prosody
0.11.12
spec/util_ip_spec.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

spec/util_ip_spec.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 8236:4878e4159e12
child 12934:c6dffebab2f8
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8236
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
1
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
2 local ip = require "util.ip";
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
3
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
4 local new_ip = ip.new_ip;
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
5 local match = ip.match;
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
6 local parse_cidr = ip.parse_cidr;
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
7 local commonPrefixLength = ip.commonPrefixLength;
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
8
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
9 describe("util.ip", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
10 describe("#match()", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
11 it("should work", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
12 local _ = new_ip;
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
13 local ip = _"10.20.30.40";
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
14 assert.are.equal(match(ip, _"10.0.0.0", 8), true);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
15 assert.are.equal(match(ip, _"10.0.0.0", 16), false);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
16 assert.are.equal(match(ip, _"10.0.0.0", 24), false);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
17 assert.are.equal(match(ip, _"10.0.0.0", 32), false);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
18
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
19 assert.are.equal(match(ip, _"10.20.0.0", 8), true);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
20 assert.are.equal(match(ip, _"10.20.0.0", 16), true);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
21 assert.are.equal(match(ip, _"10.20.0.0", 24), false);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
22 assert.are.equal(match(ip, _"10.20.0.0", 32), false);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
23
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
24 assert.are.equal(match(ip, _"0.0.0.0", 32), false);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
25 assert.are.equal(match(ip, _"0.0.0.0", 0), true);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
26 assert.are.equal(match(ip, _"0.0.0.0"), false);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
27
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
28 assert.are.equal(match(ip, _"10.0.0.0", 255), false, "excessive number of bits");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
29 assert.are.equal(match(ip, _"10.0.0.0", -8), true, "negative number of bits");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
30 assert.are.equal(match(ip, _"10.0.0.0", -32), true, "negative number of bits");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
31 assert.are.equal(match(ip, _"10.0.0.0", 0), true, "zero bits");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
32 assert.are.equal(match(ip, _"10.0.0.0"), false, "no specified number of bits (differing ip)");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
33 assert.are.equal(match(ip, _"10.20.30.40"), true, "no specified number of bits (same ip)");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
34
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
35 assert.are.equal(match(_"127.0.0.1", _"127.0.0.1"), true, "simple ip");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
36
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
37 assert.are.equal(match(_"8.8.8.8", _"8.8.0.0", 16), true);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
38 assert.are.equal(match(_"8.8.4.4", _"8.8.0.0", 16), true);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
39 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
40 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
41
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
42 describe("#parse_cidr()", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
43 it("should work", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
44 assert.are.equal(new_ip"0.0.0.0", new_ip"0.0.0.0")
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
45
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
46 local function assert_cidr(cidr, ip, bits)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
47 local parsed_ip, parsed_bits = parse_cidr(cidr);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
48 assert.are.equal(new_ip(ip), parsed_ip, cidr.." parsed ip is "..ip);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
49 assert.are.equal(bits, parsed_bits, cidr.." parsed bits is "..tostring(bits));
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
50 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
51 assert_cidr("0.0.0.0", "0.0.0.0", nil);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
52 assert_cidr("127.0.0.1", "127.0.0.1", nil);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
53 assert_cidr("127.0.0.1/0", "127.0.0.1", 0);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
54 assert_cidr("127.0.0.1/8", "127.0.0.1", 8);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
55 assert_cidr("127.0.0.1/32", "127.0.0.1", 32);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
56 assert_cidr("127.0.0.1/256", "127.0.0.1", 256);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
57 assert_cidr("::/48", "::", 48);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
58 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
59 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
60
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
61 describe("#new_ip()", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
62 it("should work", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
63 local v4, v6 = "IPv4", "IPv6";
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
64 local function assert_proto(s, proto)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
65 local ip = new_ip(s);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
66 if proto then
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
67 assert.are.equal(ip and ip.proto, proto, "protocol is correct for "..("%q"):format(s));
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
68 else
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
69 assert.are.equal(ip, nil, "address is invalid");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
70 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
71 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
72 assert_proto("127.0.0.1", v4);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
73 assert_proto("::1", v6);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
74 assert_proto("", nil);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
75 assert_proto("abc", nil);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
76 assert_proto(" ", nil);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
77 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
78 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
79
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
80 describe("#commonPrefixLength()", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
81 it("should work", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
82 local function assert_cpl6(a, b, len, v4)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
83 local ipa, ipb = new_ip(a), new_ip(b);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
84 if v4 then len = len+96; end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
85 assert.are.equal(commonPrefixLength(ipa, ipb), len, "common prefix length of "..a.." and "..b.." is "..len);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
86 assert.are.equal(commonPrefixLength(ipb, ipa), len, "common prefix length of "..b.." and "..a.." is "..len);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
87 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
88 local function assert_cpl4(a, b, len)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
89 return assert_cpl6(a, b, len, "IPv4");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
90 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
91 assert_cpl4("0.0.0.0", "0.0.0.0", 32);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
92 assert_cpl4("255.255.255.255", "0.0.0.0", 0);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
93 assert_cpl4("255.255.255.255", "255.255.0.0", 16);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
94 assert_cpl4("255.255.255.255", "255.255.255.255", 32);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
95 assert_cpl4("255.255.255.255", "255.255.255.255", 32);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
96
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
97 assert_cpl6("::1", "::1", 128);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
98 assert_cpl6("abcd::1", "abcd::1", 128);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
99 assert_cpl6("abcd::abcd", "abcd::", 112);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
100 assert_cpl6("abcd::abcd", "abcd::abcd:abcd", 96);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
101 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
102 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
103 end);