Software /
code /
prosody
File
net/server.lua @ 12181:783056b4e448 0.11 0.11.12
util.xml: Do not allow doctypes, comments or processing instructions
Yes. This is as bad as it sounds. CVE pending.
In Prosody itself, this only affects mod_websocket, which uses util.xml
to parse the <open/> frame, thus allowing unauthenticated remote DoS
using Billion Laughs. However, third-party modules using util.xml may
also be affected by this.
This commit installs handlers which disallow the use of doctype
declarations and processing instructions without any escape hatch. It,
by default, also introduces such a handler for comments, however, there
is a way to enable comments nontheless.
This is because util.xml is used to parse human-facing data, where
comments are generally a desirable feature, and also because comments
are generally harmless.
author | Jonas Schäfer <jonas@wielicki.name> |
---|---|
date | Mon, 10 Jan 2022 18:23:54 +0100 |
parent | 9215:b087b5047f86 |
child | 10853:0107ed6744aa |
line wrap: on
line source
-- Prosody IM -- Copyright (C) 2008-2010 Matthew Wild -- Copyright (C) 2008-2010 Waqas Hussain -- -- This project is MIT/X11 licensed. Please see the -- COPYING file in the source package for more information. -- if not (prosody and prosody.config_loaded) then -- This module only supports loading inside Prosody, outside Prosody -- you should directly require net.server_select or server_event, etc. error(debug.traceback("Loading outside Prosody or Prosody not yet initialized"), 0); end local log = require "util.logger".init("net.server"); local server_type = require "core.configmanager".get("*", "network_backend") or "select"; if require "core.configmanager".get("*", "use_libevent") then server_type = "event"; end if server_type == "event" then if not pcall(require, "luaevent.core") then log("error", "libevent not found, falling back to select()"); server_type = "select" end end local server; local set_config; if server_type == "event" then server = require "net.server_event"; local defaults = {}; for k,v in pairs(server.cfg) do defaults[k] = v; end function set_config(settings) local event_settings = { ACCEPT_DELAY = settings.accept_retry_interval; ACCEPT_QUEUE = settings.tcp_backlog; CLEAR_DELAY = settings.event_clear_interval; CONNECT_TIMEOUT = settings.connect_timeout; DEBUG = settings.debug; HANDSHAKE_TIMEOUT = settings.ssl_handshake_timeout; MAX_CONNECTIONS = settings.max_connections; MAX_HANDSHAKE_ATTEMPTS = settings.max_ssl_handshake_roundtrips; MAX_READ_LENGTH = settings.max_receive_buffer_size; MAX_SEND_LENGTH = settings.max_send_buffer_size; READ_TIMEOUT = settings.read_timeout; WRITE_TIMEOUT = settings.send_timeout; }; for k,default in pairs(defaults) do server.cfg[k] = event_settings[k] or default; end end elseif server_type == "select" then server = require "net.server_select"; local defaults = {}; for k,v in pairs(server.getsettings()) do defaults[k] = v; end function set_config(settings) local select_settings = {}; for k,default in pairs(defaults) do select_settings[k] = settings[k] or default; end server.changesettings(select_settings); end else server = require("net.server_"..server_type); set_config = server.set_config; if not server.get_backend then function server.get_backend() return server_type; end end end -- If server.hook_signal exists, replace signal.signal() local has_signal, signal = pcall(require, "util.signal"); if has_signal then if server.hook_signal then function signal.signal(signal_id, handler) if type(signal_id) == "string" then signal_id = signal[signal_id:upper()]; end if type(signal_id) ~= "number" then return false, "invalid-signal"; end return server.hook_signal(signal_id, handler); end else server.hook_signal = signal.signal; end else if not server.hook_signal then server.hook_signal = function() return false, "signal hooking not supported" end end end if prosody and set_config then local config_get = require "core.configmanager".get; local function load_config() local settings = config_get("*", "network_settings") or {}; return set_config(settings); end load_config(); prosody.events.add_handler("config-reloaded", load_config); end -- require "net.server" shall now forever return this, -- ie. server_select or server_event as chosen above. return server;