README
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 7362 a5a080c12c96
child 9948 11d39caf0852
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1192
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     1
# Prosody IM Server
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     2
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     3
## Description
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     4
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     5
Prosody is a server for Jabber/XMPP written in Lua. It aims to be easy 
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     6
to use and light on resources. For developers, it aims to give a 
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     7
flexible system on which to rapidly develop added functionality or 
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     8
rapidly prototype new protocols.
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     9
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    10
## Useful links
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    11
7362
a5a080c12c96 Update every link to the documentation to use HTTPS
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 2665
diff changeset
    12
Homepage:        https://prosody.im/
a5a080c12c96 Update every link to the documentation to use HTTPS
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 2665
diff changeset
    13
Download:        https://prosody.im/download
a5a080c12c96 Update every link to the documentation to use HTTPS
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 2665
diff changeset
    14
Documentation:   https://prosody.im/doc/
1192
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    15
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    16
Jabber/XMPP Chat:
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    17
               Address:
1391
b910ef82622d README: Update for new MUC address
Matthew Wild <mwild1@gmail.com>
parents: 1192
diff changeset
    18
                 prosody@conference.prosody.im
1192
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    19
               Web interface:
7362
a5a080c12c96 Update every link to the documentation to use HTTPS
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 2665
diff changeset
    20
                 https://prosody.im/webchat
1192
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    21
               
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    22
Mailing lists:
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    23
               User support and discussion:
7362
a5a080c12c96 Update every link to the documentation to use HTTPS
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 2665
diff changeset
    24
                 https://groups.google.com/group/prosody-users
1192
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    25
               
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    26
               Development discussion:
7362
a5a080c12c96 Update every link to the documentation to use HTTPS
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 2665
diff changeset
    27
                 https://groups.google.com/group/prosody-dev
1192
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    28
               
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    29
               Issue tracker changes:
7362
a5a080c12c96 Update every link to the documentation to use HTTPS
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 2665
diff changeset
    30
                 https://groups.google.com/group/prosody-issues
1192
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    31
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    32
## Installation
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    33
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    34
See the accompanying INSTALL file for help on building Prosody from source. Alternatively 
7362
a5a080c12c96 Update every link to the documentation to use HTTPS
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 2665
diff changeset
    35
see our guide at https://prosody.im/doc/install
1192
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    36
b1b42ce4f0f6 Finally add README and INSTALL files
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    37