# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1306966854 -3600
# Node ID a37522bf6b1bb0db231110760dfb99e0dee3a7d3
# Parent  76f0d653b347c6f82d4f103cb1131898c3645452
xmlhandlers: Reject XML comments, processing instructions and (if supported by LuaExpat) DTDs. If not supported, log a warning. [Backport of 7cc426988bcc in trunk]

diff -r 76f0d653b347 -r a37522bf6b1b core/xmlhandlers.lua
--- a/core/xmlhandlers.lua	Tue May 18 23:28:36 2010 +0100
+++ b/core/xmlhandlers.lua	Wed Jun 01 23:20:54 2011 +0100
@@ -19,6 +19,16 @@
 
 local default_log = require "util.logger".init("xmlhandlers");
 
+-- COMPAT: w/LuaExpat 1.1.0
+local lxp_supports_doctype = pcall(lxp.new, { StartDoctypeDecl = false });
+
+if not lxp_supports_doctype then
+	default_log("warn", "The version of LuaExpat on your system leaves Prosody "
+		.."vulnerable to denial-of-service attacks. You should upgrade to "
+		.."LuaExpat 1.1.1 or higher as soon as possible. See "
+		.."http://prosody.im/doc/depends#luaexpat for more information.");
+end
+
 local error = error;
 
 module "xmlhandlers"
@@ -134,6 +144,18 @@
 				stanza:up();
 			end
 		end
+
+		local function restricted_handler()
+			cb_error(session, "parse-error", "restricted-xml", "Restricted XML, see RFC 6120 section 11.1.");
+		end
+		
+		if lxp_supports_doctype then
+			xml_handlers.StartDoctypeDecl = restricted_handler;
+		end
+		xml_handlers.Comment = restricted_handler;
+		xml_handlers.StartCdataSection = restricted_handler;
+		xml_handlers.ProcessingInstruction = restricted_handler;
+	
 	return xml_handlers;
 end