prosody
53e0ae770917
util/bitcompat.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util/bitcompat.lua @ 12180:53e0ae770917

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 10241:48f7cda4174d
child 12573:0f4feaf9ca64
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
10241
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 -- Compatibility layer for bitwise operations
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 -- First try the bit32 lib
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 -- Lua 5.3 has it with compat enabled
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 -- Lua 5.2 has it by default
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 if _G.bit32 then
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7 return _G.bit32;
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 else
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 -- Lua 5.1 may have it as a standalone module that can be installed
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 local ok, bitop = pcall(require, "bit32")
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 if ok then
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 return bitop;
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 end
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 end
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 do
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 -- Lua 5.3 and 5.4 would be able to use native infix operators
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18 local ok, bitop = pcall(require, "util.bit53")
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 if ok then
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 return bitop;
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 end
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 end
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 do
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 -- Lastly, try the LuaJIT bitop library
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26 local ok, bitop = pcall(require, "bit")
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27 if ok then
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 return bitop;
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 end
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 end
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31
48f7cda4174d util.bitops: Library to find appropriate bitwise library (closes #1395)
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32 error "No bit module found. See https://prosody.im/doc/depends#bitop";