prosody
783056b4e448
plugins/muc/persistent.lib.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

plugins/muc/persistent.lib.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 9053:ea9e1f8f3013
child 12642:9061f9621330
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6222
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
1 -- Prosody IM
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
2 -- Copyright (C) 2008-2010 Matthew Wild
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
3 -- Copyright (C) 2008-2010 Waqas Hussain
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
4 -- Copyright (C) 2014 Daurnimator
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
5 --
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
6 -- This project is MIT/X11 licensed. Please see the
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
7 -- COPYING file in the source package for more information.
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
8 --
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
9
9053
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
10 local restrict_persistent = not module:get_option_boolean("muc_room_allow_persistent", true);
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
11 local um_is_admin = require "core.usermanager".is_admin;
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
12
6222
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
13 local function get_persistent(room)
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
14 return room._data.persistent;
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
15 end
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
16
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
17 local function set_persistent(room, persistent)
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
18 persistent = persistent and true or nil;
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
19 if get_persistent(room) == persistent then return false; end
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
20 room._data.persistent = persistent;
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
21 return true;
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
22 end
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
23
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
24 module:hook("muc-config-form", function(event)
9053
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
25 if restrict_persistent and not um_is_admin(event.actor, module.host) then
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
26 -- Don't show option if hidden rooms are restricted and user is not admin of this host
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
27 return;
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
28 end
6222
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
29 table.insert(event.form, {
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
30 name = "muc#roomconfig_persistentroom";
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
31 type = "boolean";
9034
1c709e3d2e5e MUC: Improve labels of all config form items
Matthew Wild <mwild1@gmail.com>
parents: 9014
diff changeset
32 label = "Persistent (room should remain even when it is empty)";
1c709e3d2e5e MUC: Improve labels of all config form items
Matthew Wild <mwild1@gmail.com>
parents: 9014
diff changeset
33 desc = "Rooms are automatically deleted when they are empty, unless this option is enabled";
6222
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
34 value = get_persistent(event.room);
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
35 });
9035
173c0e16e704 MUC: Add sections in room config form
Matthew Wild <mwild1@gmail.com>
parents: 9034
diff changeset
36 end, 100-5);
6222
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
37
6991
84e01dbb739e MUC: Update all config form handlers to take advantage of the new per-option events
Matthew Wild <mwild1@gmail.com>
parents: 6222
diff changeset
38 module:hook("muc-config-submitted/muc#roomconfig_persistentroom", function(event)
9053
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
39 if restrict_persistent and not um_is_admin(event.actor, module.host) then
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
40 return; -- Not allowed
ea9e1f8f3013 MUC: Allow restricting public/persistent room options to service admins (muc_room_allow_public/muc_room_allow_persistent)
Matthew Wild <mwild1@gmail.com>
parents: 9035
diff changeset
41 end
6991
84e01dbb739e MUC: Update all config form handlers to take advantage of the new per-option events
Matthew Wild <mwild1@gmail.com>
parents: 6222
diff changeset
42 if set_persistent(event.room, event.value) then
6222
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
43 event.status_codes["104"] = true;
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
44 end
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
45 end);
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
46
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
47 module:hook("muc-disco#info", function(event)
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
48 event.reply:tag("feature", {var = get_persistent(event.room) and "muc_persistent" or "muc_temporary"}):up();
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
49 end);
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
50
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
51 module:hook("muc-room-destroyed", function(event)
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
52 set_persistent(event.room, false);
9014
326fedc1d3c6 MUC: Unset persistence of destroyed rooms later in event chain
Kim Alvefur <zash@zash.se>
parents: 7401
diff changeset
53 end, -100);
6222
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
54
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
55 return {
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
56 get = get_persistent;
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
57 set = set_persistent;
355b29881117 plugins/muc: Move persistent room configuration to own module
daurnimator <quae@daurnimator.com>
parents:
diff changeset
58 };