util/mercurial.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 6588 ec94dc502113
child 10537 a6cc5b844d7b
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
6588
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     1
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     2
local lfs = require"lfs";
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     3
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     4
local hg = { };
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     5
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     6
function hg.check_id(path)
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     7
	if lfs.attributes(path, 'mode') ~= "directory" then
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     8
		return nil, "not a directory";
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     9
	end
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    10
	local hg_dirstate = io.open(path.."/.hg/dirstate");
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    11
	local hgid, hgrepo
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    12
	if hg_dirstate then
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    13
		hgid = ("%02x%02x%02x%02x%02x%02x"):format(hg_dirstate:read(6):byte(1, 6));
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    14
		hg_dirstate:close();
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    15
		local hg_changelog = io.open(path.."/.hg/store/00changelog.i");
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    16
		if hg_changelog then
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    17
			hg_changelog:seek("set", 0x20);
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    18
			hgrepo = ("%02x%02x%02x%02x%02x%02x"):format(hg_changelog:read(6):byte(1, 6));
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    19
			hg_changelog:close();
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    20
		end
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    21
	else
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    22
		local hg_archival,e = io.open(path.."/.hg_archival.txt");
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    23
		if hg_archival then
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    24
			local repo = hg_archival:read("*l");
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    25
			local node = hg_archival:read("*l");
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    26
			hg_archival:close()
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    27
			hgid = node and node:match("^node: (%x%x%x%x%x%x%x%x%x%x%x%x)")
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    28
			hgrepo = repo and repo:match("^repo: (%x%x%x%x%x%x%x%x%x%x%x%x)")
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    29
		end
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    30
	end
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    31
	return hgid, hgrepo;
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    32
end
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    33
ec94dc502113 util.mercurial: Utility functions for Mercurial repositories
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    34
return hg;