plugins/mod_offline.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 8033 bd3527198308
child 10246 7e5d2a6c9390
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2680
1b267876246a Backed out changeset e7b09424b486 (not removing mod_offline for trunk)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     1
-- Prosody IM
1b267876246a Backed out changeset e7b09424b486 (not removing mod_offline for trunk)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     2
-- Copyright (C) 2008-2009 Matthew Wild
1b267876246a Backed out changeset e7b09424b486 (not removing mod_offline for trunk)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     3
-- Copyright (C) 2008-2009 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3973
diff changeset
     4
--
2680
1b267876246a Backed out changeset e7b09424b486 (not removing mod_offline for trunk)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
1b267876246a Backed out changeset e7b09424b486 (not removing mod_offline for trunk)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     6
-- COPYING file in the source package for more information.
1b267876246a Backed out changeset e7b09424b486 (not removing mod_offline for trunk)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     7
--
1b267876246a Backed out changeset e7b09424b486 (not removing mod_offline for trunk)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     8
2737
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
     9
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    10
local datetime = require "util.datetime";
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    11
local jid_split = require "util.jid".split;
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    12
8027
8eec715c13a6 mod_offline: Switch to using archive store via the storagemanager API
Kim Alvefur <zash@zash.se>
parents: 6837
diff changeset
    13
local offline_messages = module:open_store("offline", "archive");
8eec715c13a6 mod_offline: Switch to using archive store via the storagemanager API
Kim Alvefur <zash@zash.se>
parents: 6837
diff changeset
    14
2737
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    15
module:add_feature("msgoffline");
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    16
3972
a05cf5d9c7ab mod_message, mod_offline: Change message/offline/store -> message/offline/handle
Robert Hoelz <rob@hoelz.ro>
parents: 3971
diff changeset
    17
module:hook("message/offline/handle", function(event)
2737
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    18
	local origin, stanza = event.origin, event.stanza;
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    19
	local to = stanza.attr.to;
8027
8eec715c13a6 mod_offline: Switch to using archive store via the storagemanager API
Kim Alvefur <zash@zash.se>
parents: 6837
diff changeset
    20
	local node;
2737
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    21
	if to then
8027
8eec715c13a6 mod_offline: Switch to using archive store via the storagemanager API
Kim Alvefur <zash@zash.se>
parents: 6837
diff changeset
    22
		node = jid_split(to)
2737
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    23
	else
8027
8eec715c13a6 mod_offline: Switch to using archive store via the storagemanager API
Kim Alvefur <zash@zash.se>
parents: 6837
diff changeset
    24
		node = origin.username;
2737
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    25
	end
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3973
diff changeset
    26
8033
bd3527198308 mod_offline: Include timestamp and empty 'with'
Kim Alvefur <zash@zash.se>
parents: 8027
diff changeset
    27
	return offline_messages:append(node, nil, stanza, os.time(), "");
6837
750a97b45f88 mod_offline: Decrease priority of event handlers so 3rd party hooks fire first by default
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    28
end, -1);
2737
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    29
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    30
module:hook("message/offline/broadcast", function(event)
2251f8898900 mod_offline: Convert to Unix line endings.
Waqas Hussain <waqas20@gmail.com>
parents: 2680
diff changeset
    31
	local origin = event.origin;
3520
dc94193ec942 Alter mod_offline to respect negative priority resources
Robert Hoelz <rob@hoelz.ro>
parents: 2737
diff changeset
    32
3973
f5416372350d Don't check priority in mod_offline
Robert Hoelz <rob@hoelz.ro>
parents: 3972
diff changeset
    33
	local node, host = origin.username, origin.host;
3540
bc139431830b Monster whitespace commit (beware the whitespace monster).
Waqas Hussain <waqas20@gmail.com>
parents: 3520
diff changeset
    34
8027
8eec715c13a6 mod_offline: Switch to using archive store via the storagemanager API
Kim Alvefur <zash@zash.se>
parents: 6837
diff changeset
    35
	local data = offline_messages:find(node);
3973
f5416372350d Don't check priority in mod_offline
Robert Hoelz <rob@hoelz.ro>
parents: 3972
diff changeset
    36
	if not data then return true; end
8027
8eec715c13a6 mod_offline: Switch to using archive store via the storagemanager API
Kim Alvefur <zash@zash.se>
parents: 6837
diff changeset
    37
	for _, stanza, when in data do
8eec715c13a6 mod_offline: Switch to using archive store via the storagemanager API
Kim Alvefur <zash@zash.se>
parents: 6837
diff changeset
    38
		stanza:tag("delay", {xmlns = "urn:xmpp:delay", from = host, stamp = datetime.datetime(when)}):up(); -- XEP-0203
3973
f5416372350d Don't check priority in mod_offline
Robert Hoelz <rob@hoelz.ro>
parents: 3972
diff changeset
    39
		origin.send(stanza);
3540
bc139431830b Monster whitespace commit (beware the whitespace monster).
Waqas Hussain <waqas20@gmail.com>
parents: 3520
diff changeset
    40
	end
8027
8eec715c13a6 mod_offline: Switch to using archive store via the storagemanager API
Kim Alvefur <zash@zash.se>
parents: 6837
diff changeset
    41
	offline_messages:delete(node);
3973
f5416372350d Don't check priority in mod_offline
Robert Hoelz <rob@hoelz.ro>
parents: 3972
diff changeset
    42
	return true;
6837
750a97b45f88 mod_offline: Decrease priority of event handlers so 3rd party hooks fire first by default
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    43
end, -1);