Mercurial Mercurial > prosody > prosody / annotate
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | file | latest | revisions | annotate | diff | comparison | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
spec/scansion/muc_mediated_invite.scs
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 9294 329a670ae975
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
9294
329a670ae975 spec/scansion: Ensure all scripts have sensible titles
Matthew Wild <mwild1@gmail.com>
parents: 9269
diff changeset 
     1
 
# MUC: Mediated invites
329a670ae975 spec/scansion: Ensure all scripts have sensible titles
Matthew Wild <mwild1@gmail.com>
parents: 9269
diff changeset 
     2
 







9269






c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




     3


[Client] Romeo












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




     4


	jid: user@localhost












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




     5


	password: password












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




     6














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




     7


[Client] Juliet












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




     8


	jid: user2@localhost












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




     9


	password: password












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    10














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    11


-----












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    12














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    13


Romeo connects












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    14














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    15


Romeo sends:












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    16


	<presence to="room@conference.localhost/Romeo">












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    17


		<x xmlns="http://jabber.org/protocol/muc"/>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    18


	</presence>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    19














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    20


Romeo receives:












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    21


	<presence from='room@conference.localhost/Romeo'>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    22


		<x xmlns='http://jabber.org/protocol/muc#user'>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    23


			<status code='201'/>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    24


			<item jid="${Romeo's full JID}" affiliation='owner' role='moderator'/>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    25


			<status code='110'/>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    26


		</x>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    27


	</presence>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    28














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    29


Romeo receives:












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    30


	<message type='groupchat' from='room@conference.localhost'><subject/></message>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    31














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    32


# Submit config form












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    33


Romeo sends:












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    34


	<iq id='config1' to='room@conference.localhost' type='set'>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    35


		<query xmlns='http://jabber.org/protocol/muc#owner'>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    36


			<x xmlns='jabber:x:data' type='submit'>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    37


				<field var='FORM_TYPE'>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    38


					<value>http://jabber.org/protocol/muc#roomconfig</value>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    39


				</field>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    40


			</x>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    41


		</query>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    42


	</iq>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    43














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    44


Romeo receives:












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    45


	<iq id="config1" from="room@conference.localhost" type="result">












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    46


	</iq>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    47














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    48


# Juliet connects












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    49


Juliet connects












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    50














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    51


Juliet sends:












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    52


	<presence/>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    53














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    54


Juliet receives:












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    55


	<presence/>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    56














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    57














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    58


# Romeo invites Juliet to join the room












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    59














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    60


Romeo sends:












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    61


	<message to="room@conference.localhost" id="invite1">












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    62


		<x xmlns="http://jabber.org/protocol/muc#user">












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    63


			<invite to="${Juliet's JID}" />












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    64


		</x>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    65


	</message>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    66














c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    67


Juliet receives:












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    68


	<message from="room@conference.localhost" id="invite1">












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    69


		<x xmlns="http://jabber.org/protocol/muc#user">












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    70


			<invite from="room@conference.localhost/Romeo">












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    71


				<reason/>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    72


			</invite>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    73


		</x>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    74


		<body>room@conference.localhost/Romeo invited you to the room room@conference.localhost</body>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    75


		<x xmlns="jabber:x:conference" jid="room@conference.localhost"/>












c5267f5fd6e6
spec/scansion: Add scansion scripts used for testing



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    76


	</message>














prosody