prosody
53e0ae770917
spec/util_human_io_spec.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

spec/util_human_io_spec.lua @ 12180:53e0ae770917

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 11896:93e9f7ae2f9b
child 13054:f4d7fe919969
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
10978
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 describe("util.human.io", function ()
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2 local human_io
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 setup(function ()
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 human_io = require "util.human.io";
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 end);
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 describe("table", function ()
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 it("alignment works", function ()
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 local row = human_io.table({
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 {
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 width = 3,
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 align = "right"
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 },
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 {
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 width = 3,
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 },
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 });
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 assert.equal(" 1 | . ", row({ 1, "." }));
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 assert.equal(" 10 | .. ", row({ 10, ".." }));
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 assert.equal("100 | ...", row({ 100, "..." }));
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 assert.equal("10… | ..…", row({ 1000, "...." }));
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 end);
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 end);
11896
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
26
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
27 describe("ellipsis", function()
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
28 it("works", function()
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
29 assert.equal("…", human_io.ellipsis("abc", 1));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
30 assert.equal("a…", human_io.ellipsis("abc", 2));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
31 assert.equal("abc", human_io.ellipsis("abc", 3));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
32
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
33 assert.equal("…", human_io.ellipsis("räksmörgås", 1));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
34 assert.equal("r…", human_io.ellipsis("räksmörgås", 2));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
35 assert.equal("rä…", human_io.ellipsis("räksmörgås", 3));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
36 assert.equal("räk…", human_io.ellipsis("räksmörgås", 4));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
37 assert.equal("räks…", human_io.ellipsis("räksmörgås", 5));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
38 assert.equal("räksm…", human_io.ellipsis("räksmörgås", 6));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
39 assert.equal("räksmö…", human_io.ellipsis("räksmörgås", 7));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
40 assert.equal("räksmör…", human_io.ellipsis("räksmörgås", 8));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
41 assert.equal("räksmörg…", human_io.ellipsis("räksmörgås", 9));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
42 assert.equal("räksmörgås", human_io.ellipsis("räksmörgås", 10));
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
43 end);
93e9f7ae2f9b util.human.io: Fix cutting of UTF-8 into pieces
Kim Alvefur <zash@zash.se>
parents: 10978
diff changeset
44 end);
10978
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
45 end);
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
46
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
47
4d3247a1f6b3 util.human.io: Add brief test of table generation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
48