prosody
53e0ae770917
util-src/time.c

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util-src/time.c @ 12180:53e0ae770917

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 10480:94cacf9fd0ae
child 12976:a187600ec7d6
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
9164
35807f02bdc7 util.time: Allow for already set constant
Kim Alvefur <zash@zash.se>
parents: 9163
diff changeset
1 #ifndef _POSIX_C_SOURCE
9680
a374905e99ff util.time: Bump POSIX_C_SOURCE to ensure visibility of CLOCK_MONOTONIC on FreeBSD (fixes #1253)
Matthew Wild <mwild1@gmail.com>
parents: 9164
diff changeset
2 #define _POSIX_C_SOURCE 200809L
9164
35807f02bdc7 util.time: Allow for already set constant
Kim Alvefur <zash@zash.se>
parents: 9163
diff changeset
3 #endif
9162
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 #include <time.h>
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 #include <lua.h>
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7
10480
94cacf9fd0ae util.*.c: Add static qualifiers everywhere
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 9680
diff changeset
8 static lua_Number tv2number(struct timespec *tv) {
9162
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 return tv->tv_sec + tv->tv_nsec * 1e-9;
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 }
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11
10480
94cacf9fd0ae util.*.c: Add static qualifiers everywhere
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 9680
diff changeset
12 static int lc_time_realtime(lua_State *L) {
9162
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 struct timespec t;
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 clock_gettime(CLOCK_REALTIME, &t);
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 lua_pushnumber(L, tv2number(&t));
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 return 1;
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 }
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18
10480
94cacf9fd0ae util.*.c: Add static qualifiers everywhere
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 9680
diff changeset
19 static int lc_time_monotonic(lua_State *L) {
9163
6b1f46730217 util.time: Add monotonic time
Kim Alvefur <zash@zash.se>
parents: 9162
diff changeset
20 struct timespec t;
6b1f46730217 util.time: Add monotonic time
Kim Alvefur <zash@zash.se>
parents: 9162
diff changeset
21 clock_gettime(CLOCK_MONOTONIC, &t);
6b1f46730217 util.time: Add monotonic time
Kim Alvefur <zash@zash.se>
parents: 9162
diff changeset
22 lua_pushnumber(L, tv2number(&t));
6b1f46730217 util.time: Add monotonic time
Kim Alvefur <zash@zash.se>
parents: 9162
diff changeset
23 return 1;
6b1f46730217 util.time: Add monotonic time
Kim Alvefur <zash@zash.se>
parents: 9162
diff changeset
24 }
6b1f46730217 util.time: Add monotonic time
Kim Alvefur <zash@zash.se>
parents: 9162
diff changeset
25
9162
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26 int luaopen_util_time(lua_State *L) {
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27 lua_createtable(L, 0, 2);
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 {
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 lua_pushcfunction(L, lc_time_realtime);
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 lua_setfield(L, -2, "now");
9163
6b1f46730217 util.time: Add monotonic time
Kim Alvefur <zash@zash.se>
parents: 9162
diff changeset
31 lua_pushcfunction(L, lc_time_monotonic);
6b1f46730217 util.time: Add monotonic time
Kim Alvefur <zash@zash.se>
parents: 9162
diff changeset
32 lua_setfield(L, -2, "monotonic");
9162
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 }
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34 return 1;
8ad1fe9d26d4 util.time: Convert to C
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35 }