util/pluginloader.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 8385 e5d00bf4a4d5
child 10209 ff8de86b75f0
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1522
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1441
diff changeset
     1
-- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1522
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1522
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5073
diff changeset
     4
--
1522
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1441
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1441
diff changeset
     6
-- COPYING file in the source package for more information.
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1441
diff changeset
     7
--
8385
e5d00bf4a4d5 util: Various minor changes to please [luacheck]
Kim Alvefur <zash@zash.se>
parents: 7118
diff changeset
     8
-- luacheck: ignore 113/CFG_PLUGINDIR
1522
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1441
diff changeset
     9
4121
ea7e3f22f898 util.pluginloader: Add support for multiple plugin directories.
Waqas Hussain <waqas20@gmail.com>
parents: 3411
diff changeset
    10
local dir_sep, path_sep = package.config:match("^(%S+)%s(%S+)");
ea7e3f22f898 util.pluginloader: Add support for multiple plugin directories.
Waqas Hussain <waqas20@gmail.com>
parents: 3411
diff changeset
    11
local plugin_dir = {};
ea7e3f22f898 util.pluginloader: Add support for multiple plugin directories.
Waqas Hussain <waqas20@gmail.com>
parents: 3411
diff changeset
    12
for path in (CFG_PLUGINDIR or "./plugins/"):gsub("[/\\]", dir_sep):gmatch("[^"..path_sep.."]+") do
ea7e3f22f898 util.pluginloader: Add support for multiple plugin directories.
Waqas Hussain <waqas20@gmail.com>
parents: 3411
diff changeset
    13
	path = path..dir_sep; -- add path separator to path end
ea7e3f22f898 util.pluginloader: Add support for multiple plugin directories.
Waqas Hussain <waqas20@gmail.com>
parents: 3411
diff changeset
    14
	path = path:gsub(dir_sep..dir_sep.."+", dir_sep); -- coalesce multiple separaters
ea7e3f22f898 util.pluginloader: Add support for multiple plugin directories.
Waqas Hussain <waqas20@gmail.com>
parents: 3411
diff changeset
    15
	plugin_dir[#plugin_dir + 1] = path;
ea7e3f22f898 util.pluginloader: Add support for multiple plugin directories.
Waqas Hussain <waqas20@gmail.com>
parents: 3411
diff changeset
    16
end
1359
015d624a2a71 util.pluginloader: Initial commit - a plugin resource loader
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    17
5073
ecc89a60b2ba util.pluginloader: Remove unused imports
Matthew Wild <mwild1@gmail.com>
parents: 5072
diff changeset
    18
local io_open = io.open;
5021
85b2689dbcfe Eliminate direct setfenv usage
Florian Zeitz <florob@babelmonkeys.de>
parents: 4154
diff changeset
    19
local envload = require "util.envload".envload;
2276
d9302be05f86 util.pluginloader: Support for fetching plugins from the data store
Matthew Wild <mwild1@gmail.com>
parents: 1522
diff changeset
    20
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6031
diff changeset
    21
local function load_file(names)
4149
3c1b153c2856 util.pluginloader: Return full file path from internal file loader on success, not just the name.
Waqas Hussain <waqas20@gmail.com>
parents: 4121
diff changeset
    22
	local file, err, path;
4121
ea7e3f22f898 util.pluginloader: Add support for multiple plugin directories.
Waqas Hussain <waqas20@gmail.com>
parents: 3411
diff changeset
    23
	for i=1,#plugin_dir do
4154
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    24
		for j=1,#names do
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    25
			path = plugin_dir[i]..names[j];
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    26
			file, err = io_open(path);
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    27
			if file then
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    28
				local content = file:read("*a");
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    29
				file:close();
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    30
				return content, path;
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    31
			end
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    32
		end
4121
ea7e3f22f898 util.pluginloader: Add support for multiple plugin directories.
Waqas Hussain <waqas20@gmail.com>
parents: 3411
diff changeset
    33
	end
4154
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    34
	return file, err;
1359
015d624a2a71 util.pluginloader: Initial commit - a plugin resource loader
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    35
end
015d624a2a71 util.pluginloader: Initial commit - a plugin resource loader
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    36
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6031
diff changeset
    37
local function load_resource(plugin, resource)
4154
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    38
	resource = resource or "mod_"..plugin..".lua";
2276
d9302be05f86 util.pluginloader: Support for fetching plugins from the data store
Matthew Wild <mwild1@gmail.com>
parents: 1522
diff changeset
    39
4154
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    40
	local names = {
6029
dd3d4cfbd3cb util.pluginloader: Always use path separator from package.config (thanks Junne)
Kim Alvefur <zash@zash.se>
parents: 5073
diff changeset
    41
		"mod_"..plugin..dir_sep..plugin..dir_sep..resource; -- mod_hello/hello/mod_hello.lua
dd3d4cfbd3cb util.pluginloader: Always use path separator from package.config (thanks Junne)
Kim Alvefur <zash@zash.se>
parents: 5073
diff changeset
    42
		"mod_"..plugin..dir_sep..resource;                  -- mod_hello/mod_hello.lua
dd3d4cfbd3cb util.pluginloader: Always use path separator from package.config (thanks Junne)
Kim Alvefur <zash@zash.se>
parents: 5073
diff changeset
    43
		plugin..dir_sep..resource;                          -- hello/mod_hello.lua
dd3d4cfbd3cb util.pluginloader: Always use path separator from package.config (thanks Junne)
Kim Alvefur <zash@zash.se>
parents: 5073
diff changeset
    44
		resource;                                           -- mod_hello.lua
4154
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    45
	};
3410
32b018eeeb3b util.pluginloader: Fix loading of plugins, plugin libraries and resources in subfolders (e.g., when loading 'a/b', load 'a/mod_b.lua', and not 'mod_a/b.lua').
Waqas Hussain <waqas20@gmail.com>
parents: 3233
diff changeset
    46
4154
3785a9bb7f11 util.pluginloader: Rewritten resource loading to be cleaner, and added support for prosody-modules directory layout. "/" in plugin names is no longer supported.
Waqas Hussain <waqas20@gmail.com>
parents: 4152
diff changeset
    47
	return load_file(names);
1359
015d624a2a71 util.pluginloader: Initial commit - a plugin resource loader
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    48
end
015d624a2a71 util.pluginloader: Initial commit - a plugin resource loader
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    49
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6031
diff changeset
    50
local function load_code(plugin, resource, env)
1359
015d624a2a71 util.pluginloader: Initial commit - a plugin resource loader
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    51
	local content, err = load_resource(plugin, resource);
015d624a2a71 util.pluginloader: Initial commit - a plugin resource loader
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    52
	if not content then return content, err; end
4150
2894ca33ec45 util.pluginloader: Return file path on success in pluginloader.load_code().
Waqas Hussain <waqas20@gmail.com>
parents: 4149
diff changeset
    53
	local path = err;
5021
85b2689dbcfe Eliminate direct setfenv usage
Florian Zeitz <florob@babelmonkeys.de>
parents: 4154
diff changeset
    54
	local f, err = envload(content, "@"..path, env);
4150
2894ca33ec45 util.pluginloader: Return file path on success in pluginloader.load_code().
Waqas Hussain <waqas20@gmail.com>
parents: 4149
diff changeset
    55
	if not f then return f, err; end
2894ca33ec45 util.pluginloader: Return file path on success in pluginloader.load_code().
Waqas Hussain <waqas20@gmail.com>
parents: 4149
diff changeset
    56
	return f, path;
1359
015d624a2a71 util.pluginloader: Initial commit - a plugin resource loader
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    57
end
015d624a2a71 util.pluginloader: Initial commit - a plugin resource loader
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    58
7118
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    59
local function load_code_ext(plugin, resource, extension, env)
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    60
	local content, err = load_resource(plugin, resource.."."..extension);
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    61
	if not content then
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    62
		content, err = load_resource(resource, resource.."."..extension);
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    63
		if not content then
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    64
			return content, err;
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    65
		end
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    66
	end
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    67
	local path = err;
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    68
	local f, err = envload(content, "@"..path, env);
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    69
	if not f then return f, err; end
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    70
	return f, path;
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    71
end
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    72
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6031
diff changeset
    73
return {
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6031
diff changeset
    74
	load_file = load_file;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6031
diff changeset
    75
	load_resource = load_resource;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6031
diff changeset
    76
	load_code = load_code;
7118
805d068d2fd5 modulemanager, util.pluginloader: Move logic for locating some module libraries to pluginloader, to fix problems with non-filesystem errors being masked by the second load_code call
Matthew Wild <mwild1@gmail.com>
parents: 6780
diff changeset
    77
	load_code_ext = load_code_ext;
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6031
diff changeset
    78
};