util/paths.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 6508 2dc8dbd0940e
child 10201 91085371cfc5
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
6508
2dc8dbd0940e util.paths: Add function for joining path segments
Kim Alvefur <zash@zash.se>
parents: 6164
diff changeset
     1
local t_concat = table.concat;
2dc8dbd0940e util.paths: Add function for joining path segments
Kim Alvefur <zash@zash.se>
parents: 6164
diff changeset
     2
6164
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     3
local path_sep = package.config:sub(1,1);
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     4
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     5
local path_util = {}
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     6
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     7
-- Helper function to resolve relative paths (needed by config)
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     8
function path_util.resolve_relative_path(parent_path, path)
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     9
	if path then
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    10
		-- Some normalization
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    11
		parent_path = parent_path:gsub("%"..path_sep.."+$", "");
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    12
		path = path:gsub("^%.%"..path_sep.."+", "");
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    13
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    14
		local is_relative;
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    15
		if path_sep == "/" and path:sub(1,1) ~= "/" then
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    16
			is_relative = true;
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    17
		elseif path_sep == "\\" and (path:sub(1,1) ~= "/" and (path:sub(2,3) ~= ":\\" and path:sub(2,3) ~= ":/")) then
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    18
			is_relative = true;
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    19
		end
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    20
		if is_relative then
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    21
			return parent_path..path_sep..path;
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    22
		end
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    23
	end
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    24
	return path;
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    25
end
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    26
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    27
-- Helper function to convert a glob to a Lua pattern
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    28
function path_util.glob_to_pattern(glob)
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    29
	return "^"..glob:gsub("[%p*?]", function (c)
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    30
		if c == "*" then
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    31
			return ".*";
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    32
		elseif c == "?" then
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    33
			return ".";
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    34
		else
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    35
			return "%"..c;
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    36
		end
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    37
	end).."$";
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    38
end
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    39
6508
2dc8dbd0940e util.paths: Add function for joining path segments
Kim Alvefur <zash@zash.se>
parents: 6164
diff changeset
    40
function path_util.join(...)
2dc8dbd0940e util.paths: Add function for joining path segments
Kim Alvefur <zash@zash.se>
parents: 6164
diff changeset
    41
	return t_concat({...}, path_sep);
2dc8dbd0940e util.paths: Add function for joining path segments
Kim Alvefur <zash@zash.se>
parents: 6164
diff changeset
    42
end
2dc8dbd0940e util.paths: Add function for joining path segments
Kim Alvefur <zash@zash.se>
parents: 6164
diff changeset
    43
6164
ef4024f6bc40 core.configmanager: Move path utility functions into util.paths
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    44
return path_util;