
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
67
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
68 describe("parse", function ()
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
69 local parse = nwf.parse;
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
70 it("works", function ()
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
71 assert.same(test_frames.simple_empty, parse("\0\0"));
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
72 assert.same(test_frames.simple_data, parse("\0\5hello"));
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
73 assert.same(test_frames.simple_fin, parse("\128\0"));
11162
ee399a0522cc net.websocket.frames: Add small test covering xor-masking
Kim Alvefur <zash@zash.se>
parents: 9660
diff changeset
74 assert.same(test_frames.with_mask, parse("\128\133 \0 \0HeLlO"));
9660
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
75 end);
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
76 end);
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
77
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
78 end);
7e75c348095b net.websocket.frames: Add some brief tests
Kim Alvefur <zash@zash.se>
parents:
diff changeset
79