prosody
7cc426988bcc
util/xmppstream.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

util/xmppstream.lua @ 4274:7cc426988bcc

util.xmppstream: Reject XML comments, processing instructions and (if supported by LuaExpat) DTDs. If not supported, log a warning.
author Matthew Wild <mwild1@gmail.com>
date Wed, 01 Jun 2011 23:02:10 +0100
parent 3987:8fbf57722368
child 4279:9808e2b32aa5
comparison
equal deleted inserted replaced
4273:7f789266b741 4274:7cc426988bcc
16 local t_concat = table.concat; 16 local t_concat = table.concat;
17 local t_remove = table.remove; 17 local t_remove = table.remove;
18 local setmetatable = setmetatable; 18 local setmetatable = setmetatable;
19 19
20 local default_log = require "util.logger".init("xmppstream"); 20 local default_log = require "util.logger".init("xmppstream");
21
22 -- COMPAT: w/LuaExpat 1.1.0
23 local lxp_supports_doctype = pcall(lxp.new, { StartDoctypeDecl = false });
24
25 if not lxp_supports_doctype then
26 default_log("warn", "The version of LuaExpat on your system leaves Prosody "
27 .."vulnerable to denial-of-service attacks. You should upgrade to "
28 .."LuaExpat 1.1.1 or higher as soon as possible. See "
29 .."http://prosody.im/doc/depends#luaexpat for more information.");
30 end
21 31
22 local error = error; 32 local error = error;
23 33
24 module "xmppstream" 34 module "xmppstream"
25 35
155 end 165 end
156 stanza, chardata = nil, {}; 166 stanza, chardata = nil, {};
157 stack = {}; 167 stack = {};
158 end 168 end
159 end 169 end
170
171 local function restricted_handler()
172 cb_error(session, "parse-error", "restricted-xml", "Restricted XML, see RFC 6120 section 11.1.");
173 end
174
175 if lxp_supports_doctype then
176 xml_handlers.StartDoctypeDecl = restricted_handler;
177 end
178 xml_handlers.Comment = restricted_handler;
179 xml_handlers.StartCdataSection = restricted_handler;
180 xml_handlers.ProcessingInstruction = restricted_handler;
160 181
161 local function reset() 182 local function reset()
162 stanza, chardata = nil, {}; 183 stanza, chardata = nil, {};
163 stack = {}; 184 stack = {};
164 end 185 end