prosody-hg: util-src/table.c annotate

annotate util-src/table.c @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.

author	Jonas Schäfer <jonas@wielicki.name>
date	Mon, 10 Jan 2022 18:23:54 +0100
parents	1c6a07606309
children	8deb401a21f6

rev	line source
6610 7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	1 #include <lua.h>
7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	2 #include <lauxlib.h>
7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	3
7889 b8d694646597 util-src/.c: Attach pointer to name instead of type Kim Alvefur <zash@zash.se> parents: 7835 diff changeset	4 static int Lcreate_table(lua_State *L) {
6610 7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	5 lua_createtable(L, luaL_checkinteger(L, 1), luaL_checkinteger(L, 2));
7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	6 return 1;
7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	7 }
7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	8
7889 b8d694646597 util-src/.c: Attach pointer to name instead of type Kim Alvefur <zash@zash.se> parents: 7835 diff changeset	9 static int Lpack(lua_State *L) {
7519 d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	10 unsigned int n_args = lua_gettop(L);
d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	11 lua_createtable(L, n_args, 1);
d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	12 lua_insert(L, 1);
7889 b8d694646597 util-src/.c: Attach pointer to name instead of type Kim Alvefur <zash@zash.se> parents: 7835 diff changeset	13
7936 582bfb39337f Backed out changeset a3a4ed0d34f4 C99 is ok Kim Alvefur <zash@zash.se> parents: 7889 diff changeset	14 for(int arg = n_args; arg >= 1; arg--) {
7519 d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	15 lua_rawseti(L, 1, arg);
d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	16 }
7889 b8d694646597 util-src/.c: Attach pointer to name instead of type Kim Alvefur <zash@zash.se> parents: 7835 diff changeset	17
7519 d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	18 lua_pushinteger(L, n_args);
d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	19 lua_setfield(L, -2, "n");
d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	20 return 1;
d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	21 }
d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	22
7889 b8d694646597 util-src/.c: Attach pointer to name instead of type Kim Alvefur <zash@zash.se> parents: 7835 diff changeset	23 int luaopen_util_table(lua_State *L) {
7818 54669df178c2 util-src: Make C modules assert that the Lua runtime matches what it was compiled for Kim Alvefur <zash@zash.se> parents: 7538 diff changeset	24 #if (LUA_VERSION_NUM > 501)
54669df178c2 util-src: Make C modules assert that the Lua runtime matches what it was compiled for Kim Alvefur <zash@zash.se> parents: 7538 diff changeset	25 luaL_checkversion(L);
54669df178c2 util-src: Make C modules assert that the Lua runtime matches what it was compiled for Kim Alvefur <zash@zash.se> parents: 7538 diff changeset	26 #endif
7969 1c6a07606309 util-src: Specify size of various tables to be allocated Kim Alvefur <zash@zash.se> parents: 7936 diff changeset	27 lua_createtable(L, 0, 2);
6610 7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	28 lua_pushcfunction(L, Lcreate_table);
7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	29 lua_setfield(L, -2, "create");
7519 d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	30 lua_pushcfunction(L, Lpack);
d278a770eddc util.table: Add pack() function (this is already available in Lua 5.2+) Matthew Wild <mwild1@gmail.com> parents: 6615 diff changeset	31 lua_setfield(L, -2, "pack");
6610 7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	32 return 1;
7c4cf87f4dff util.table, Makefile: New C module that allows pre-allocation of tables to improve performance and decrease memory fragmentation Matthew Wild <mwild1@gmail.com> parents: diff changeset	33 }

Mercurial > prosody-hg

annotate util-src/table.c @ 12181:783056b4e448 0.11 0.11.12