File

util/interpolation.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 11306:5798ab735619
child 11307:f2e276bb4ef8
line wrap: on
line source

-- Simple template language
--
-- The new() function takes a pattern and an escape function and returns
-- a render() function.  Both are required.
--
-- The function render() takes a string template and a table of values.
-- Sequences like {name} in the template string are substituted
-- with values from the table, optionally depending on a modifier
-- symbol.
--
-- Variants are:
-- {name} is substituted for values["name"] and is escaped using the
-- second argument to new_render().  To disable the escaping, use {name!}.
-- {name.item} can be used to access table items.
-- To renter lists of items: {name# item number {idx} is {item} }
-- Or key-value pairs: {name% t[ {idx} ] = {item} }
-- To show a defaults for missing values {name? sub-template } can be used,
-- which renders a sub-template if values["name"] is false-ish.
-- {name& sub-template } does the opposite, the sub-template is rendered
-- if the selected value is anything but false or nil.

local type, tostring = type, tostring;
local pairs, ipairs = pairs, ipairs;
local s_sub, s_gsub, s_match = string.sub, string.gsub, string.match;
local t_concat = table.concat;

local function new_render(pat, escape, funcs)
	-- assert(type(pat) == "string", "bad argument #1 to 'new_render' (string expected)");
	-- assert(type(escape) == "function", "bad argument #2 to 'new_render' (function expected)");
	local function render(template, values)
		-- assert(type(template) == "string", "bad argument #1 to 'render' (string expected)");
		-- assert(type(values) == "table", "bad argument #2 to 'render' (table expected)");
		return (s_gsub(template, pat, function (block)
			block = s_sub(block, 2, -2);
			local name, raw, opt, e = s_match(block, "^([%a_][%w_.]*)(!?)(%p?)()");
			if not name then return end
			local value = values[name];
			if not value and name:find(".", 2, true) then
				value = values;
				for word in name:gmatch"[^.]+" do
					value = value[word];
					if not value then break; end
				end
			end
			if funcs then
				while opt == '|' do
					local f;
					f, raw, opt, e = s_match(block, "^([%a_][%w_.]*)(!?)(%p?)()", e);
					f = funcs[f];
					if value ~= nil and f then value = f(value); end
				end
			end
			if opt == '#' or opt == '%' then
				if type(value) ~= "table" then return ""; end
				local iter = opt == '#' and ipairs or pairs;
				local out, i, subtpl = {}, 1, s_sub(block, e);
				local subvalues = setmetatable({}, { __index = values });
				for idx, item in iter(value) do
					subvalues.idx = idx;
					subvalues.item = item;
					out[i], i = render(subtpl, subvalues), i+1;
				end
				return t_concat(out);
			elseif opt == '&' then
				if not value then return ""; end
				return render(s_sub(block, e), values);
			elseif opt == '?' and not value then
				return render(s_sub(block, e), values);
			elseif value ~= nil then
				if type(value) ~= "string" then
					value = tostring(value);
				end
				if raw ~= '!' then
					return escape(value);
				end
				return value;
			end
		end));
	end
	return render;
end

return {
	new = new_render;
};