plugins/mod_message.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 8731 41c959c5c84b
child 11486 671f6b867e0d
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1522
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1423
diff changeset
     1
-- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1522
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1522
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5370
diff changeset
     4
--
1522
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1423
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1423
diff changeset
     6
-- COPYING file in the source package for more information.
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1423
diff changeset
     7
--
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1423
diff changeset
     8
1232
6ddbb583f067 mod_message: Initial commit
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
     9
5370
7838acadb0fa mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals
Kim Alvefur <zash@zash.se>
parents: 4965
diff changeset
    10
local full_sessions = prosody.full_sessions;
7838acadb0fa mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals
Kim Alvefur <zash@zash.se>
parents: 4965
diff changeset
    11
local bare_sessions = prosody.bare_sessions;
1232
6ddbb583f067 mod_message: Initial commit
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    12
1329
599a058d3961 mod_message: Require stanza lib to prevent traceback on error replies
Matthew Wild <mwild1@gmail.com>
parents: 1289
diff changeset
    13
local st = require "util.stanza";
1232
6ddbb583f067 mod_message: Initial commit
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    14
local jid_bare = require "util.jid".bare;
1289
d0c38cac1687 mod_message: Fix global access
Waqas Hussain <waqas20@gmail.com>
parents: 1275
diff changeset
    15
local jid_split = require "util.jid".split;
1232
6ddbb583f067 mod_message: Initial commit
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    16
local user_exists = require "core.usermanager".user_exists;
1274
50babb72edac mod_message: mod_message now handles all cases
Waqas Hussain <waqas20@gmail.com>
parents: 1272
diff changeset
    17
1271
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    18
local function process_to_bare(bare, origin, stanza)
1274
50babb72edac mod_message: mod_message now handles all cases
Waqas Hussain <waqas20@gmail.com>
parents: 1272
diff changeset
    19
	local user = bare_sessions[bare];
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5370
diff changeset
    20
1272
28f9041d8c55 mod_message: Added code to handle error groupchat and headline messages to bare JID
Waqas Hussain <waqas20@gmail.com>
parents: 1271
diff changeset
    21
	local t = stanza.attr.type;
1275
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    22
	if t == "error" then
7959
beaeafedc2d7 mod_message: Return early on messages of type error (silences empty if branch warning) [luacheck]
Kim Alvefur <zash@zash.se>
parents: 7721
diff changeset
    23
		return true; -- discard
1275
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    24
	elseif t == "groupchat" then
1272
28f9041d8c55 mod_message: Added code to handle error groupchat and headline messages to bare JID
Waqas Hussain <waqas20@gmail.com>
parents: 1271
diff changeset
    25
		origin.send(st.error_reply(stanza, "cancel", "service-unavailable"));
1275
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    26
	elseif t == "headline" then
3408
e03fd9a16e19 mod_message: Discard headline messages sent to offline full JIDs (to follow latest spec updates).
Waqas Hussain <waqas20@gmail.com>
parents: 2923
diff changeset
    27
		if user and stanza.attr.to == bare then
1274
50babb72edac mod_message: mod_message now handles all cases
Waqas Hussain <waqas20@gmail.com>
parents: 1272
diff changeset
    28
			for _, session in pairs(user.sessions) do
1272
28f9041d8c55 mod_message: Added code to handle error groupchat and headline messages to bare JID
Waqas Hussain <waqas20@gmail.com>
parents: 1271
diff changeset
    29
				if session.presence and session.priority >= 0 then
28f9041d8c55 mod_message: Added code to handle error groupchat and headline messages to bare JID
Waqas Hussain <waqas20@gmail.com>
parents: 1271
diff changeset
    30
					session.send(stanza);
28f9041d8c55 mod_message: Added code to handle error groupchat and headline messages to bare JID
Waqas Hussain <waqas20@gmail.com>
parents: 1271
diff changeset
    31
				end
28f9041d8c55 mod_message: Added code to handle error groupchat and headline messages to bare JID
Waqas Hussain <waqas20@gmail.com>
parents: 1271
diff changeset
    32
			end
1274
50babb72edac mod_message: mod_message now handles all cases
Waqas Hussain <waqas20@gmail.com>
parents: 1272
diff changeset
    33
		end  -- current policy is to discard headlines if no recipient is available
1275
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    34
	else -- chat or normal message
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    35
		if user then -- some resources are connected
1418
d14de6cb8b5b mod_message, mod_presence: Maintain list of top resources. Less work in routing messages to bare JIDs. - #optimization
Waqas Hussain <waqas20@gmail.com>
parents: 1329
diff changeset
    36
			local recipients = user.top_resources;
d14de6cb8b5b mod_message, mod_presence: Maintain list of top resources. Less work in routing messages to bare JIDs. - #optimization
Waqas Hussain <waqas20@gmail.com>
parents: 1329
diff changeset
    37
			if recipients then
4965
c1685f0441b7 mod_message: Don't treat a message as delivered ok if session.send() returns false
Matthew Wild <mwild1@gmail.com>
parents: 4759
diff changeset
    38
				local sent;
1275
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    39
				for i=1,#recipients do
4965
c1685f0441b7 mod_message: Don't treat a message as delivered ok if session.send() returns false
Matthew Wild <mwild1@gmail.com>
parents: 4759
diff changeset
    40
					sent = recipients[i].send(stanza) or sent;
1275
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    41
				end
4965
c1685f0441b7 mod_message: Don't treat a message as delivered ok if session.send() returns false
Matthew Wild <mwild1@gmail.com>
parents: 4759
diff changeset
    42
				if sent then
c1685f0441b7 mod_message: Don't treat a message as delivered ok if session.send() returns false
Matthew Wild <mwild1@gmail.com>
parents: 4759
diff changeset
    43
					return true;
c1685f0441b7 mod_message: Don't treat a message as delivered ok if session.send() returns false
Matthew Wild <mwild1@gmail.com>
parents: 4759
diff changeset
    44
				end
1274
50babb72edac mod_message: mod_message now handles all cases
Waqas Hussain <waqas20@gmail.com>
parents: 1272
diff changeset
    45
			end
1272
28f9041d8c55 mod_message: Added code to handle error groupchat and headline messages to bare JID
Waqas Hussain <waqas20@gmail.com>
parents: 1271
diff changeset
    46
		end
1275
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    47
		-- no resources are online
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    48
		local node, host = jid_split(bare);
3970
0f9ab57a1aee mod_message: Send service-unavailable if offline storage fails.
Robert Hoelz <rob@hoelz.ro>
parents: 3968
diff changeset
    49
		local ok
1275
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    50
		if user_exists(node, host) then
3972
a05cf5d9c7ab mod_message, mod_offline: Change message/offline/store -> message/offline/handle
Robert Hoelz <rob@hoelz.ro>
parents: 3970
diff changeset
    51
			ok = module:fire_event('message/offline/handle', {
8144
03714861f8fc mod_message: Include username in event for offline messages
Kim Alvefur <zash@zash.se>
parents: 8142
diff changeset
    52
				username = node;
8142
4119cca64064 mod_message: Normalize indentation
Kim Alvefur <zash@zash.se>
parents: 8139
diff changeset
    53
				origin = origin,
4119cca64064 mod_message: Normalize indentation
Kim Alvefur <zash@zash.se>
parents: 8139
diff changeset
    54
				stanza = stanza,
3970
0f9ab57a1aee mod_message: Send service-unavailable if offline storage fails.
Robert Hoelz <rob@hoelz.ro>
parents: 3968
diff changeset
    55
			});
0f9ab57a1aee mod_message: Send service-unavailable if offline storage fails.
Robert Hoelz <rob@hoelz.ro>
parents: 3968
diff changeset
    56
		end
0f9ab57a1aee mod_message: Send service-unavailable if offline storage fails.
Robert Hoelz <rob@hoelz.ro>
parents: 3968
diff changeset
    57
0f9ab57a1aee mod_message: Send service-unavailable if offline storage fails.
Robert Hoelz <rob@hoelz.ro>
parents: 3968
diff changeset
    58
		if not ok then
1275
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    59
			origin.send(st.error_reply(stanza, "cancel", "service-unavailable"));
850cf92b8ad4 mod_message: A little cleanup
Waqas Hussain <waqas20@gmail.com>
parents: 1274
diff changeset
    60
		end
1274
50babb72edac mod_message: mod_message now handles all cases
Waqas Hussain <waqas20@gmail.com>
parents: 1272
diff changeset
    61
	end
50babb72edac mod_message: mod_message now handles all cases
Waqas Hussain <waqas20@gmail.com>
parents: 1272
diff changeset
    62
	return true;
1271
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    63
end
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    64
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    65
module:hook("message/full", function(data)
8731
41c959c5c84b Fix spelling throughout the codebase [codespell]
Kim Alvefur <zash@zash.se>
parents: 8144
diff changeset
    66
	-- message to full JID received
1271
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    67
	local origin, stanza = data.origin, data.stanza;
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5370
diff changeset
    68
1271
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    69
	local session = full_sessions[stanza.attr.to];
4965
c1685f0441b7 mod_message: Don't treat a message as delivered ok if session.send() returns false
Matthew Wild <mwild1@gmail.com>
parents: 4759
diff changeset
    70
	if session and session.send(stanza) then
1271
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    71
		return true;
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    72
	else -- resource not online
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    73
		return process_to_bare(jid_bare(stanza.attr.to), origin, stanza);
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    74
	end
7721
c58075c4d375 mod_message, mod_carbons: Adjust event hook priorities to negative (core modules should do this to make overriding from other modules easier)
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    75
end, -1);
1271
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    76
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    77
module:hook("message/bare", function(data)
8731
41c959c5c84b Fix spelling throughout the codebase [codespell]
Kim Alvefur <zash@zash.se>
parents: 8144
diff changeset
    78
	-- message to bare JID received
1271
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    79
	local origin, stanza = data.origin, data.stanza;
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    80
e78c161944ab mod_message: Move bare JID processing to it's own function
Waqas Hussain <waqas20@gmail.com>
parents: 1234
diff changeset
    81
	return process_to_bare(stanza.attr.to or (origin.username..'@'..origin.host), origin, stanza);
7721
c58075c4d375 mod_message, mod_carbons: Adjust event hook priorities to negative (core modules should do this to make overriding from other modules easier)
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    82
end, -1);
1423
5e72c3e1743a mod_message: Advertise offline message support as per XEP-0160 (thanks nolan)
Matthew Wild <mwild1@gmail.com>
parents: 1418
diff changeset
    83
5e72c3e1743a mod_message: Advertise offline message support as per XEP-0160 (thanks nolan)
Matthew Wild <mwild1@gmail.com>
parents: 1418
diff changeset
    84
module:add_feature("msgoffline");