Mercurial > prosody-hg

comparison plugins/mod_component.lua @ 12686:5f182bccf33f

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_component: Require 'from' attribute on stanzas by default The old behaviour of falling back to the component domain when it is missing has been merged into the logic for the existing "validate_from_addresses" option (which is strict by default). ejabberd already rejects component stanzas with no 'from' (as the XEP requires), and this has led to compatibility issues for components that were seemingly working fine with Prosody.
author Matthew Wild <mwild1@gmail.com>
date Sun, 28 Aug 2022 07:51:50 +0100
parents ae093c259da2
children 74b9e05af71e
comparison
equal deleted inserted replaced
12685:4d75663d1552 12686:5f182bccf33f
15 15
16 local logger = require "util.logger"; 16 local logger = require "util.logger";
17 local sha1 = require "util.hashes".sha1; 17 local sha1 = require "util.hashes".sha1;
18 local st = require "util.stanza"; 18 local st = require "util.stanza";
19 19
20 local jid_split = require "util.jid".split; 20 local jid_host = require "util.jid".host;
21 local new_xmpp_stream = require "util.xmppstream".new; 21 local new_xmpp_stream = require "util.xmppstream".new;
22 local uuid_gen = require "util.uuid".generate; 22 local uuid_gen = require "util.uuid".generate;
23 23
24 local core_process_stanza = prosody.core_process_stanza; 24 local core_process_stanza = prosody.core_process_stanza;
25 local hosts = prosody.hosts; 25 local hosts = prosody.hosts;
220 if not stanza.attr.xmlns and stanza.name == "handshake" then 220 if not stanza.attr.xmlns and stanza.name == "handshake" then
221 stanza.attr.xmlns = xmlns_component; 221 stanza.attr.xmlns = xmlns_component;
222 end 222 end
223 if not stanza.attr.xmlns or stanza.attr.xmlns == "jabber:client" then 223 if not stanza.attr.xmlns or stanza.attr.xmlns == "jabber:client" then
224 local from = stanza.attr.from; 224 local from = stanza.attr.from;
225 if from then 225 if session.component_validate_from then
226 if session.component_validate_from then 226 if not from or (jid_host(from) ~= session.host) then
227 local _, domain = jid_split(stanza.attr.from); 227 -- Return error
228 if domain ~= session.host then 228 session.log("warn", "Component sent stanza with missing or invalid 'from' address");
229 -- Return error 229 session:close{
230 session.log("warn", "Component sent stanza with missing or invalid 'from' address"); 230 condition = "invalid-from";
231 session:close{ 231 text = "Component tried to send from address <"..(from or "< [missing 'from' attribute] >")
232 condition = "invalid-from"; 232 .."> which is not in domain <"..tostring(session.host)..">";
233 text = "Component tried to send from address <"..tostring(from) 233 };
234 .."> which is not in domain <"..tostring(session.host)..">"; 234 return;
235 }; 235 end
236 return; 236 elseif not from then
237 end 237 stanza.attr.from = session.host;
238 end
239 else
240 stanza.attr.from = session.host; -- COMPAT: Strictly we shouldn't allow this
241 end 238 end
242 if not stanza.attr.to then 239 if not stanza.attr.to then
243 session.log("warn", "Rejecting stanza with no 'to' address"); 240 session.log("warn", "Rejecting stanza with no 'to' address");
244 session.send(st.error_reply(stanza, "modify", "bad-request", "Components MUST specify a 'to' address on stanzas")); 241 session.send(st.error_reply(stanza, "modify", "bad-request", "Components MUST specify a 'to' address on stanzas"));
245 return; 242 return;