Mercurial > prosody-hg

changeset 14132:1e005ba71f0d 13.0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_c2s, mod_s2s: Add configurable limit for stanza max child elements
author Matthew Wild <mwild1@gmail.com>
date Thu, 16 Apr 2026 18:53:34 +0100
parents 6c7549964d4d
children 4087c5b600b1
files plugins/mod_c2s.lua plugins/mod_s2s.lua
diffstat 2 files changed, 8 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/plugins/mod_c2s.lua	Thu Apr 16 18:52:58 2026 +0100
+++ b/plugins/mod_c2s.lua	Thu Apr 16 18:53:34 2026 +0100
@@ -30,6 +30,7 @@
 local opt_keepalives = module:get_option_boolean("c2s_tcp_keepalives", module:get_option_boolean("tcp_keepalives", true));
 local unauthed_stanza_size_limit = module:get_option_integer("c2s_unauthed_stanza_size_limit", 10000,1000);
 local authed_stanza_size_limit = module:get_option_integer("c2s_stanza_size_limit", 1024*256,10000);
+local max_child_elements = module:get_option_integer("c2s_max_child_elements", 25000, 0);
 
 local advertised_idle_timeout = 14*60; -- default in all net.server implementations
 local network_settings = module:get_option("network_settings");
@@ -355,7 +356,9 @@
 
 	session.stanza_size_limit = unauthed_stanza_size_limit;
 
-	local stream = new_xmpp_stream(session, stream_callbacks, session.stanza_size_limit);
+	local stream = new_xmpp_stream(session, stream_callbacks, session.stanza_size_limit, {
+		max_elements = max_child_elements;
+	});
 	session.stream = stream;
 	session.notopen = true;
 
--- a/plugins/mod_s2s.lua	Thu Apr 16 18:52:58 2026 +0100
+++ b/plugins/mod_s2s.lua	Thu Apr 16 18:53:34 2026 +0100
@@ -43,6 +43,7 @@
 local require_encryption = module:get_option_boolean("s2s_require_encryption", true);
 local unauthed_stanza_size_limit = module:get_option_integer("s2s_unauthed_stanza_size_limit", 10000, 1000);
 local authed_stanza_size_limit = module:get_option_integer("s2s_stanza_size_limit", 1024*512, 10000);
+local max_child_elements = module:get_option_integer("s2s_max_child_elements", 25000, 0);
 local sendq_size = module:get_option_integer("s2s_send_queue_size", 1024*32, 1);
 
 local advertised_idle_timeout = 14*60; -- default in all net.server implementations
@@ -801,7 +802,9 @@
 
 -- Session initialization logic shared by incoming and outgoing
 local function initialize_session(session)
-	local stream = new_xmpp_stream(session, stream_callbacks, session.stanza_size_limit or unauthed_stanza_size_limit);
+	local stream = new_xmpp_stream(session, stream_callbacks, session.stanza_size_limit, {
+		max_elements = max_child_elements;
+	});
 
 	session.thread = runner(function (item)
 		if st.is_stanza(item) then