# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1642672306 -3600
# Node ID ebeb4d959fb3fdbc9235fd42e16a33f3f78241a8
# Parent  e5e0ab93d7f462f45e6fd0bfe19f5787a3a3f5e4
util.xml: Deduplicate handlers for restricted XML

Makes the code more like util.xmppstream, allowing easier comparisons if
we ever need to apply fixes in the future.

diff -r e5e0ab93d7f4 -r ebeb4d959fb3 util/xml.lua
--- a/util/xml.lua	Thu Jan 20 09:57:20 2022 +0100
+++ b/util/xml.lua	Thu Jan 20 10:51:46 2022 +0100
@@ -66,23 +66,16 @@
 			stanza:up();
 		end
 		-- SECURITY: These two handlers, especially the Doctype one, are required to prevent exploits such as Billion Laughs.
-		function handler:StartDoctypeDecl()
-			if not self.stop or not self:stop() then
+		local function restricted_handler(parser)
+			if not parser.stop or not parser:stop() then
 				error("Failed to abort parsing");
 			end
 		end
-		function handler:ProcessingInstruction()
-			if not self.stop or not self:stop() then
-				error("Failed to abort parsing");
-			end
-		end
+		handler.StartDoctypeDecl = restricted_handler;
+		handler.ProcessingInstruction = restricted_handler;
 		if not options or not options.allow_comments then
 			-- NOTE: comments are generally harmless and can be useful when parsing configuration files or other data, even user-provided data
-			function handler:Comment()
-				if not self.stop or not self:stop() then
-					error("Failed to abort parsing");
-				end
-			end
+			handler.Comment = restricted_handler;
 		end
 		local parser = lxp.new(handler, ns_separator);
 		local ok, err, line, col = parser:parse(xml);