prosody
0.11.12
util/rsm.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util/rsm.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 7852:e594010e1ba0
child 10761:b53193bb21cc
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
7852
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
1 -- Prosody IM
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
2 -- Copyright (C) 2008-2017 Matthew Wild
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
3 -- Copyright (C) 2008-2017 Waqas Hussain
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
4 -- Copyright (C) 2011-2017 Kim Alvefur
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
5 --
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
6 -- This project is MIT/X11 licensed. Please see the
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
7 -- COPYING file in the source package for more information.
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
8 --
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
9 -- XEP-0313: Message Archive Management for Prosody
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
10 --
e594010e1ba0 util.rsm: Add copyright header
Kim Alvefur <zash@zash.se>
parents: 7837
diff changeset
11
7836
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 local stanza = require"util.stanza".stanza;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 local tostring, tonumber = tostring, tonumber;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 local type = type;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 local pairs = pairs;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 local xmlns_rsm = 'http://jabber.org/protocol/rsm';
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 local element_parsers = {};
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 do
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 local parsers = element_parsers;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 local function xs_int(st)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 return tonumber((st:get_text()));
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26 local function xs_string(st)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27 return st:get_text();
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 parsers.after = xs_string;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 parsers.before = function(st)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32 local text = st:get_text();
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 return text == "" or text;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34 end;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35 parsers.max = xs_int;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36 parsers.index = xs_int;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38 parsers.first = function(st)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39 return { index = tonumber(st.attr.index); st:get_text() };
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
40 end;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
41 parsers.last = xs_string;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
42 parsers.count = xs_int;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
43 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
44
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
45 local element_generators = setmetatable({
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
46 first = function(st, data)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
47 if type(data) == "table" then
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
48 st:tag("first", { index = data.index }):text(data[1]):up();
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
49 else
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
50 st:tag("first"):text(tostring(data)):up();
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
51 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
52 end;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
53 before = function(st, data)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
54 if data == true then
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
55 st:tag("before"):up();
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
56 else
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
57 st:tag("before"):text(tostring(data)):up();
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
58 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
59 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
60 }, {
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
61 __index = function(_, name)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
62 return function(st, data)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
63 st:tag(name):text(tostring(data)):up();
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
64 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
65 end;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
66 });
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
67
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
68
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
69 local function parse(set)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
70 local rs = {};
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
71 for tag in set:childtags() do
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
72 local name = tag.name;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
73 local parser = name and element_parsers[name];
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
74 if parser then
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
75 rs[name] = parser(tag);
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
76 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
77 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
78 return rs;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
79 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
80
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
81 local function generate(t)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
82 local st = stanza("set", { xmlns = xmlns_rsm });
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
83 for k,v in pairs(t) do
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
84 if element_parsers[k] then
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
85 element_generators[k](st, v);
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
86 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
87 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
88 return st;
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
89 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
90
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
91 local function get(st)
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
92 local set = st:get_child("set", xmlns_rsm);
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
93 if set and #set.tags > 0 then
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
94 return parse(set);
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
95 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
96 end
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
97
30fac9154fd4 mod_mam: Import from prosody-modules
Kim Alvefur <zash@zash.se>
parents:
diff changeset
98 return { parse = parse, generate = generate, get = get };