Mercurial Mercurial > prosody > prosody / annotate
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | file | latest | revisions | annotate | diff | comparison | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
spec/utf8_sequences.txt
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 8239 4878e4159e12
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
8239
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
     1
 
Should pass: 41 42 43               # Simple ASCII - abc
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
     2
 
Should pass: 41 42 c3 87            # "ABÇ"
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
     3
 
Should pass: 41 42 e1 b8 88         # "ABḈ"
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
     4
 
Should pass: 41 42 f0 9d 9c 8d      # "AB𝜍"
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
     5
 
Should pass: F4 8F BF BF            # Last valid sequence (U+10FFFF)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
     6
 
Should fail: F4 90 80 80            # First invalid sequence (U+110000)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
     7
 
Should fail: 80 81 82 83            # Invalid sequence (invalid start byte)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
     8
 
Should fail: C2 C3                  # Invalid sequence (invalid continuation byte)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
     9
 
Should fail: C0 43                  # Overlong sequence
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    10
 
Should fail: F5 80 80 80            # U+140000 (out of range)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    11
 
Should fail: ED A0 80               # U+D800 (forbidden by RFC 3629)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    12
 
Should fail: ED BF BF               # U+DFFF (forbidden by RFC 3629)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    13
 
Should pass: ED 9F BF               # U+D7FF (U+D800 minus 1: allowed)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    14
 
Should pass: EE 80 80               # U+E000 (U+D7FF plus 1: allowed)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    15
 
Should fail: C0                     # Invalid start byte
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    16
 
Should fail: C1                     # Invalid start byte
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    17
 
Should fail: C2                     # Incomplete sequence
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    18
 
Should fail: F8 88 80 80 80         # 6-byte sequence
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    19
 
Should pass: 7F                     # Last valid 1-byte sequence (U+00007F)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    20
 
Should pass: DF BF                  # Last valid 2-byte sequence (U+0007FF)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    21
 
Should pass: EF BF BF               # Last valid 3-byte sequence (U+00FFFF)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    22
 
Should pass: 00                     # First valid 1-byte sequence (U+000000)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    23
 
Should pass: C2 80                  # First valid 2-byte sequence (U+000080)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    24
 
Should pass: E0 A0 80               # First valid 3-byte sequence (U+000800)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    25
 
Should pass: F0 90 80 80            # First valid 4-byte sequence (U+000800)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    26
 
Should fail: F8 88 80 80 80         # First 5-byte sequence - invalid per RFC 3629
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    27
 
Should fail: FC 84 80 80 80 80      # First 6-byte sequence - invalid per RFC 3629
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    28
 
Should pass: EF BF BD               # U+00FFFD (replacement character)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    29
 
Should fail: 80                     # First continuation byte
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    30
 
Should fail: BF                     # Last continuation byte
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    31
 
Should fail: 80 BF                  # 2 continuation bytes
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    32
 
Should fail: 80 BF 80               # 3 continuation bytes
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    33
 
Should fail: 80 BF 80 BF            # 4 continuation bytes
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    34
 
Should fail: 80 BF 80 BF 80         # 5 continuation bytes
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    35
 
Should fail: 80 BF 80 BF 80 BF      # 6 continuation bytes
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    36
 
Should fail: 80 BF 80 BF 80 BF 80   # 7 continuation bytes
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    37
 
Should fail: FE                     # Impossible byte
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    38
 
Should fail: FF                     # Impossible byte
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    39
 
Should fail: FE FE FF FF            # Impossible bytes
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    40
 
Should fail: C0 AF                  # Overlong "/"
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    41
 
Should fail: E0 80 AF               # Overlong "/"
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    42
 
Should fail: F0 80 80 AF            # Overlong "/"
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    43
 
Should fail: F8 80 80 80 AF         # Overlong "/"
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    44
 
Should fail: FC 80 80 80 80 AF      # Overlong "/"
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    45
 
Should fail: C0 80 AF               # Overlong "/" (invalid)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    46
 
Should fail: C1 BF                  # Overlong
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    47
 
Should fail: E0 9F BF               # Overlong
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    48
 
Should fail: F0 8F BF BF            # Overlong
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    49
 
Should fail: F8 87 BF BF BF         # Overlong
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    50
 
Should fail: FC 83 BF BF BF BF      # Overlong
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    51
 
Should pass: EF BF BE               # U+FFFE (invalid unicode, valid UTF-8)
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset 
    52
 
Should pass: EF BF BF               # U+FFFF (invalid unicode, valid UTF-8)
prosody