File

tools/modtrace.lua @ 12180:53e0ae770917

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 11197:50f182931bdd
child 12589:39ae08180c81
line wrap: on
line source

-- Trace module calls and method calls on created objects
--
-- Very rough and for debugging purposes only. It makes many
-- assumptions and there are many ways it could fail.
--
-- Example use:
--
--   local dbuffer = require "tools.modtrace".trace("util.dbuffer");
--

local t_pack = require "util.table".pack;
local serialize = require "util.serialization".serialize;
local unpack = table.unpack or unpack; --luacheck: ignore 113
local set = require "util.set";

local serialize_cfg = {
	preset = "oneline";
	freeze = true;
	fatal = false;
	fallback = function (v) return "<"..tostring(v)..">" end;
};

local function stringify_value(v)
	if type(v) == "string" and #v > 20 then
		return ("<string(%d)>"):format(#v);
	elseif type(v) == "function" then
		return tostring(v);
	end
	return serialize(v, serialize_cfg);
end

local function stringify_params(...)
	local n = select("#", ...);
	local r = {};
	for i = 1, n do
		table.insert(r, stringify_value((select(i, ...))));
	end
	return table.concat(r, ", ");
end

local function stringify_result(ret)
	local r = {};
	for i = 1, ret.n do
		table.insert(r, stringify_value(ret[i]));
	end
	return table.concat(r, ", ");
end

local function stringify_call(method_name, ...)
	return ("%s(%s)"):format(method_name, stringify_params(...));
end

local function wrap_method(original_obj, original_method, method_name)
	method_name = ("<%s>:%s"):format(getmetatable(original_obj).__name or "object", method_name);
	return function (new_obj_self, ...)
		local opts = new_obj_self._modtrace_opts;
		local f = opts.output or io.stderr;
		f:write(stringify_call(method_name, ...));
		local ret = t_pack(original_method(original_obj, ...));
		if ret.n > 0 then
			f:write(" = ", stringify_result(ret), "\n");
		else
			f:write("\n");
		end
		return unpack(ret, 1, ret.n);
	end;
end

local function wrap_function(original_function, function_name, opts)
	local f = opts.output or io.stderr;
	return function (...)
		f:write(stringify_call(function_name, ...));
		local ret = t_pack(original_function(...));
		if ret.n > 0 then
			f:write(" = ", stringify_result(ret), "\n");
		else
			f:write("\n");
		end
		return unpack(ret, 1, ret.n);
	end;
end

local function wrap_metamethod(name, method)
	if name == "__index" then
		return function (new_obj, k)
			local original_method;
			if type(method) == "table" then
				original_method = new_obj._modtrace_original_obj[k];
			else
				original_method = method(new_obj._modtrace_original_obj, k);
			end
			if original_method == nil then
				return nil;
			end
			return wrap_method(new_obj._modtrace_original_obj, original_method, k);
		end;
	end
	return function (new_obj, ...)
		return method(new_obj._modtrace_original_obj, ...);
	end;
end

local function wrap_mt(original_mt)
	local new_mt = {};
	for k, v in pairs(original_mt) do
		new_mt[k] = wrap_metamethod(k, v);
	end
	return new_mt;
end

local function wrap_obj(original_obj, opts)
	local new_mt = wrap_mt(getmetatable(original_obj));
	return setmetatable({_modtrace_original_obj = original_obj, _modtrace_opts = opts}, new_mt);
end

local function wrap_new(original_new, function_name, opts)
	local f = opts.output or io.stderr;
	return function (...)
		f:write(stringify_call(function_name, ...));
		local ret = t_pack(original_new(...));
		local obj = ret[1];

		if ret.n == 1 and type(ret[1]) == "table" then
			f:write(" = <", getmetatable(ret[1]).__name or "object", ">", "\n");
		elseif ret.n > 0 then
			f:write(" = ", stringify_result(ret), "\n");
		else
			f:write("\n");
		end

		if obj then
			ret[1] = wrap_obj(obj, opts);
		end
		return unpack(ret, 1, ret.n);
	end;
end

local function trace(module, opts)
	if type(module) == "string" then
		module = require(module);
	end
	opts = opts or {};
	local new_methods = set.new(opts.new_methods or {"new"});
	local fake_module = setmetatable({}, {
		__index = function (_, k)
			if new_methods:contains(k) then
				return wrap_new(module[k], k, opts);
			else
				return wrap_function(module[k], k, opts);
			end
		end;
	});
	return fake_module;
end

return {
	wrap = trace;
	trace = trace;
}