prosody
53e0ae770917
GNUmakefile

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

File

GNUmakefile @ 12180:53e0ae770917

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 12131:b4c0efff8dd3
child 12313:469e4453ed01
child 12354:3ce3633527af
line wrap: on
line source


include config.unix

BIN = $(DESTDIR)$(PREFIX)/bin
CONFIG = $(DESTDIR)$(SYSCONFDIR)
MODULES = $(DESTDIR)$(LIBDIR)/prosody/modules
SOURCE = $(DESTDIR)$(LIBDIR)/prosody
DATA = $(DESTDIR)$(DATADIR)
MAN = $(DESTDIR)$(PREFIX)/share/man

INSTALLEDSOURCE = $(LIBDIR)/prosody
INSTALLEDCONFIG = $(SYSCONFDIR)
INSTALLEDMODULES = $(LIBDIR)/prosody/modules
INSTALLEDDATA = $(DATADIR)

INSTALL=install -p
INSTALL_DATA=$(INSTALL) -m644
INSTALL_EXEC=$(INSTALL) -m755
MKDIR=install -d
MKDIR_PRIVATE=$(MKDIR) -m750

LUACHECK=luacheck
BUSTED=busted
SCANSION=scansion

.PHONY: all test coverage clean install

all: prosody.install prosodyctl.install prosody.cfg.lua.install prosody.version
	$(MAKE) -C util-src install
ifeq ($(EXCERTS),yes)
	-$(MAKE) -C certs localhost.crt example.com.crt
endif

install: prosody.install prosodyctl.install prosody.cfg.lua.install util/encodings.so util/encodings.so util/pposix.so util/signal.so
	$(MKDIR) $(BIN) $(CONFIG) $(MODULES) $(SOURCE)
	$(MKDIR_PRIVATE) $(DATA)
	$(MKDIR) $(MAN)/man1
	$(MKDIR) $(CONFIG)/certs
	$(MKDIR) $(SOURCE)/core $(SOURCE)/net $(SOURCE)/util
	$(INSTALL_EXEC) ./prosody.install $(BIN)/prosody
	$(INSTALL_EXEC) ./prosodyctl.install $(BIN)/prosodyctl
	$(INSTALL_DATA) core/*.lua $(SOURCE)/core
	$(INSTALL_DATA) net/*.lua $(SOURCE)/net
	$(MKDIR) $(SOURCE)/net/http $(SOURCE)/net/resolvers $(SOURCE)/net/websocket
	$(INSTALL_DATA) net/http/*.lua $(SOURCE)/net/http
	$(INSTALL_DATA) net/resolvers/*.lua $(SOURCE)/net/resolvers
	$(INSTALL_DATA) net/websocket/*.lua $(SOURCE)/net/websocket
	$(INSTALL_DATA) util/*.lua $(SOURCE)/util
	$(INSTALL_DATA) util/*.so $(SOURCE)/util
	$(MKDIR) $(SOURCE)/util/sasl
	$(INSTALL_DATA) util/sasl/*.lua $(SOURCE)/util/sasl
	$(MKDIR) $(SOURCE)/util/human
	$(INSTALL_DATA) util/human/*.lua $(SOURCE)/util/human
	$(MKDIR) $(SOURCE)/util/prosodyctl
	$(INSTALL_DATA) util/prosodyctl/*.lua $(SOURCE)/util/prosodyctl
	$(MKDIR) $(MODULES)/mod_pubsub $(MODULES)/adhoc $(MODULES)/muc $(MODULES)/mod_mam
	$(INSTALL_DATA) plugins/*.lua $(MODULES)
	$(INSTALL_DATA) plugins/mod_pubsub/*.lua $(MODULES)/mod_pubsub
	$(INSTALL_DATA) plugins/adhoc/*.lua $(MODULES)/adhoc
	$(INSTALL_DATA) plugins/muc/*.lua $(MODULES)/muc
	$(INSTALL_DATA) plugins/mod_mam/*.lua $(MODULES)/mod_mam
	$(INSTALL_DATA) certs/* $(CONFIG)/certs
	$(INSTALL_DATA) man/prosodyctl.man $(MAN)/man1/prosodyctl.1
	test -f $(CONFIG)/prosody.cfg.lua || $(INSTALL_DATA) prosody.cfg.lua.install $(CONFIG)/prosody.cfg.lua
	-test -f prosody.version && $(INSTALL_DATA) prosody.version $(SOURCE)/prosody.version
	$(MAKE) install -C util-src

clean:
	rm -f prosody.install
	rm -f prosodyctl.install
	rm -f prosody.cfg.lua.install
	rm -f prosody.version
	$(MAKE) clean -C util-src

test:
	$(BUSTED) --lua=$(RUNWITH)

test-%:
	$(BUSTED) --lua=$(RUNWITH) -r $*

integration-test: all
	$(MKDIR) data
	$(RUNWITH) prosodyctl --config ./spec/scansion/prosody.cfg.lua start
	$(SCANSION) -d ./spec/scansion; R=$$? \
	$(RUNWITH) prosodyctl --config ./spec/scansion/prosody.cfg.lua stop \
	exit $$R

integration-test-%: all
	$(MKDIR) data
	$(RUNWITH) prosodyctl --config ./spec/scansion/prosody.cfg.lua start
	$(SCANSION) ./spec/scansion/$*.scs; R=$$? \
	$(RUNWITH) prosodyctl --config ./spec/scansion/prosody.cfg.lua stop \
	exit $$R

coverage:
	-rm -- luacov.*
	$(BUSTED) --lua=$(RUNWITH) -c
	luacov
	luacov-console
	luacov-console -s
	@echo "To inspect individual files run: luacov-console -l FILENAME"

lint:
	$(LUACHECK) -q $$(HGPLAIN= hg files -I '**.lua') prosody prosodyctl
	@echo $$(sed -n '/^\tlocal exclude_files/,/^}/p;' .luacheckrc | sed '1d;$d' | wc -l) files ignored
	shellcheck configure

vpath %.tl teal-src/
%.lua: %.tl
	tl -I teal-src/ --gen-compat off --gen-target 5.1 gen $^ -o $@
	-lua-format -i $@

teal: util/jsonschema.lua util/datamapper.lua util/jsonpointer.lua

util/%.so:
	$(MAKE) install -C util-src

%.install: %
	sed "1s| lua$$| $(RUNWITH)|; \
		s|^CFG_SOURCEDIR=.*;$$|CFG_SOURCEDIR='$(INSTALLEDSOURCE)';|; \
		s|^CFG_CONFIGDIR=.*;$$|CFG_CONFIGDIR='$(INSTALLEDCONFIG)';|; \
		s|^CFG_DATADIR=.*;$$|CFG_DATADIR='$(INSTALLEDDATA)';|; \
		s|^CFG_PLUGINDIR=.*;$$|CFG_PLUGINDIR='$(INSTALLEDMODULES)/';|;" < $^ > $@

prosody.cfg.lua.install: prosody.cfg.lua.dist
	sed 's|certs/|$(INSTALLEDCONFIG)/certs/|' $^ > $@

%.version: %.release
	cp $^ $@

%.version: .hg_archival.txt
	sed -n 's/^node: \(............\).*/\1/p' $^ > $@

%.version: .hg/dirstate
	hexdump -n6 -e'6/1 "%02x"' $^ > $@

%.version:
	echo unknown > $@