prosody
a37522bf6b1b
core/xmlhandlers.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

core/xmlhandlers.lua @ 4276:a37522bf6b1b

xmlhandlers: Reject XML comments, processing instructions and (if supported by LuaExpat) DTDs. If not supported, log a warning. [Backport of 7cc426988bcc in trunk]
author Matthew Wild <mwild1@gmail.com>
date Wed, 01 Jun 2011 23:20:54 +0100
parent 2923:b7049746bd29
child 4277:683523db4fe8
child 4280:65e2c089d138
comparison
equal deleted inserted replaced
3050:76f0d653b347 4276:a37522bf6b1b
16 local ipairs = ipairs; 16 local ipairs = ipairs;
17 local t_insert = table.insert; 17 local t_insert = table.insert;
18 local t_concat = table.concat; 18 local t_concat = table.concat;
19 19
20 local default_log = require "util.logger".init("xmlhandlers"); 20 local default_log = require "util.logger".init("xmlhandlers");
21
22 -- COMPAT: w/LuaExpat 1.1.0
23 local lxp_supports_doctype = pcall(lxp.new, { StartDoctypeDecl = false });
24
25 if not lxp_supports_doctype then
26 default_log("warn", "The version of LuaExpat on your system leaves Prosody "
27 .."vulnerable to denial-of-service attacks. You should upgrade to "
28 .."LuaExpat 1.1.1 or higher as soon as possible. See "
29 .."http://prosody.im/doc/depends#luaexpat for more information.");
30 end
21 31
22 local error = error; 32 local error = error;
23 33
24 module "xmlhandlers" 34 module "xmlhandlers"
25 35
132 stanza = nil; 142 stanza = nil;
133 else 143 else
134 stanza:up(); 144 stanza:up();
135 end 145 end
136 end 146 end
147
148 local function restricted_handler()
149 cb_error(session, "parse-error", "restricted-xml", "Restricted XML, see RFC 6120 section 11.1.");
150 end
151
152 if lxp_supports_doctype then
153 xml_handlers.StartDoctypeDecl = restricted_handler;
154 end
155 xml_handlers.Comment = restricted_handler;
156 xml_handlers.StartCdataSection = restricted_handler;
157 xml_handlers.ProcessingInstruction = restricted_handler;
158
137 return xml_handlers; 159 return xml_handlers;
138 end 160 end
139 161
140 return init_xmlhandlers; 162 return init_xmlhandlers;