prosody
53e0ae770917
util/import.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util/import.lua @ 12180:53e0ae770917

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 9692:affcbccc1dff
child 12589:39ae08180c81
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1523
841d61be198f Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
1 -- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
3 -- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 2923
diff changeset
4 --
758
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 615
diff changeset
5 -- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 615
diff changeset
6 -- COPYING file in the source package for more information.
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 49
diff changeset
7 --
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 49
diff changeset
8
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 49
diff changeset
9
49
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10
9692
affcbccc1dff lint: Remove use of the 143 error code
Kim Alvefur <zash@zash.se>
parents: 8570
diff changeset
11 local unpack = table.unpack or unpack; --luacheck: ignore 113
49
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 local t_insert = table.insert;
8570
a4ef8cfa97bd util.import: Explicitly export the global import function [luacheck]
Kim Alvefur <zash@zash.se>
parents: 8389
diff changeset
13 function _G.import(module, ...)
49
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 local m = package.loaded[module] or require(module);
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 if type(m) == "table" and ... then
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 local ret = {};
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 for _, f in ipairs{...} do
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 t_insert(ret, m[f]);
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 end
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 return unpack(ret);
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 end
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22 return m;
1cd2a8db392d New "import" module to help tidy up all the local declarations at the top of modules
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 end