prosody
0.11.12
util-src/Makefile.win

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

File

util-src/Makefile.win @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 2063:e89594a1bf4a
line wrap: on
line source


LUA_PATH=$(LUA_DEV)
IDN_PATH=..\..\libidn-1.15
OPENSSL_PATH=..\..\openssl-0.9.8k

LUA_INCLUDE=$(LUA_PATH)\include
LUA_LIB=$(LUA_PATH)\lib\lua5.1.lib

IDN_LIB=$(IDN_PATH)\win32\lib\libidn.lib
IDN_INCLUDE1=$(IDN_PATH)\lib
IDN_INCLUDE2=$(IDN_PATH)\win32\include
OPENSSL_LIB=$(OPENSSL_PATH)\out32dll\libeay32.lib
OPENSSL_INCLUDE=$(OPENSSL_PATH)\include

CL=cl /LD /MD /nologo

all: encodings.dll hashes.dll windows.dll

install: encodings.dll hashes.dll windows.dll
	copy /Y *.dll ..\util\

clean:
	del encodings.dll encodings.exp encodings.lib encodings.obj encodings.dll.manifest
	del hashes.dll hashes.exp hashes.lib hashes.obj hashes.dll.manifest
	del windows.dll windows.exp windows.lib windows.obj windows.dll.manifest

encodings.dll: encodings.c
	$(CL) encodings.c /I"$(LUA_INCLUDE)" /I"$(IDN_INCLUDE1)" /I"$(IDN_INCLUDE2)" /link "$(LUA_LIB)" "$(IDN_LIB)" /export:luaopen_util_encodings
	del encodings.exp encodings.lib encodings.obj encodings.dll.manifest

hashes.dll: hashes.c
	$(CL) hashes.c /I"$(LUA_INCLUDE)" /I"$(OPENSSL_INCLUDE)" /link "$(LUA_LIB)" "$(OPENSSL_LIB)" /export:luaopen_util_hashes
	del hashes.exp hashes.lib hashes.obj hashes.dll.manifest

windows.dll: windows.c
	$(CL) windows.c /I"$(LUA_INCLUDE)" /link "$(LUA_LIB)" dnsapi.lib /export:luaopen_util_windows
	del windows.exp windows.lib windows.obj windows.dll.manifest