plugins/mod_vcard4.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 10711 c4b49939b471
child 12981 74b9e05af71e
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
9264
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     1
local st = require "util.stanza"
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     2
local jid_split = require "util.jid".split;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     3
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     4
local mod_pep = module:depends("pep");
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     5
9286
e977b64ebd81 mod_vcard4: Advertise feature on account instead of host
Kim Alvefur <zash@zash.se>
parents: 9264
diff changeset
     6
module:hook("account-disco-info", function (event)
e977b64ebd81 mod_vcard4: Advertise feature on account instead of host
Kim Alvefur <zash@zash.se>
parents: 9264
diff changeset
     7
	event.reply:tag("feature", { var = "urn:ietf:params:xml:ns:vcard-4.0" }):up();
e977b64ebd81 mod_vcard4: Advertise feature on account instead of host
Kim Alvefur <zash@zash.se>
parents: 9264
diff changeset
     8
end);
9264
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     9
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    10
module:hook("iq-get/bare/urn:ietf:params:xml:ns:vcard-4.0:vcard", function (event)
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    11
	local origin, stanza = event.origin, event.stanza;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    12
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    13
	local pep_service = mod_pep.get_pep_service(jid_split(stanza.attr.to) or origin.username);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    14
	local ok, id, item = pep_service:get_last_item("urn:xmpp:vcard4", stanza.attr.from);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    15
	if ok and item then
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    16
		origin.send(st.reply(stanza):add_child(item.tags[1]));
10711
c4b49939b471 mod_vcard4: Report correct error condition (fixes #1521)
Kim Alvefur <zash@zash.se>
parents: 9286
diff changeset
    17
	elseif id == "item-not-found" or not id then
9264
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    18
		origin.send(st.error_reply(stanza, "cancel", "item-not-found"));
10711
c4b49939b471 mod_vcard4: Report correct error condition (fixes #1521)
Kim Alvefur <zash@zash.se>
parents: 9286
diff changeset
    19
	elseif id == "forbidden" then
9264
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    20
		origin.send(st.error_reply(stanza, "auth", "forbidden"));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    21
	else
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    22
		origin.send(st.error_reply(stanza, "modify", "undefined-condition"));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    23
	end
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    24
	return true;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    25
end);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    26
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    27
module:hook("iq-set/self/urn:ietf:params:xml:ns:vcard-4.0:vcard", function (event)
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    28
	local origin, stanza = event.origin, event.stanza;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    29
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    30
	local vcard4 = st.stanza("item", { xmlns = "http://jabber.org/protocol/pubsub", id = "current" })
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    31
		:add_child(stanza.tags[1]);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    32
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    33
	local pep_service = mod_pep.get_pep_service(origin.username);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    34
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    35
	local ok, err = pep_service:publish("urn:xmpp:vcard4", origin.full_jid, "current", vcard4);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    36
	if ok then
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    37
		origin.send(st.reply(stanza));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    38
	elseif err == "forbidden" then
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    39
		origin.send(st.error_reply(stanza, "auth", "forbidden"));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    40
	else
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    41
		origin.send(st.error_reply(stanza, "modify", "undefined-condition", err));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    42
	end
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    43
	return true;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    44
end);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    45