util/filters.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 8558 4f0f5b49bb03
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     1
-- Prosody IM
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3943
diff changeset
     4
--
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     6
-- COPYING file in the source package for more information.
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     7
--
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     8
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     9
local t_insert, t_remove = table.insert, table.remove;
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    10
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    11
local _ENV = nil;
8558
4f0f5b49bb03 vairious: Add annotation when an empty environment is set [luacheck]
Kim Alvefur <zash@zash.se>
parents: 6780
diff changeset
    12
-- luacheck: std none
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    13
3625
f8d61da5bcc1 util.filters: Support for 'filter hooks' that get called when a session is initialized for filters
Matthew Wild <mwild1@gmail.com>
parents: 3331
diff changeset
    14
local new_filter_hooks = {};
f8d61da5bcc1 util.filters: Support for 'filter hooks' that get called when a session is initialized for filters
Matthew Wild <mwild1@gmail.com>
parents: 3331
diff changeset
    15
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    16
local function initialize(session)
3142
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    17
	if not session.filters then
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    18
		local filters = {};
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    19
		session.filters = filters;
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3943
diff changeset
    20
3142
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    21
		function session.filter(type, data)
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    22
			local filter_list = filters[type];
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    23
			if filter_list then
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    24
				for i = 1, #filter_list do
3625
f8d61da5bcc1 util.filters: Support for 'filter hooks' that get called when a session is initialized for filters
Matthew Wild <mwild1@gmail.com>
parents: 3331
diff changeset
    25
					data = filter_list[i](data, session);
3142
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    26
					if data == nil then break; end
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    27
				end
3139
7b4f180d7c6f util.filters: Don't traceback with no filters of a type added
Matthew Wild <mwild1@gmail.com>
parents: 3135
diff changeset
    28
			end
3142
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    29
			return data;
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    30
		end
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    31
	end
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3943
diff changeset
    32
3625
f8d61da5bcc1 util.filters: Support for 'filter hooks' that get called when a session is initialized for filters
Matthew Wild <mwild1@gmail.com>
parents: 3331
diff changeset
    33
	for i=1,#new_filter_hooks do
f8d61da5bcc1 util.filters: Support for 'filter hooks' that get called when a session is initialized for filters
Matthew Wild <mwild1@gmail.com>
parents: 3331
diff changeset
    34
		new_filter_hooks[i](session);
f8d61da5bcc1 util.filters: Support for 'filter hooks' that get called when a session is initialized for filters
Matthew Wild <mwild1@gmail.com>
parents: 3331
diff changeset
    35
	end
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3943
diff changeset
    36
3142
3cf02e5e632b util.filters: Ensure initialize() never initializes an object twice - and return the filter function to the caller
Matthew Wild <mwild1@gmail.com>
parents: 3140
diff changeset
    37
	return session.filter;
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    38
end
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    39
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    40
local function add_filter(session, type, callback, priority)
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    41
	if not session.filters then
3134
9a29ad6a9b97 util.filters: Expose the initialization function
Matthew Wild <mwild1@gmail.com>
parents: 3133
diff changeset
    42
		initialize(session);
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    43
	end
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3943
diff changeset
    44
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    45
	local filter_list = session.filters[type];
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    46
	if not filter_list then
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    47
		filter_list = {};
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    48
		session.filters[type] = filter_list;
6366
8dee696c33cc util.filters: Ignore filters being added twice (fixes issues on removal)
Matthew Wild <mwild1@gmail.com>
parents: 5849
diff changeset
    49
	elseif filter_list[callback] then
8dee696c33cc util.filters: Ignore filters being added twice (fixes issues on removal)
Matthew Wild <mwild1@gmail.com>
parents: 5849
diff changeset
    50
		return; -- Filter already added
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    51
	end
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3943
diff changeset
    52
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    53
	priority = priority or 0;
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3943
diff changeset
    54
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    55
	local i = 0;
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    56
	repeat
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    57
		i = i + 1;
5849
8f451d370dd4 util.filters: Fix inserting items so that higher priority filters run first
Kim Alvefur <zash@zash.se>
parents: 3943
diff changeset
    58
	until not filter_list[i] or filter_list[filter_list[i]] < priority;
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 3943
diff changeset
    59
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    60
	t_insert(filter_list, i, callback);
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    61
	filter_list[callback] = priority;
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    62
end
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    63
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    64
local function remove_filter(session, type, callback)
3135
f29a297471e3 util.filters: Don't traceback when trying to remove a filter from an uninitialized object
Matthew Wild <mwild1@gmail.com>
parents: 3134
diff changeset
    65
	if not session.filters then return; end
3133
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    66
	local filter_list = session.filters[type];
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    67
	if filter_list and filter_list[callback] then
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    68
		for i=1, #filter_list do
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    69
			if filter_list[i] == callback then
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    70
				t_remove(filter_list, i);
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    71
				filter_list[callback] = nil;
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    72
				return true;
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    73
			end
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    74
		end
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    75
	end
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    76
end
d3f16b4c1ecb util.filters: New utility library for managing filters on an object
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    77
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    78
local function add_filter_hook(callback)
3625
f8d61da5bcc1 util.filters: Support for 'filter hooks' that get called when a session is initialized for filters
Matthew Wild <mwild1@gmail.com>
parents: 3331
diff changeset
    79
	t_insert(new_filter_hooks, callback);
f8d61da5bcc1 util.filters: Support for 'filter hooks' that get called when a session is initialized for filters
Matthew Wild <mwild1@gmail.com>
parents: 3331
diff changeset
    80
end
f8d61da5bcc1 util.filters: Support for 'filter hooks' that get called when a session is initialized for filters
Matthew Wild <mwild1@gmail.com>
parents: 3331
diff changeset
    81
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    82
local function remove_filter_hook(callback)
3943
ad5924c31953 util.filters: Add remove_filter_hook()
Matthew Wild <mwild1@gmail.com>
parents: 3625
diff changeset
    83
	for i=1,#new_filter_hooks do
ad5924c31953 util.filters: Add remove_filter_hook()
Matthew Wild <mwild1@gmail.com>
parents: 3625
diff changeset
    84
		if new_filter_hooks[i] == callback then
ad5924c31953 util.filters: Add remove_filter_hook()
Matthew Wild <mwild1@gmail.com>
parents: 3625
diff changeset
    85
			t_remove(new_filter_hooks, i);
ad5924c31953 util.filters: Add remove_filter_hook()
Matthew Wild <mwild1@gmail.com>
parents: 3625
diff changeset
    86
		end
ad5924c31953 util.filters: Add remove_filter_hook()
Matthew Wild <mwild1@gmail.com>
parents: 3625
diff changeset
    87
	end
ad5924c31953 util.filters: Add remove_filter_hook()
Matthew Wild <mwild1@gmail.com>
parents: 3625
diff changeset
    88
end
ad5924c31953 util.filters: Add remove_filter_hook()
Matthew Wild <mwild1@gmail.com>
parents: 3625
diff changeset
    89
6780
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    90
return {
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    91
	initialize = initialize;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    92
	add_filter = add_filter;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    93
	remove_filter = remove_filter;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    94
	add_filter_hook = add_filter_hook;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    95
	remove_filter_hook = remove_filter_hook;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
    96
};