Mercurial > prosody-hg

annotate util-src/compat.c @ 12181:783056b4e448 0.11 0.11.12

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parents cfc7b2f7251e
children a187600ec7d6
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
9561
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2 #include <lua.h>
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 #include <lauxlib.h>
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 static int lc_xpcall (lua_State *L) {
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 int ret;
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8 int n_arg = lua_gettop(L);
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 /* f, msgh, p1, p2... */
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 luaL_argcheck(L, n_arg >= 2, 2, "value expected");
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 lua_pushvalue(L, 1); /* f to top */
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 lua_pushvalue(L, 2); /* msgh to top */
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13 lua_replace(L, 1); /* msgh to 1 */
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 lua_replace(L, 2); /* f to 2 */
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 /* msgh, f, p1, p2... */
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 ret = lua_pcall(L, n_arg - 2, LUA_MULTRET, 1);
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 lua_pushboolean(L, ret == 0);
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 lua_replace(L, 1);
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 return lua_gettop(L);
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 }
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22 int luaopen_util_compat(lua_State *L) {
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 lua_createtable(L, 0, 2);
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 {
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 lua_pushcfunction(L, lc_xpcall);
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26 lua_setfield(L, -2, "xpcall");
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 }
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28 return 1;
cfc7b2f7251e util.xpcall, util.compat: Add non-hacky multi-argument xpcall() for Lua 5.1
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 }