prosody
0.11.12
util/hex.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util/hex.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 6802:442019e955dc
child 12355:a0ff5c438e9d
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6375
76d8907d5301 util.hex: Small util lib for converting to/from hex strings
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 local s_char = string.char;
6545
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
2 local s_format = string.format;
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
3 local s_gsub = string.gsub;
6802
442019e955dc util.hex: Normalize hex to lowercase and discard non-hex input
Kim Alvefur <zash@zash.se>
parents: 6545
diff changeset
4 local s_lower = string.lower;
6545
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
5
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
6 local char_to_hex = {};
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
7 local hex_to_char = {};
6375
76d8907d5301 util.hex: Small util lib for converting to/from hex strings
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8
6545
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
9 do
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
10 local char, hex;
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
11 for i = 0,255 do
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
12 char, hex = s_char(i), s_format("%02x", i);
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
13 char_to_hex[char] = hex;
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
14 hex_to_char[hex] = char;
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
15 end
6375
76d8907d5301 util.hex: Small util lib for converting to/from hex strings
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 end
76d8907d5301 util.hex: Small util lib for converting to/from hex strings
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17
6384
3f4809d01783 util.hex: Use locals!
Kim Alvefur <zash@zash.se>
parents: 6375
diff changeset
18 local function to(s)
6545
ec566d7cd518 util.hex: Pedantic optimization, 1 table lookup per byte instead of 3 function calls makes it go faster
Kim Alvefur <zash@zash.se>
parents: 6384
diff changeset
19 return (s_gsub(s, ".", char_to_hex));
6375
76d8907d5301 util.hex: Small util lib for converting to/from hex strings
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 end
76d8907d5301 util.hex: Small util lib for converting to/from hex strings
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21
6384
3f4809d01783 util.hex: Use locals!
Kim Alvefur <zash@zash.se>
parents: 6375
diff changeset
22 local function from(s)
6802
442019e955dc util.hex: Normalize hex to lowercase and discard non-hex input
Kim Alvefur <zash@zash.se>
parents: 6545
diff changeset
23 return (s_gsub(s_lower(s), "%X*(%x%x)%X*", hex_to_char));
6375
76d8907d5301 util.hex: Small util lib for converting to/from hex strings
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 end
76d8907d5301 util.hex: Small util lib for converting to/from hex strings
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25
76d8907d5301 util.hex: Small util lib for converting to/from hex strings
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26 return { to = to, from = from }