plugins/mod_time.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 9228 0ba963e82ac7
child 12636 70ae68bb0aa5
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1523
841d61be198f Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents: 1513
diff changeset
     1
-- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2012
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2012
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 2923
diff changeset
     4
--
758
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 615
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 615
diff changeset
     6
-- COPYING file in the source package for more information.
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 438
diff changeset
     7
--
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 438
diff changeset
     8
1513
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
     9
local st = require "util.stanza";
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    10
local datetime = require "util.datetime".datetime;
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    11
local legacy = require "util.datetime".legacy;
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    12
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    13
-- XEP-0202: Entity Time
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    14
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    15
module:add_feature("urn:xmpp:time");
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    16
2012
12131e7d3c25 mod_time: Updated to use events (which also fixes a few minor issues).
Waqas Hussain <waqas20@gmail.com>
parents: 1523
diff changeset
    17
local function time_handler(event)
12131e7d3c25 mod_time: Updated to use events (which also fixes a few minor issues).
Waqas Hussain <waqas20@gmail.com>
parents: 1523
diff changeset
    18
	local origin, stanza = event.origin, event.stanza;
9228
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    19
	origin.send(st.reply(stanza):tag("time", {xmlns="urn:xmpp:time"})
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    20
		:tag("tzo"):text("+00:00"):up() -- TODO get the timezone in a platform independent fashion
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    21
		:tag("utc"):text(datetime()));
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    22
	return true;
2012
12131e7d3c25 mod_time: Updated to use events (which also fixes a few minor issues).
Waqas Hussain <waqas20@gmail.com>
parents: 1523
diff changeset
    23
end
12131e7d3c25 mod_time: Updated to use events (which also fixes a few minor issues).
Waqas Hussain <waqas20@gmail.com>
parents: 1523
diff changeset
    24
9228
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    25
module:hook("iq-get/bare/urn:xmpp:time:time", time_handler);
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    26
module:hook("iq-get/host/urn:xmpp:time:time", time_handler);
1513
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    27
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    28
-- XEP-0090: Entity Time (deprecated)
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    29
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    30
module:add_feature("jabber:iq:time");
5c62216dd516 mod_time Convert from Windows line endings
Matthew Wild <mwild1@gmail.com>
parents: 896
diff changeset
    31
2012
12131e7d3c25 mod_time: Updated to use events (which also fixes a few minor issues).
Waqas Hussain <waqas20@gmail.com>
parents: 1523
diff changeset
    32
local function legacy_time_handler(event)
12131e7d3c25 mod_time: Updated to use events (which also fixes a few minor issues).
Waqas Hussain <waqas20@gmail.com>
parents: 1523
diff changeset
    33
	local origin, stanza = event.origin, event.stanza;
9228
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    34
	origin.send(st.reply(stanza):tag("query", {xmlns="jabber:iq:time"})
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    35
		:tag("utc"):text(legacy()));
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    36
	return true;
2012
12131e7d3c25 mod_time: Updated to use events (which also fixes a few minor issues).
Waqas Hussain <waqas20@gmail.com>
parents: 1523
diff changeset
    37
end
12131e7d3c25 mod_time: Updated to use events (which also fixes a few minor issues).
Waqas Hussain <waqas20@gmail.com>
parents: 1523
diff changeset
    38
9228
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    39
module:hook("iq-get/bare/jabber:iq:time:query", legacy_time_handler);
0ba963e82ac7 mod_time: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5776
diff changeset
    40
module:hook("iq-get/host/jabber:iq:time:query", legacy_time_handler);