spec/scansion/muc_members_only_deregister.scs
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 9718 34c48eed4650
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
9718
34c48eed4650 spec/scansion: Fix test names of tests added in 0d97768b0ea9
Matthew Wild <mwild1@gmail.com>
parents: 9716
diff changeset
     1
# MUC: Members-only rooms kick members who deregister
9716
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     2
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     3
[Client] Romeo
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     4
	jid: user@localhost
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     5
	password: password
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     6
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     7
[Client] Juliet
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     8
	jid: user2@localhost
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     9
	password: password
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    10
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    11
-----
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    12
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    13
Romeo connects
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    14
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    15
Romeo sends:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    16
	<presence to="room@conference.localhost/Romeo">
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    17
		<x xmlns="http://jabber.org/protocol/muc"/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    18
	</presence>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    19
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    20
Romeo receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    21
	<presence from='room@conference.localhost/Romeo'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    22
		<x xmlns='http://jabber.org/protocol/muc#user'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    23
			<status code='201'/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    24
			<item jid="${Romeo's full JID}" affiliation='owner' role='moderator'/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    25
			<status code='110'/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    26
		</x>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    27
	</presence>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    28
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    29
Romeo receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    30
	<message type='groupchat' from='room@conference.localhost'><subject/></message>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    31
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    32
# Submit config form, set the room to members-only
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    33
Romeo sends:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    34
	<iq id='config1' to='room@conference.localhost' type='set'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    35
		<query xmlns='http://jabber.org/protocol/muc#owner'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    36
			<x xmlns='jabber:x:data' type='submit'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    37
				<field var='FORM_TYPE'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    38
					<value>http://jabber.org/protocol/muc#roomconfig</value>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    39
				</field>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    40
				<field var='muc#roomconfig_membersonly'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    41
					<value>1</value>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    42
				</field>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    43
			</x>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    44
		</query>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    45
	</iq>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    46
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    47
Romeo receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    48
	<iq id="config1" from="room@conference.localhost" type="result">
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    49
	</iq>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    50
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    51
# Romeo adds Juliet to the member list
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    52
Romeo sends:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    53
	<iq id='member1' to='room@conference.localhost' type='set'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    54
		<query xmlns='http://jabber.org/protocol/muc#admin'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    55
			<item affiliation='member' jid="${Juliet's JID}" />
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    56
		</query>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    57
	</iq>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    58
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    59
Romeo receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    60
	<message from='room@conference.localhost'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    61
		<x xmlns='http://jabber.org/protocol/muc#user'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    62
			<item jid="${Juliet's JID}" affiliation='member' />
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    63
		</x>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    64
	</message>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    65
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    66
Romeo receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    67
	<iq from='room@conference.localhost' id='member1' type='result'/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    68
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    69
# Juliet connects, and joins the room
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    70
Juliet connects
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    71
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    72
Juliet sends:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    73
	<presence to="room@conference.localhost/Juliet">
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    74
		<x xmlns="http://jabber.org/protocol/muc"/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    75
	</presence>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    76
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    77
Juliet receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    78
	<presence from="room@conference.localhost/Romeo" />
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    79
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    80
Juliet receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    81
	<presence from="room@conference.localhost/Juliet" />
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    82
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    83
Juliet receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    84
	<message type='groupchat' from='room@conference.localhost'><subject/></message>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    85
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    86
Romeo receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    87
	<presence from="room@conference.localhost/Juliet" />
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    88
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    89
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    90
# Tired of Romeo's company, Juliet unregisters from the room
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    91
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    92
Juliet sends:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    93
	<iq type='set' to='room@conference.localhost' id='unreg1'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    94
		<query xmlns='jabber:iq:register'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    95
			<remove/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    96
		</query>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    97
	</iq>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    98
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    99
Juliet receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   100
	<presence type='unavailable' from='room@conference.localhost/Juliet'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   101
		<x xmlns='http://jabber.org/protocol/muc#user'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   102
			<status code='321'/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   103
			<item affiliation='none' role='none' jid="${Juliet's full JID}" />
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   104
			<status code='110'/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   105
		  </x>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   106
	</presence>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   107
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   108
Juliet receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   109
	<iq type='result' from='room@conference.localhost' id='unreg1'/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   110
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   111
Romeo receives:
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   112
	<presence type='unavailable' from='room@conference.localhost/Juliet'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   113
		<x xmlns='http://jabber.org/protocol/muc#user'>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   114
			<status code='321'/>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   115
			<item affiliation='none' role='none' jid="${Juliet's full JID}" />
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   116
		  </x>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   117
	</presence>
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   118
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   119
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   120
Romeo disconnects
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   121
0d97768b0ea9 spec/scansion: Add tests for members-only rooms
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
   122
Juliet disconnects