diff options
| author | Kim Alvefur <zash@zash.se> | 2021-08-29 23:26:19 +0200 |
|---|---|---|
| committer | Kim Alvefur <zash@zash.se> | 2021-08-29 23:26:19 +0200 |
| commit | d915f98800f1740242a56b0c29b129a686fe1c9d (patch) | |
| tree | 8750b06162997804d57d87624d8927db5b93e5e9 | |
| parent | 4ddf47aaf0ec7783cb69475000c8f09dd651d678 (diff) | |
| download | prosody-d915f98800f1740242a56b0c29b129a686fe1c9d.tar.gz prosody-d915f98800f1740242a56b0c29b129a686fe1c9d.zip | |
mod_external_services: Validate required attributes on credentials requests
| -rw-r--r-- | plugins/mod_external_services.lua | 7 | ||||
| -rw-r--r-- | spec/scansion/extdisco.scs | 14 |
2 files changed, 20 insertions, 1 deletions
diff --git a/plugins/mod_external_services.lua b/plugins/mod_external_services.lua index 1a6c80bd..6fafdb1f 100644 --- a/plugins/mod_external_services.lua +++ b/plugins/mod_external_services.lua @@ -175,7 +175,7 @@ local function handle_credentials(event) local action = stanza.tags[1]; if origin.type ~= "c2s" then - origin.send(st.error_reply(stanza, "auth", "forbidden")); + origin.send(st.error_reply(stanza, "auth", "forbidden", "The 'port' and 'type' attributes are required.")); return true; end @@ -188,6 +188,11 @@ local function handle_credentials(event) local requested_credentials = {}; for service in action:childtags("service") do + if not service.attr.type or not service.attr.host then + origin.send(st.error_reply(stanza, "modify", "bad-request")); + return true; + end + table.insert(requested_credentials, { type = service.attr.type; host = service.attr.host; diff --git a/spec/scansion/extdisco.scs b/spec/scansion/extdisco.scs index fd73c9da..f0781dc5 100644 --- a/spec/scansion/extdisco.scs +++ b/spec/scansion/extdisco.scs @@ -52,6 +52,20 @@ Romeo receives: </credentials> </iq> +Romeo sends: + <iq type='get' xml:lang='sv' id='lx5' to='localhost'> + <credentials xmlns='urn:xmpp:extdisco:2'> + <service host='default.example' /> + </credentials> + </iq> + +Romeo receives: + <iq type='error' id='lx5' from='localhost'> + <error type='modify'> + <bad-request xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/> + </error> + </iq> + Romeo disconnects # recording ended on 2020-07-18T16:47:57Z |