prosody
53e0ae770917
tools/http-status-codes.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

tools/http-status-codes.lua @ 12180:53e0ae770917

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 9166:cce55767004a
child 12271:f31bb79f51d7
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
9166
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 -- Generate net/http/codes.lua from IANA HTTP status code registry
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 local xml = require "util.xml";
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 local registry = xml.parse(io.read("*a"));
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 io.write([[
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 local response_codes = {
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 -- Source: http://www.iana.org/assignments/http-status-codes
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 ]]);
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 for record in registry:get_child("registry"):childtags("record") do
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 -- Extract values
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 local value = record:get_child_text("value");
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 local description = record:get_child_text("description");
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 local ref = record:get_child_text("xref");
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 local code = tonumber(value);
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 -- Space between major groups
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 if code and code % 100 == 0 then
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 io.write("\n");
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 end
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 -- Reserved and Unassigned entries should be not be included
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 if description == "Reserved" or description == "Unassigned" or description == "(Unused)" then
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26 code = nil;
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27 end
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 -- Non-empty references become comments
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 if ref and ref:find("%S") then
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 ref = " -- " .. ref;
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32 else
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 ref = "";
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34 end
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36 io.write((code and "\t[%d] = %q;%s\n" or "\t-- [%s] = %q;%s\n"):format(code or value, description, ref));
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37 end
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39 io.write([[};
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
40
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
41 for k,v in pairs(response_codes) do response_codes[k] = k.." "..v; end
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
42 return setmetatable(response_codes, { __index = function(_, k) return k.." Unassigned"; end })
cce55767004a tools: Add a tool to generate net.http.codes from IANA registry
Kim Alvefur <zash@zash.se>
parents:
diff changeset
43 ]]);