prosody
ebeb4d959fb3
util/xml.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

util/xml.lua @ 12202:ebeb4d959fb3 0.11 0.11.13

util.xml: Deduplicate handlers for restricted XML Makes the code more like util.xmppstream, allowing easier comparisons if we ever need to apply fixes in the future.
author Kim Alvefur <zash@zash.se>
date Thu, 20 Jan 2022 10:51:46 +0100
parent 12201:e5e0ab93d7f4
child 12203:320de3e4b579
comparison
equal deleted inserted replaced
12201:e5e0ab93d7f4 12202:ebeb4d959fb3
64 end 64 end
65 function handler:EndElement() 65 function handler:EndElement()
66 stanza:up(); 66 stanza:up();
67 end 67 end
68 -- SECURITY: These two handlers, especially the Doctype one, are required to prevent exploits such as Billion Laughs. 68 -- SECURITY: These two handlers, especially the Doctype one, are required to prevent exploits such as Billion Laughs.
69 function handler:StartDoctypeDecl() 69 local function restricted_handler(parser)
70 if not self.stop or not self:stop() then 70 if not parser.stop or not parser:stop() then
71 error("Failed to abort parsing"); 71 error("Failed to abort parsing");
72 end 72 end
73 end 73 end
74 function handler:ProcessingInstruction() 74 handler.StartDoctypeDecl = restricted_handler;
75 if not self.stop or not self:stop() then 75 handler.ProcessingInstruction = restricted_handler;
76 error("Failed to abort parsing");
77 end
78 end
79 if not options or not options.allow_comments then 76 if not options or not options.allow_comments then
80 -- NOTE: comments are generally harmless and can be useful when parsing configuration files or other data, even user-provided data 77 -- NOTE: comments are generally harmless and can be useful when parsing configuration files or other data, even user-provided data
81 function handler:Comment() 78 handler.Comment = restricted_handler;
82 if not self.stop or not self:stop() then
83 error("Failed to abort parsing");
84 end
85 end
86 end 79 end
87 local parser = lxp.new(handler, ns_separator); 80 local parser = lxp.new(handler, ns_separator);
88 local ok, err, line, col = parser:parse(xml); 81 local ok, err, line, col = parser:parse(xml);
89 if ok then ok, err, line, col = parser:parse(); end 82 if ok then ok, err, line, col = parser:parse(); end
90 --parser:close(); 83 --parser:close();