Software / code / prosody
Annotate
plugins/mod_csi.lua @ 12180:53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Yes. This is as bad as it sounds. CVE pending.
In Prosody itself, this only affects mod_websocket, which uses util.xml
to parse the <open/> frame, thus allowing unauthenticated remote DoS
using Billion Laughs. However, third-party modules using util.xml may
also be affected by this.
This commit installs handlers which disallow the use of doctype
declarations and processing instructions without any escape hatch. It,
by default, also introduces such a handler for comments, however, there
is a way to enable comments nontheless.
This is because util.xml is used to parse human-facing data, where
comments are generally a desirable feature, and also because comments
are generally harmless.
| author | Jonas Schäfer <jonas@wielicki.name> |
|---|---|
| date | Mon, 10 Jan 2022 18:23:54 +0100 |
| parent | 10429:0b04d25c4ffb |
| child | 12977:74b9e05af71e |
| rev | line source |
|---|---|
|
9073
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
1 local st = require "util.stanza"; |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
2 local xmlns_csi = "urn:xmpp:csi:0"; |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
3 local csi_feature = st.stanza("csi", { xmlns = xmlns_csi }); |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
4 |
|
10429
0b04d25c4ffb
mod_csi: Cache CSI module availability to improve readabilty
Kim Alvefur <zash@zash.se>
parents:
10428
diff
changeset
|
5 local csi_handler_available = nil; |
|
9073
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
6 module:hook("stream-features", function (event) |
|
10429
0b04d25c4ffb
mod_csi: Cache CSI module availability to improve readabilty
Kim Alvefur <zash@zash.se>
parents:
10428
diff
changeset
|
7 if event.origin.username and csi_handler_available then |
|
9073
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
8 event.features:add_child(csi_feature); |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
9 end |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
10 end); |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
11 |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
12 function refire_event(name) |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
13 return function (event) |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
14 if event.origin.username then |
|
9653
91856829f18b
mod_csi: Fix copypaste mistake [luacheck]
Kim Alvefur <zash@zash.se>
parents:
9651
diff
changeset
|
15 event.origin.state = event.stanza.name; |
|
9073
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
16 module:fire_event(name, event); |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
17 return true; |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
18 end |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
19 end; |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
20 end |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
21 |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
22 module:hook("stanza/"..xmlns_csi..":active", refire_event("csi-client-active")); |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
23 module:hook("stanza/"..xmlns_csi..":inactive", refire_event("csi-client-inactive")); |
|
a5daf3f6d588
mod_csi: Imported from prosody-modules 66b3085ecc49
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
24 |
|
10428
12a10208d86a
mod_csi: Set module status based on whether a CSI handler module appears to be loaded
Kim Alvefur <zash@zash.se>
parents:
10427
diff
changeset
|
25 function module.load() |
|
12a10208d86a
mod_csi: Set module status based on whether a CSI handler module appears to be loaded
Kim Alvefur <zash@zash.se>
parents:
10427
diff
changeset
|
26 if prosody.hosts[module.host].events._handlers["csi-client-active"] then |
|
10429
0b04d25c4ffb
mod_csi: Cache CSI module availability to improve readabilty
Kim Alvefur <zash@zash.se>
parents:
10428
diff
changeset
|
27 csi_handler_available = true; |
|
10428
12a10208d86a
mod_csi: Set module status based on whether a CSI handler module appears to be loaded
Kim Alvefur <zash@zash.se>
parents:
10427
diff
changeset
|
28 module:set_status("core", "CSI handler module loaded"); |
|
12a10208d86a
mod_csi: Set module status based on whether a CSI handler module appears to be loaded
Kim Alvefur <zash@zash.se>
parents:
10427
diff
changeset
|
29 else |
|
10429
0b04d25c4ffb
mod_csi: Cache CSI module availability to improve readabilty
Kim Alvefur <zash@zash.se>
parents:
10428
diff
changeset
|
30 csi_handler_available = false; |
|
10428
12a10208d86a
mod_csi: Set module status based on whether a CSI handler module appears to be loaded
Kim Alvefur <zash@zash.se>
parents:
10427
diff
changeset
|
31 module:set_status("warn", "No CSI handler module loaded"); |
|
12a10208d86a
mod_csi: Set module status based on whether a CSI handler module appears to be loaded
Kim Alvefur <zash@zash.se>
parents:
10427
diff
changeset
|
32 end |
|
12a10208d86a
mod_csi: Set module status based on whether a CSI handler module appears to be loaded
Kim Alvefur <zash@zash.se>
parents:
10427
diff
changeset
|
33 end |
|
12a10208d86a
mod_csi: Set module status based on whether a CSI handler module appears to be loaded
Kim Alvefur <zash@zash.se>
parents:
10427
diff
changeset
|
34 module:hook("module-loaded", module.load); |
|
12a10208d86a
mod_csi: Set module status based on whether a CSI handler module appears to be loaded
Kim Alvefur <zash@zash.se>
parents:
10427
diff
changeset
|
35 module:hook("module-unloaded", module.load); |
