util/jid.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 9327 607b262da853
child 10362 a77d9b3885bb
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1523
841d61be198f Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents: 1171
diff changeset
     1
-- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2245
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2245
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 4407
diff changeset
     4
--
758
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 717
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 717
diff changeset
     6
-- COPYING file in the source package for more information.
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 384
diff changeset
     7
--
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 384
diff changeset
     8
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 384
diff changeset
     9
0
3e3171b59028 First commit, where do you want to go tomorrow?
matthew
parents:
diff changeset
    10
7324
a7199fc8a50e util.jid: Import select() into local (fixes traceback, tests on Lua 5.2)
Kim Alvefur <zash@zash.se>
parents: 7299
diff changeset
    11
local select = select;
5944
f3817912e8b2 util.jid: Strip trailing '.' when normalizing hostnames
Matthew Wild <mwild1@gmail.com>
parents: 4407
diff changeset
    12
local match, sub = string.match, string.sub;
717
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    13
local nodeprep = require "util.encodings".stringprep.nodeprep;
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    14
local nameprep = require "util.encodings".stringprep.nameprep;
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    15
local resourceprep = require "util.encodings".stringprep.resourceprep;
367
cc26368294a3 Remove some declarations I added while debugging
Matthew Wild <mwild1@gmail.com>
parents: 366
diff changeset
    16
4407
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    17
local escapes = {
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    18
	[" "] = "\\20"; ['"'] = "\\22";
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    19
	["&"] = "\\26"; ["'"] = "\\27";
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    20
	["/"] = "\\2f"; [":"] = "\\3a";
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    21
	["<"] = "\\3c"; [">"] = "\\3e";
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    22
	["@"] = "\\40"; ["\\"] = "\\5c";
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    23
};
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    24
local unescapes = {};
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    25
for k,v in pairs(escapes) do unescapes[v] = k; end
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
    26
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    27
local _ENV = nil;
8558
4f0f5b49bb03 vairious: Add annotation when an empty environment is set [luacheck]
Kim Alvefur <zash@zash.se>
parents: 7673
diff changeset
    28
-- luacheck: std none
0
3e3171b59028 First commit, where do you want to go tomorrow?
matthew
parents:
diff changeset
    29
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    30
local function split(jid)
109
7efedc96352a Minor edit, and added a TODO
Waqas Hussain <waqas20@gmail.com>
parents: 104
diff changeset
    31
	if not jid then return; end
3480
97831dfe7f72 util.jid: Fix parsing of JIDs with no nodepart and an @ in the resourcepart (thanks seth)
Matthew Wild <mwild1@gmail.com>
parents: 3375
diff changeset
    32
	local node, nodepos = match(jid, "^([^@/]+)@()");
9327
607b262da853 util.jid: Add missing semicolon
Kim Alvefur <zash@zash.se>
parents: 8558
diff changeset
    33
	local host, hostpos = match(jid, "^([^@/]+)()", nodepos);
366
5691edc7dd63 Improve jid.split() and jid.bare() to pass new test cases with invalid JIDs
Matthew Wild <mwild1@gmail.com>
parents: 365
diff changeset
    34
	if node and not host then return nil, nil, nil; end
369
42de92add67b Better names for variables
Matthew Wild <mwild1@gmail.com>
parents: 368
diff changeset
    35
	local resource = match(jid, "^/(.+)$", hostpos);
42de92add67b Better names for variables
Matthew Wild <mwild1@gmail.com>
parents: 368
diff changeset
    36
	if (not host) or ((not resource) and #jid >= hostpos) then return nil, nil, nil; end
366
5691edc7dd63 Improve jid.split() and jid.bare() to pass new test cases with invalid JIDs
Matthew Wild <mwild1@gmail.com>
parents: 365
diff changeset
    37
	return node, host, resource;
0
3e3171b59028 First commit, where do you want to go tomorrow?
matthew
parents:
diff changeset
    38
end
104
cfbd3b849f9e Fixed: util/jid.lua now returns module object
Waqas Hussain <waqas20@gmail.com>
parents: 29
diff changeset
    39
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    40
local function bare(jid)
6894
7f76c77ddcb8 util.jid: Fix backout
Kim Alvefur <zash@zash.se>
parents: 6892
diff changeset
    41
	local node, host = split(jid);
6892
7f7920f2aebf Backout 7e820979fd9b (broke tests)
Kim Alvefur <zash@zash.se>
parents: 6780
diff changeset
    42
	if node and host then
7f7920f2aebf Backout 7e820979fd9b (broke tests)
Kim Alvefur <zash@zash.se>
parents: 6780
diff changeset
    43
		return node.."@"..host;
7f7920f2aebf Backout 7e820979fd9b (broke tests)
Kim Alvefur <zash@zash.se>
parents: 6780
diff changeset
    44
	end
7f7920f2aebf Backout 7e820979fd9b (broke tests)
Kim Alvefur <zash@zash.se>
parents: 6780
diff changeset
    45
	return host;
365
a59300fc22ec Add jid.bare() helper function
Matthew Wild <mwild1@gmail.com>
parents: 109
diff changeset
    46
end
a59300fc22ec Add jid.bare() helper function
Matthew Wild <mwild1@gmail.com>
parents: 109
diff changeset
    47
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    48
local function prepped_split(jid)
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    49
	local node, host, resource = split(jid);
7673
2be85cb3bc66 mod_carbons: Make the conditions for ignoring MUC PMs more specific (fixes #744)
Kim Alvefur <zash@zash.se>
parents: 7324
diff changeset
    50
	if host and host ~= "." then
5944
f3817912e8b2 util.jid: Strip trailing '.' when normalizing hostnames
Matthew Wild <mwild1@gmail.com>
parents: 4407
diff changeset
    51
		if sub(host, -1, -1) == "." then -- Strip empty root label
f3817912e8b2 util.jid: Strip trailing '.' when normalizing hostnames
Matthew Wild <mwild1@gmail.com>
parents: 4407
diff changeset
    52
			host = sub(host, 1, -2);
f3817912e8b2 util.jid: Strip trailing '.' when normalizing hostnames
Matthew Wild <mwild1@gmail.com>
parents: 4407
diff changeset
    53
		end
717
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    54
		host = nameprep(host);
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    55
		if not host then return; end
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    56
		if node then
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    57
			node = nodeprep(node);
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    58
			if not node then return; end
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    59
		end
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    60
		if resource then
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    61
			resource = resourceprep(resource);
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    62
			if not resource then return; end
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    63
		end
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    64
		return node, host, resource;
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    65
	end
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    66
end
ab428c579cbc util/jid: string prepping functions added: prepped_split and prep
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    67
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    68
local function join(node, host, resource)
6339
1c19464cde77 util.jid: Use existing join function in jid.prep
Kim Alvefur <zash@zash.se>
parents: 6338
diff changeset
    69
	if not host then return end
6338
736c388748fd util.jid: Return early in join on invalid jids
Kim Alvefur <zash@zash.se>
parents: 5945
diff changeset
    70
	if node and resource then
2245
df9e18f5c808 util.jid: Add join(node, host, resource) function to join the components and return nil if invalid
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
    71
		return node.."@"..host.."/"..resource;
6338
736c388748fd util.jid: Return early in join on invalid jids
Kim Alvefur <zash@zash.se>
parents: 5945
diff changeset
    72
	elseif node then
2245
df9e18f5c808 util.jid: Add join(node, host, resource) function to join the components and return nil if invalid
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
    73
		return node.."@"..host;
6338
736c388748fd util.jid: Return early in join on invalid jids
Kim Alvefur <zash@zash.se>
parents: 5945
diff changeset
    74
	elseif resource then
2245
df9e18f5c808 util.jid: Add join(node, host, resource) function to join the components and return nil if invalid
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
    75
		return host.."/"..resource;
df9e18f5c808 util.jid: Add join(node, host, resource) function to join the components and return nil if invalid
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
    76
	end
6338
736c388748fd util.jid: Return early in join on invalid jids
Kim Alvefur <zash@zash.se>
parents: 5945
diff changeset
    77
	return host;
2245
df9e18f5c808 util.jid: Add join(node, host, resource) function to join the components and return nil if invalid
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
    78
end
6339
1c19464cde77 util.jid: Use existing join function in jid.prep
Kim Alvefur <zash@zash.se>
parents: 6338
diff changeset
    79
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    80
local function prep(jid)
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    81
	local node, host, resource = prepped_split(jid);
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    82
	return join(node, host, resource);
6339
1c19464cde77 util.jid: Use existing join function in jid.prep
Kim Alvefur <zash@zash.se>
parents: 6338
diff changeset
    83
end
2245
df9e18f5c808 util.jid: Add join(node, host, resource) function to join the components and return nil if invalid
Matthew Wild <mwild1@gmail.com>
parents: 1523
diff changeset
    84
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    85
local function compare(jid, acl)
3375
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    86
	-- compare jid to single acl rule
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    87
	-- TODO compare to table of rules?
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    88
	local jid_node, jid_host, jid_resource = split(jid);
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
    89
	local acl_node, acl_host, acl_resource = split(acl);
3375
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    90
	if ((acl_node ~= nil and acl_node == jid_node) or acl_node == nil) and
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    91
		((acl_host ~= nil and acl_host == jid_host) or acl_host == nil) and
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    92
		((acl_resource ~= nil and acl_resource == jid_resource) or acl_resource == nil) then
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    93
		return true
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    94
	end
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    95
	return false
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    96
end
29e51e1c7c3d util.jid: compare() added, with some tests.
Kim Alvefur <zash@zash.se>
parents: 2923
diff changeset
    97
7299
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
    98
local function node(jid)
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
    99
	return (select(1, split(jid)));
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   100
end
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   101
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   102
local function host(jid)
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   103
	return (select(2, split(jid)));
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   104
end
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   105
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   106
local function resource(jid)
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   107
	return (select(3, split(jid)));
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   108
end
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   109
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   110
local function escape(s) return s and (s:gsub(".", escapes)); end
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   111
local function unescape(s) return s and (s:gsub("\\%x%x", unescapes)); end
4407
f78c6f5fa090 util.jid: Added escape() and unescape().
Waqas Hussain <waqas20@gmail.com>
parents: 3480
diff changeset
   112
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   113
return {
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   114
	split = split;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   115
	bare = bare;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   116
	prepped_split = prepped_split;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   117
	join = join;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   118
	prep = prep;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   119
	compare = compare;
7299
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   120
	node = node;
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   121
	host = host;
1859e07ae082 util.jid+tests: Add simple helpers... node(), host() and resource() for extracting specific parts of a JID
Matthew Wild <mwild1@gmail.com>
parents: 6894
diff changeset
   122
	resource = resource;
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   123
	escape = escape;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   124
	unescape = unescape;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6340
diff changeset
   125
};