plugins/mod_vcard.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 9231 e2e2aa76ea31
child 10556 f1cf8c08a09d
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1523
841d61be198f Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents: 1042
diff changeset
     1
-- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2344
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2344
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5500
diff changeset
     4
--
758
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 615
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 615
diff changeset
     6
-- COPYING file in the source package for more information.
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 438
diff changeset
     7
--
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 438
diff changeset
     8
2004
5033348feba8 mod_vcard: Cleaned up unused variables and global accesses.
Waqas Hussain <waqas20@gmail.com>
parents: 2003
diff changeset
     9
local st = require "util.stanza"
5033348feba8 mod_vcard: Cleaned up unused variables and global accesses.
Waqas Hussain <waqas20@gmail.com>
parents: 2003
diff changeset
    10
local jid_split = require "util.jid".split;
5500
eeea0eb2602a mod_auth_internal_hashed, mod_auth_internal_plain, mod_privacy, mod_private, mod_register, mod_vcard, mod_muc: Use module:open_store()
Kim Alvefur <zash@zash.se>
parents: 5017
diff changeset
    11
eeea0eb2602a mod_auth_internal_hashed, mod_auth_internal_plain, mod_privacy, mod_private, mod_register, mod_vcard, mod_muc: Use module:open_store()
Kim Alvefur <zash@zash.se>
parents: 5017
diff changeset
    12
local vcards = module:open_store();
86
a2085854c72c Added: vCard plugin: mod_vcard
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    13
2004
5033348feba8 mod_vcard: Cleaned up unused variables and global accesses.
Waqas Hussain <waqas20@gmail.com>
parents: 2003
diff changeset
    14
module:add_feature("vcard-temp");
86
a2085854c72c Added: vCard plugin: mod_vcard
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
    15
2004
5033348feba8 mod_vcard: Cleaned up unused variables and global accesses.
Waqas Hussain <waqas20@gmail.com>
parents: 2003
diff changeset
    16
local function handle_vcard(event)
2001
2f73fe2b3edd mod_vcard: Moved completely to new event based hooks.
Waqas Hussain <waqas20@gmail.com>
parents: 2000
diff changeset
    17
	local session, stanza = event.origin, event.stanza;
2002
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    18
	local to = stanza.attr.to;
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    19
	if stanza.attr.type == "get" then
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    20
		local vCard;
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    21
		if to then
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    22
			local node, host = jid_split(to);
5500
eeea0eb2602a mod_auth_internal_hashed, mod_auth_internal_plain, mod_privacy, mod_private, mod_register, mod_vcard, mod_muc: Use module:open_store()
Kim Alvefur <zash@zash.se>
parents: 5017
diff changeset
    23
			vCard = st.deserialize(vcards:get(node)); -- load vCard for user or server
2002
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    24
		else
5500
eeea0eb2602a mod_auth_internal_hashed, mod_auth_internal_plain, mod_privacy, mod_private, mod_register, mod_vcard, mod_muc: Use module:open_store()
Kim Alvefur <zash@zash.se>
parents: 5017
diff changeset
    25
			vCard = st.deserialize(vcards:get(session.username));-- load user's own vCard
2002
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    26
		end
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    27
		if vCard then
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    28
			session.send(st.reply(stanza):add_child(vCard)); -- send vCard!
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    29
		else
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    30
			session.send(st.error_reply(stanza, "cancel", "item-not-found"));
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    31
		end
9231
e2e2aa76ea31 mod_private, mod_vcard: Use the usual comment on non-get received iqs.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 9222
diff changeset
    32
	else -- stanza.attr.type == "set"
2002
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    33
		if not to then
5500
eeea0eb2602a mod_auth_internal_hashed, mod_auth_internal_plain, mod_privacy, mod_private, mod_register, mod_vcard, mod_muc: Use module:open_store()
Kim Alvefur <zash@zash.se>
parents: 5017
diff changeset
    34
			if vcards:set(session.username, st.preserialize(stanza.tags[1])) then
2002
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    35
				session.send(st.reply(stanza));
1956
ec04b571fa86 mod_vcard: Add vcard_compatibility option to handle vcard stanzas routed to the full JID by ejabberd MUC rooms
Matthew Wild <mwild1@gmail.com>
parents: 1779
diff changeset
    36
			else
2002
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    37
				-- TODO unable to write file, file may be locked, etc, what's the correct error?
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    38
				session.send(st.error_reply(stanza, "wait", "internal-server-error"));
1956
ec04b571fa86 mod_vcard: Add vcard_compatibility option to handle vcard stanzas routed to the full JID by ejabberd MUC rooms
Matthew Wild <mwild1@gmail.com>
parents: 1779
diff changeset
    39
			end
2002
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    40
		else
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    41
			session.send(st.error_reply(stanza, "auth", "forbidden"));
1956
ec04b571fa86 mod_vcard: Add vcard_compatibility option to handle vcard stanzas routed to the full JID by ejabberd MUC rooms
Matthew Wild <mwild1@gmail.com>
parents: 1779
diff changeset
    42
		end
ec04b571fa86 mod_vcard: Add vcard_compatibility option to handle vcard stanzas routed to the full JID by ejabberd MUC rooms
Matthew Wild <mwild1@gmail.com>
parents: 1779
diff changeset
    43
	end
2002
fa71261d8a15 mod_vcard: Refactoring and cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2001
diff changeset
    44
	return true;
1956
ec04b571fa86 mod_vcard: Add vcard_compatibility option to handle vcard stanzas routed to the full JID by ejabberd MUC rooms
Matthew Wild <mwild1@gmail.com>
parents: 1779
diff changeset
    45
end
ec04b571fa86 mod_vcard: Add vcard_compatibility option to handle vcard stanzas routed to the full JID by ejabberd MUC rooms
Matthew Wild <mwild1@gmail.com>
parents: 1779
diff changeset
    46
2001
2f73fe2b3edd mod_vcard: Moved completely to new event based hooks.
Waqas Hussain <waqas20@gmail.com>
parents: 2000
diff changeset
    47
module:hook("iq/bare/vcard-temp:vCard", handle_vcard);
2f73fe2b3edd mod_vcard: Moved completely to new event based hooks.
Waqas Hussain <waqas20@gmail.com>
parents: 2000
diff changeset
    48
module:hook("iq/host/vcard-temp:vCard", handle_vcard);