Software / code / prosody
Changeset
12270:c78639ee6ccb
util.xml: Add an option to allow <?processing instructions?>
These should generally be safe to just ignore, which should be the
default behavior of Expat and LuaExpat
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Fri, 04 Feb 2022 20:47:39 +0100 |
| parents | 12269:a19d435dee90 |
| children | 12271:f31bb79f51d7 |
| files | spec/util_xml_spec.lua util/xml.lua |
| diffstat | 2 files changed, 11 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/spec/util_xml_spec.lua Fri Feb 04 20:11:18 2022 +0100 +++ b/spec/util_xml_spec.lua Fri Feb 04 20:47:39 2022 +0100 @@ -42,6 +42,13 @@ assert.falsy(ok); end); + it("should allow processing instructions if asked nicely", function() + local x = "<?xml-stylesheet href='make-fancy.xsl'?><foo/>"; + local stanza = xml.parse(x, {allow_processing_instructions = true}); + assert.truthy(stanza); + assert.are.equal(stanza.name, "foo"); + end); + it("should allow an xml declaration", function() local x = "<?xml version='1.0'?><foo/>"; local stanza = xml.parse(x);
--- a/util/xml.lua Fri Feb 04 20:11:18 2022 +0100 +++ b/util/xml.lua Fri Feb 04 20:47:39 2022 +0100 @@ -72,11 +72,14 @@ end end handler.StartDoctypeDecl = restricted_handler; - handler.ProcessingInstruction = restricted_handler; if not options or not options.allow_comments then -- NOTE: comments are generally harmless and can be useful when parsing configuration files or other data, even user-provided data handler.Comment = restricted_handler; end + if not options or not options.allow_processing_instructions then + -- Processing instructions should generally be safe to just ignore + handler.ProcessingInstruction = restricted_handler; + end local parser = lxp.new(handler, ns_separator); local ok, err, line, col = parser:parse(xml); if ok then ok, err, line, col = parser:parse(); end
