Software /
code /
prosody
Annotate
spec/util_xml_spec.lua @ 13587:fdb2e0568cf8
mod_authz_internal: Make 'prosody:guest' default role for all unknown JIDs
This fixes an issue where e.g. remote users or even other users on the server
were unable to list MUC rooms.
We want to define a permission to list MUC rooms, but we want it to be
available to everyone by default (the traditional behaviour).
prosody:guest is the lowest role we have. I ran a quick check and it isn't
really used for anything right now that would be concerning.
It was originally designed for anonymous logins. I think it's safe to treat
remote JIDs as equivalent, since we have no trust relationship with anonymous
users either.
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Tue, 07 Jan 2025 14:41:32 +0000 (6 months ago) |
parent | 12270:c78639ee6ccb |
rev | line source |
---|---|
8236
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
1 |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
2 local xml = require "util.xml"; |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
3 |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
4 describe("util.xml", function() |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
5 describe("#parse()", function() |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
6 it("should work", function() |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
7 local x = |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
8 [[<x xmlns:a="b"> |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
9 <y xmlns:a="c"> <!-- this overwrites 'a' --> |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
10 <a:z/> |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
11 </y> |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
12 <a:z/> <!-- prefix 'a' is nil here, but should be 'b' --> |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
13 </x> |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
14 ]] |
12180
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
15 local stanza = xml.parse(x, {allow_comments = true}); |
8236
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
16 assert.are.equal(stanza.tags[2].attr.xmlns, "b"); |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
17 assert.are.equal(stanza.tags[2].namespaces["a"], "b"); |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
18 end); |
12180
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
19 |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
20 it("should reject doctypes", function() |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
21 local x = "<!DOCTYPE foo []><foo/>"; |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
22 local ok = xml.parse(x); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
23 assert.falsy(ok); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
24 end); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
25 |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
26 it("should reject comments by default", function() |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
27 local x = "<foo><!-- foo --></foo>"; |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
28 local ok = xml.parse(x); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
29 assert.falsy(ok); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
30 end); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
31 |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
32 it("should allow comments if asked nicely", function() |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
33 local x = "<foo><!-- foo --></foo>"; |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
34 local stanza = xml.parse(x, {allow_comments = true}); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
35 assert.are.equal(stanza.name, "foo"); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
36 assert.are.equal(#stanza, 0); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
37 end); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
38 |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
39 it("should reject processing instructions", function() |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
40 local x = "<foo><?php die(); ?></foo>"; |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
41 local ok = xml.parse(x); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
42 assert.falsy(ok); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
43 end); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
44 |
12270
c78639ee6ccb
util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents:
12180
diff
changeset
|
45 it("should allow processing instructions if asked nicely", function() |
c78639ee6ccb
util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents:
12180
diff
changeset
|
46 local x = "<?xml-stylesheet href='make-fancy.xsl'?><foo/>"; |
c78639ee6ccb
util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents:
12180
diff
changeset
|
47 local stanza = xml.parse(x, {allow_processing_instructions = true}); |
c78639ee6ccb
util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents:
12180
diff
changeset
|
48 assert.truthy(stanza); |
c78639ee6ccb
util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents:
12180
diff
changeset
|
49 assert.are.equal(stanza.name, "foo"); |
c78639ee6ccb
util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents:
12180
diff
changeset
|
50 end); |
c78639ee6ccb
util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents:
12180
diff
changeset
|
51 |
12180
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
52 it("should allow an xml declaration", function() |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
53 local x = "<?xml version='1.0'?><foo/>"; |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
54 local stanza = xml.parse(x); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
55 assert.truthy(stanza); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
56 assert.are.equal(stanza.name, "foo"); |
53e0ae770917
util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents:
8236
diff
changeset
|
57 end); |
8236
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
58 end); |
4878e4159e12
Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff
changeset
|
59 end); |