prosody
783056b4e448
util/gc.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util/gc.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 11072:02227c5d0c59
child 11431:4874b54af344
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
11071
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 local set = require "util.set";
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 local known_options = {
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 incremental = set.new { "mode", "threshold", "speed", "step_size" };
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 generational = set.new { "mode", "minor_threshold", "major_threshold" };
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 };
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8 if _VERSION ~= "5.4" then
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 known_options.generational = nil;
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 known_options.incremental:remove("step_size");
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 end
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13 local function configure(user, defaults)
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 local mode = user.mode or defaults.mode or "incremental";
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 if not known_options[mode] then
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 return nil, "GC mode not supported on ".._VERSION..": "..mode;
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 end
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 for k, v in pairs(user) do
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 if not known_options[mode]:contains(k) then
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 return nil, "Unknown GC parameter: "..k;
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22 elseif k ~= "mode" and type(v) ~= "number" then
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 return nil, "parameter '"..k.."' should be a number";
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 end
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 end
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 if mode == "incremental" then
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28 if _VERSION == "Lua 5.4" then
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 collectgarbage(mode,
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
30 user.threshold or defaults.threshold,
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
31 user.speed or defaults.speed,
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
32 user.step_size or defaults.step_size
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
33 );
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
34 else
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
35 collectgarbage("setpause", user.threshold or defaults.threshold);
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
36 collectgarbage("setstepmul", user.speed or defaults.speed);
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
37 end
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
38 elseif mode == "generational" then
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
39 collectgarbage(mode,
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
40 user.minor_threshold or defaults.minor_threshold,
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
41 user.major_threshold or defaults.major_threshold
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
42 );
11072
02227c5d0c59 util.gc: Linter fixes [luacheck]
Matthew Wild <mwild1@gmail.com>
parents: 11071
diff changeset
43 end
11071
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
44 return true;
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
45 end
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
46
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
47 return {
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
48 configure = configure;
f69a63b80f3a util.gc: New module for configuring the Lua garbage collector
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
49 };