plugins/mod_version.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 9439 a950f9fa9137
child 12981 74b9e05af71e
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1523
841d61be198f Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents: 1312
diff changeset
     1
-- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1646
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1646
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 4793
diff changeset
     4
--
758
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 704
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 704
diff changeset
     6
-- COPYING file in the source package for more information.
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 517
diff changeset
     7
--
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 517
diff changeset
     8
188
0d9f03009b8a mod_version is here
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     9
local st = require "util.stanza";
0d9f03009b8a mod_version is here
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    10
1646
21bcc7b8b4d8 mod_version: Rewritten to use new API. Added reply caching, and fixed some issues.
Waqas Hussain <waqas20@gmail.com>
parents: 1645
diff changeset
    11
module:add_feature("jabber:iq:version");
421
63be85693710 Modules now sending disco replies
Waqas Hussain <waqas20@gmail.com>
parents: 314
diff changeset
    12
3421
d3852a4d37e2 mod_version: Leave out the os element if hide_os_type is set
Kim Alvefur <zash@zash.se>
parents: 3420
diff changeset
    13
local query = st.stanza("query", {xmlns = "jabber:iq:version"})
9436
13b8d47119ad mod_version: Use text_tag
Kim Alvefur <zash@zash.se>
parents: 9232
diff changeset
    14
	:text_tag("name", "Prosody")
13b8d47119ad mod_version: Use text_tag
Kim Alvefur <zash@zash.se>
parents: 9232
diff changeset
    15
	:text_tag("version", prosody.version);
3421
d3852a4d37e2 mod_version: Leave out the os element if hide_os_type is set
Kim Alvefur <zash@zash.se>
parents: 3420
diff changeset
    16
7980
01d6298de991 plugins/various: Use type-specific config API
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    17
if not module:get_option_boolean("hide_os_type") then
9439
a950f9fa9137 mod_version: Reduce scope of variable
Kim Alvefur <zash@zash.se>
parents: 9438
diff changeset
    18
	local platform;
803
5a64649f4b94 mod_version: Operating system detection. Disable with hide_os_type = true in config
Matthew Wild <mwild1@gmail.com>
parents: 760
diff changeset
    19
	if os.getenv("WINDIR") then
9438
33301038d3e4 mod_version: Rename confusingly named variable
Kim Alvefur <zash@zash.se>
parents: 9437
diff changeset
    20
		platform = "Windows";
803
5a64649f4b94 mod_version: Operating system detection. Disable with hide_os_type = true in config
Matthew Wild <mwild1@gmail.com>
parents: 760
diff changeset
    21
	else
7980
01d6298de991 plugins/various: Use type-specific config API
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    22
		local os_version_command = module:get_option_string("os_version_command");
4793
eaa8991998d5 mod_version: Fix missing comma and correct prefix for util.pposix
Kim Alvefur <zash@zash.se>
parents: 3483
diff changeset
    23
		local ok, pposix = pcall(require, "util.pposix");
3483
443139c396c5 mod_version: Use pposix.uname() if available and os_version_command not set
Matthew Wild <mwild1@gmail.com>
parents: 3421
diff changeset
    24
		if not os_version_command and (ok and pposix and pposix.uname) then
9438
33301038d3e4 mod_version: Rename confusingly named variable
Kim Alvefur <zash@zash.se>
parents: 9437
diff changeset
    25
			platform = pposix.uname().sysname;
3483
443139c396c5 mod_version: Use pposix.uname() if available and os_version_command not set
Matthew Wild <mwild1@gmail.com>
parents: 3421
diff changeset
    26
		end
9438
33301038d3e4 mod_version: Rename confusingly named variable
Kim Alvefur <zash@zash.se>
parents: 9437
diff changeset
    27
		if not platform then
3483
443139c396c5 mod_version: Use pposix.uname() if available and os_version_command not set
Matthew Wild <mwild1@gmail.com>
parents: 3421
diff changeset
    28
			local uname = io.popen(os_version_command or "uname");
443139c396c5 mod_version: Use pposix.uname() if available and os_version_command not set
Matthew Wild <mwild1@gmail.com>
parents: 3421
diff changeset
    29
			if uname then
9438
33301038d3e4 mod_version: Rename confusingly named variable
Kim Alvefur <zash@zash.se>
parents: 9437
diff changeset
    30
				platform = uname:read("*a");
3483
443139c396c5 mod_version: Use pposix.uname() if available and os_version_command not set
Matthew Wild <mwild1@gmail.com>
parents: 3421
diff changeset
    31
			end
443139c396c5 mod_version: Use pposix.uname() if available and os_version_command not set
Matthew Wild <mwild1@gmail.com>
parents: 3421
diff changeset
    32
			uname:close();
803
5a64649f4b94 mod_version: Operating system detection. Disable with hide_os_type = true in config
Matthew Wild <mwild1@gmail.com>
parents: 760
diff changeset
    33
		end
5a64649f4b94 mod_version: Operating system detection. Disable with hide_os_type = true in config
Matthew Wild <mwild1@gmail.com>
parents: 760
diff changeset
    34
	end
9438
33301038d3e4 mod_version: Rename confusingly named variable
Kim Alvefur <zash@zash.se>
parents: 9437
diff changeset
    35
	if platform then
33301038d3e4 mod_version: Rename confusingly named variable
Kim Alvefur <zash@zash.se>
parents: 9437
diff changeset
    36
		platform = platform:match("^%s*(.-)%s*$") or platform;
33301038d3e4 mod_version: Rename confusingly named variable
Kim Alvefur <zash@zash.se>
parents: 9437
diff changeset
    37
		query:text_tag("os", platform);
3483
443139c396c5 mod_version: Use pposix.uname() if available and os_version_command not set
Matthew Wild <mwild1@gmail.com>
parents: 3421
diff changeset
    38
	end
803
5a64649f4b94 mod_version: Operating system detection. Disable with hide_os_type = true in config
Matthew Wild <mwild1@gmail.com>
parents: 760
diff changeset
    39
end
5a64649f4b94 mod_version: Operating system detection. Disable with hide_os_type = true in config
Matthew Wild <mwild1@gmail.com>
parents: 760
diff changeset
    40
9230
c0e058633d9a mod_version: Simplify iq handling by hooking on iq-get/ instead of iq/.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 7980
diff changeset
    41
module:hook("iq-get/host/jabber:iq:version:query", function(event)
9437
b502766a10d7 mod_version: Make 'origin' variable local for consistency
Kim Alvefur <zash@zash.se>
parents: 9436
diff changeset
    42
	local origin, stanza = event.origin, event.stanza;
b502766a10d7 mod_version: Make 'origin' variable local for consistency
Kim Alvefur <zash@zash.se>
parents: 9436
diff changeset
    43
	origin.send(st.reply(stanza):add_child(query));
9232
1338b84c0566 mod_version: Remove redundant
Kim Alvefur <zash@zash.se>
parents: 9230
diff changeset
    44
	return true;
704
ef8d0d339172 mod_version: Removed and rearranged some code
Waqas Hussain <waqas20@gmail.com>
parents: 615
diff changeset
    45
end);