spec/scansion/basic_roster.scs
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 9308 f14c81fd44a4
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
9294
329a670ae975 spec/scansion: Ensure all scripts have sensible titles
Matthew Wild <mwild1@gmail.com>
parents: 9293
diff changeset
     1
# Basic roster test
329a670ae975 spec/scansion: Ensure all scripts have sensible titles
Matthew Wild <mwild1@gmail.com>
parents: 9293
diff changeset
     2
9269
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     3
[Client] Romeo
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     4
	jid: user@localhost
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     5
	password: password
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     6
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     7
[Client] Juliet
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     8
	jid: juliet@localhost
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     9
	password: password
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    10
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    11
---------
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    12
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    13
Romeo connects
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    14
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    15
Juliet connects
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    16
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    17
Romeo sends:
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    18
	<presence/>
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    19
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    20
Romeo receives:
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    21
	<presence from="${Romeo's full JID}" />
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    22
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    23
Romeo sends:
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    24
	<iq type="get" id="roster1">
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    25
		<query xmlns='jabber:iq:roster'/>
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    26
	</iq>
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    27
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    28
Romeo receives:
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    29
	<iq type="result" id="roster1">
9293
decdaaf78f32 spec/scansion: Multiple fixes to make all tests pass in latest (c35386e4b456) scansion
Matthew Wild <mwild1@gmail.com>
parents: 9269
diff changeset
    30
		<query ver='{scansion:any}' xmlns="jabber:iq:roster"/>
9269
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    31
	</iq>
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    32
9308
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    33
# Add nurse to roster
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    34
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    35
Romeo sends:
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    36
	<iq type="set" id="roster2">
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    37
		<query xmlns="jabber:iq:roster">
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    38
			<item jid='nurse@localhost'/>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    39
		</query>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    40
	</iq>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    41
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    42
# Receive the roster add result
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    43
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    44
Romeo receives:
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    45
	<iq type="result" id="roster2"/>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    46
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    47
# Receive the roster push
9269
c5267f5fd6e6 spec/scansion: Add scansion scripts used for testing
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    48
9308
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    49
Romeo receives:
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    50
	<iq type="set" id="{scansion:any}">
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    51
		<query xmlns='jabber:iq:roster' ver='{scansion:any}'>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    52
			<item jid='nurse@localhost' subscription='none'/>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    53
		</query>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    54
	</iq>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    55
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    56
Romeo sends:
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    57
	<iq type="result" id="fixme"/>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    58
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    59
# Fetch the roster, it should include nurse now
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    60
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    61
Romeo sends:
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    62
	<iq type="get" id="roster3">
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    63
		<query xmlns='jabber:iq:roster'/>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    64
	</iq>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    65
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    66
Romeo receives:
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    67
	<iq type="result" id="roster3">
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    68
		<query xmlns='jabber:iq:roster' ver="{scansion:any}">
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    69
			<item subscription='none' jid='nurse@localhost'/>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    70
		</query>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    71
	</iq>
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    72
f14c81fd44a4 spec/scansion/basic_roster.scs: Add tests for actually modifying the roster
Matthew Wild <mwild1@gmail.com>
parents: 9294
diff changeset
    73
Romeo disconnects