prosody
53e0ae770917
tools/form2table.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

tools/form2table.lua @ 12180:53e0ae770917

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 11194:9d1ce6f28401
child 13142:879a6a33c21b
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
11194
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 -- Read an XML dataform and spit out a serialized Lua table of it
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 local function from_stanza(stanza)
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 local layout = {
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 title = stanza:get_child_text("title");
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 instructions = stanza:get_child_text("instructions");
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7 };
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 for tag in stanza:childtags("field") do
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 local field = {
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 name = tag.attr.var;
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 type = tag.attr.type;
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 label = tag.attr.label;
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 desc = tag:get_child_text("desc");
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 required = tag:get_child("required") and true or nil;
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 value = tag:get_child_text("value");
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 options = nil;
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 };
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 if field.type == "list-single" or field.type == "list-multi" then
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 local options = {};
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 for option in tag:childtags("option") do
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 options[#options+1] = { label = option.attr.label, value = option:get_child_text("value") };
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 end
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 field.options = options;
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 end
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27 if field.type == "jid-multi" or field.type == "list-multi" or field.type == "text-multi" then
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 local values = {};
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 for value in tag:childtags("value") do
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 values[#values+1] = value:get_text();
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 end
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32 if field.type == "text-multi" then
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 values = table.concat(values, "\n");
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34 end
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35 field.value = values;
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36 end
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38 if field.type == "boolean" then
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39 field.value = field.value == "true" or field.value == "1";
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
40 end
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
41
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
42 layout[#layout+1] = field;
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
43
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
44 end
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
45 return layout;
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
46 end
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
47
9d1ce6f28401 tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff changeset
48 print("dataforms.new " .. require "util.serialization".serialize(from_stanza(require "util.xml".parse(io.read("*a"))), { unquoted = true }))