aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKim Alvefur <zash@zash.se>2022-01-20 10:51:46 +0100
committerKim Alvefur <zash@zash.se>2022-01-20 10:51:46 +0100
commit785d3273084026d308cfa92edf8832e24ec4193e (patch)
treed305b9cce72a4350fcb292e39947a385ecf67535
parentd17619344dda05f9bc9b3f98a0c82f2f68939605 (diff)
downloadprosody-0.11.13.tar.gz
prosody-0.11.13.zip
util.xml: Deduplicate handlers for restricted XML0.11.13
Makes the code more like util.xmppstream, allowing easier comparisons if we ever need to apply fixes in the future.
-rw-r--r--util/xml.lua17
1 files changed, 5 insertions, 12 deletions
diff --git a/util/xml.lua b/util/xml.lua
index 72f1a26b..4327dfba 100644
--- a/util/xml.lua
+++ b/util/xml.lua
@@ -66,23 +66,16 @@ local parse_xml = (function()
stanza:up();
end
-- SECURITY: These two handlers, especially the Doctype one, are required to prevent exploits such as Billion Laughs.
- function handler:StartDoctypeDecl()
- if not self.stop or not self:stop() then
- error("Failed to abort parsing");
- end
- end
- function handler:ProcessingInstruction()
- if not self.stop or not self:stop() then
+ local function restricted_handler(parser)
+ if not parser.stop or not parser:stop() then
error("Failed to abort parsing");
end
end
+ handler.StartDoctypeDecl = restricted_handler;
+ handler.ProcessingInstruction = restricted_handler;
if not options or not options.allow_comments then
-- NOTE: comments are generally harmless and can be useful when parsing configuration files or other data, even user-provided data
- function handler:Comment()
- if not self.stop or not self:stop() then
- error("Failed to abort parsing");
- end
- end
+ handler.Comment = restricted_handler;
end
local parser = lxp.new(handler, ns_separator);
local ok, err, line, col = parser:parse(xml);