plugins/mod_private.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 9231 e2e2aa76ea31
child 12981 74b9e05af71e
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1523
841d61be198f Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
     1
-- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5500
diff changeset
     4
--
758
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 615
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 615
diff changeset
     6
-- COPYING file in the source package for more information.
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 438
diff changeset
     7
--
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 438
diff changeset
     8
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 438
diff changeset
     9
185
a67c88ce1c6a Added support for XEP-0049: Private XML Storage (mod_private)
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    10
local st = require "util.stanza"
a67c88ce1c6a Added support for XEP-0049: Private XML Storage (mod_private)
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    11
6343
e6839156bb82 mod_private: Use map store
Kim Alvefur <zash@zash.se>
parents: 6341
diff changeset
    12
local private_storage = module:open_store("private", "map");
185
a67c88ce1c6a Added support for XEP-0049: Private XML Storage (mod_private)
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    13
541
3521e0851c9e Change modules to use the new add_feature module API method.
Waqas Hussain <waqas20@gmail.com>
parents: 519
diff changeset
    14
module:add_feature("jabber:iq:private");
421
63be85693710 Modules now sending disco replies
Waqas Hussain <waqas20@gmail.com>
parents: 310
diff changeset
    15
3522
4646b5b039ca mod_private: Updated to use the new events API. Smaller, more robust.
Waqas Hussain <waqas20@gmail.com>
parents: 3114
diff changeset
    16
module:hook("iq/self/jabber:iq:private:query", function(event)
4646b5b039ca mod_private: Updated to use the new events API. Smaller, more robust.
Waqas Hussain <waqas20@gmail.com>
parents: 3114
diff changeset
    17
	local origin, stanza = event.origin, event.stanza;
4646b5b039ca mod_private: Updated to use the new events API. Smaller, more robust.
Waqas Hussain <waqas20@gmail.com>
parents: 3114
diff changeset
    18
	local query = stanza.tags[1];
6341
ab9a1af80632 mod_private: Cleanup and more tailcalls
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    19
	if #query.tags ~= 1 then
6844
be87ab2d611c plugins: Explicitly return to halt event propagation (session.send sometimes does not return true)
Kim Alvefur <zash@zash.se>
parents: 6353
diff changeset
    20
		origin.send(st.error_reply(stanza, "modify", "bad-format"));
be87ab2d611c plugins: Explicitly return to halt event propagation (session.send sometimes does not return true)
Kim Alvefur <zash@zash.se>
parents: 6353
diff changeset
    21
		return true;
6341
ab9a1af80632 mod_private: Cleanup and more tailcalls
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    22
	end
ab9a1af80632 mod_private: Cleanup and more tailcalls
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    23
	local tag = query.tags[1];
ab9a1af80632 mod_private: Cleanup and more tailcalls
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    24
	local key = tag.name..":"..tag.attr.xmlns;
ab9a1af80632 mod_private: Cleanup and more tailcalls
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    25
	if stanza.attr.type == "get" then
6343
e6839156bb82 mod_private: Use map store
Kim Alvefur <zash@zash.se>
parents: 6341
diff changeset
    26
		local data, err = private_storage:get(origin.username, key);
e6839156bb82 mod_private: Use map store
Kim Alvefur <zash@zash.se>
parents: 6341
diff changeset
    27
		if data then
6846
161cccfdf015 Merge 0.10->trunk
Kim Alvefur <zash@zash.se>
parents: 6354 6844
diff changeset
    28
			origin.send(st.reply(stanza):query("jabber:iq:private"):add_child(st.deserialize(data)));
6343
e6839156bb82 mod_private: Use map store
Kim Alvefur <zash@zash.se>
parents: 6341
diff changeset
    29
		elseif err then
6846
161cccfdf015 Merge 0.10->trunk
Kim Alvefur <zash@zash.se>
parents: 6354 6844
diff changeset
    30
			origin.send(st.error_reply(stanza, "wait", "internal-server-error", err));
6341
ab9a1af80632 mod_private: Cleanup and more tailcalls
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    31
		else
6844
be87ab2d611c plugins: Explicitly return to halt event propagation (session.send sometimes does not return true)
Kim Alvefur <zash@zash.se>
parents: 6353
diff changeset
    32
			origin.send(st.reply(stanza):add_child(query));
3522
4646b5b039ca mod_private: Updated to use the new events API. Smaller, more robust.
Waqas Hussain <waqas20@gmail.com>
parents: 3114
diff changeset
    33
		end
6846
161cccfdf015 Merge 0.10->trunk
Kim Alvefur <zash@zash.se>
parents: 6354 6844
diff changeset
    34
		return true;
9231
e2e2aa76ea31 mod_private, mod_vcard: Use the usual comment on non-get received iqs.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 6846
diff changeset
    35
	else -- stanza.attr.type == "set"
6343
e6839156bb82 mod_private: Use map store
Kim Alvefur <zash@zash.se>
parents: 6341
diff changeset
    36
		local data;
e6839156bb82 mod_private: Use map store
Kim Alvefur <zash@zash.se>
parents: 6341
diff changeset
    37
		if #tag ~= 0 then
e6839156bb82 mod_private: Use map store
Kim Alvefur <zash@zash.se>
parents: 6341
diff changeset
    38
			data = st.preserialize(tag);
185
a67c88ce1c6a Added support for XEP-0049: Private XML Storage (mod_private)
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    39
		end
6341
ab9a1af80632 mod_private: Cleanup and more tailcalls
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    40
		-- TODO delete datastore if empty
6343
e6839156bb82 mod_private: Use map store
Kim Alvefur <zash@zash.se>
parents: 6341
diff changeset
    41
		local ok, err = private_storage:set(origin.username, key, data);
6341
ab9a1af80632 mod_private: Cleanup and more tailcalls
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    42
		if not ok then
6844
be87ab2d611c plugins: Explicitly return to halt event propagation (session.send sometimes does not return true)
Kim Alvefur <zash@zash.se>
parents: 6353
diff changeset
    43
			origin.send(st.error_reply(stanza, "wait", "internal-server-error", err));
be87ab2d611c plugins: Explicitly return to halt event propagation (session.send sometimes does not return true)
Kim Alvefur <zash@zash.se>
parents: 6353
diff changeset
    44
			return true;
6341
ab9a1af80632 mod_private: Cleanup and more tailcalls
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    45
		end
6844
be87ab2d611c plugins: Explicitly return to halt event propagation (session.send sometimes does not return true)
Kim Alvefur <zash@zash.se>
parents: 6353
diff changeset
    46
		origin.send(st.reply(stanza));
be87ab2d611c plugins: Explicitly return to halt event propagation (session.send sometimes does not return true)
Kim Alvefur <zash@zash.se>
parents: 6353
diff changeset
    47
		return true;
3522
4646b5b039ca mod_private: Updated to use the new events API. Smaller, more robust.
Waqas Hussain <waqas20@gmail.com>
parents: 3114
diff changeset
    48
	end
4646b5b039ca mod_private: Updated to use the new events API. Smaller, more robust.
Waqas Hussain <waqas20@gmail.com>
parents: 3114
diff changeset
    49
end);