# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1563589198 -7200
# Node ID 4b3c129e96f2686f3c8ee873add5cc97dcc02e1d
# Parent  7a36b7ac309bbca74ad75edd9cf86db33535ba7d
mod_websocket: Clone stanza before mutating (fixes #1398)

Checking for `stanza.attr.xmlns == nil` to determine if the stanza
object is an actual stanza (`<message>`, `<presence>` or `<iq>` in the
`jabber:client` or `jabbber:server` namespace) or some other stream
element.

Since this mutation is not reverted, it may leak to other places and
cause them to mistreat stanzas as stream elements. Especially in cases
like MUC where a single stanza is broadcast to many recipients.

diff -r 7a36b7ac309b -r 4b3c129e96f2 plugins/mod_websocket.lua
--- a/plugins/mod_websocket.lua	Mon Jul 08 02:46:27 2019 +0200
+++ b/plugins/mod_websocket.lua	Sat Jul 20 04:19:58 2019 +0200
@@ -285,6 +285,7 @@
 	end);
 
 	add_filter(session, "stanzas/out", function(stanza)
+		stanza = st.clone(stanza);
 		local attr = stanza.attr;
 		attr.xmlns = attr.xmlns or xmlns_client;
 		if stanza.name:find("^stream:") then