prosody
783056b4e448
spec/util_json_spec.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

spec/util_json_spec.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 9326:c9c4b8bc53b1
child 10591:d78c5c9b0cf6
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8236
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
1
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
2 local json = require "util.json";
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
3
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
4 describe("util.json", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
5 describe("#encode()", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
6 it("should work", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
7 local function test(f, j, e)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
8 if e then
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
9 assert.are.equal(f(j), e);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
10 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
11 assert.are.equal(f(j), f(json.decode(f(j))));
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
12 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
13 test(json.encode, json.null, "null")
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
14 test(json.encode, {}, "{}")
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
15 test(json.encode, {a=1});
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
16 test(json.encode, {a={1,2,3}});
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
17 test(json.encode, {1}, "[1]");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
18 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
19 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
20
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
21 describe("#decode()", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
22 it("should work", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
23 local empty_array = json.decode("[]");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
24 assert.are.equal(type(empty_array), "table");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
25 assert.are.equal(#empty_array, 0);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
26 assert.are.equal(next(empty_array), nil);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
27 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
28 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
29
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
30 describe("testcases", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
31
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
32 local valid_data = {};
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
33 local invalid_data = {};
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
34
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
35 local skip = "fail1.json fail9.json fail18.json fail15.json fail13.json fail25.json fail26.json fail27.json fail28.json fail17.json pass1.json";
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
36
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
37 setup(function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
38 local lfs = require "lfs";
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
39 local path = "spec/json";
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
40 for name in lfs.dir(path) do
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
41 if name:match("%.json$") then
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
42 local f = assert(io.open(path.."/"..name));
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
43 local content = assert(f:read("*a"));
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
44 assert(f:close());
9326
c9c4b8bc53b1 util.json tests: Add [luacheck] annotation to mark intentionally-empty if branch
Matthew Wild <mwild1@gmail.com>
parents: 8562
diff changeset
45 if skip:find(name) then --luacheck: ignore 542
8236
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
46 -- Skip
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
47 elseif name:match("^pass") then
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
48 valid_data[name] = content;
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
49 elseif name:match("^fail") then
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
50 invalid_data[name] = content;
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
51 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
52 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
53 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
54 end)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
55
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
56 it("should pass valid testcases", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
57 for name, content in pairs(valid_data) do
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
58 local parsed, err = json.decode(content);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
59 assert(parsed, name..": "..tostring(err));
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
60 end
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
61 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
62
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
63 it("should fail invalid testcases", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
64 for name, content in pairs(invalid_data) do
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
65 local parsed, err = json.decode(content);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
66 assert(not parsed, name..": "..tostring(err));
8562
a6188f5d5bb5 spec: Trim trailing whitespace
Kim Alvefur <zash@zash.se>
parents: 8236
diff changeset
67 end
8236
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
68 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
69 end)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
70 end);