File

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.

-- TODO many actually return Maybe(String)
local record lib
	record base64
		encode : function (s : string) : string
		decode : function (s : string) : string
	end
	record stringprep
		nameprep : function (s : string, strict : boolean) : string
		nodeprep : function (s : string, strict : boolean) : string
		resourceprep : function (s : string, strict : boolean) : string
		saslprep : function (s : string, strict : boolean) : string
	end
	record idna
		to_ascii : function (s : string) : string
		to_unicode : function (s : string) : string
	end
	record utf8
		valid : function (s : string) : boolean
		length : function (s : string) : integer
	end
	record confusable
		skeleteon : function (s : string) : string
	end
	version : string
end
return lib