aboutsummaryrefslogtreecommitdiffstats
path: root/util/xml.lua
Commit message (Collapse)AuthorAgeFilesLines
* util: Prefix module imports with prosody namespaceKim Alvefur2023-03-171-1/+1
|
* util.xml: Add an option to allow <?processing instructions?>Kim Alvefur2022-02-041-1/+4
| | | | | These should generally be safe to just ignore, which should be the default behavior of Expat and LuaExpat
* Merge 0.11->trunkKim Alvefur2022-01-201-13/+5
|\
| * util.xml: Deduplicate handlers for restricted XML0.11.13Kim Alvefur2022-01-201-12/+5
| | | | | | | | | | Makes the code more like util.xmppstream, allowing easier comparisons if we ever need to apply fixes in the future.
| * util.xml: Break reference to help the GC (fix #1711)Kim Alvefur2022-01-201-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | LuaExpat uses a registry reference to track handlers, which makes it so that an upvalue like this creates a reference loop that keeps the parser and its handlers from being garbage collected. The same issue has affected util.xmppstream in the past. Code for checking: local xml_parse = require"util.xml".parse; for i = 1, 10000 do xml_parse("<root/>") end collectgarbage(); collectgarbage(); print(collectgarbage("count"), "KiB"); A future release of LuaExpat may fix the underlying issue there.
| * util.xml: Do not allow doctypes, comments or processing instructions0.11.12Jonas Schäfer2022-01-101-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
* | util.xml: Do not allow doctypes, comments or processing instructionsJonas Schäfer2022-01-101-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
* | util.xml: Use variable instead of constant for consistency (thanks Thijs)Matthew Wild2021-12-261-1/+1
| |
* | util.xml: Fix float formatting of line and columns in error (on Lua 5.3+)Kim Alvefur2020-10-031-1/+1
|/
* vairious: Add annotation when an empty environment is set [luacheck]Kim Alvefur2018-02-281-0/+1
|
* util.xml: Correct stanza.namespaces table construction when duplicate prefix ↵Waqas Hussain2016-03-051-5/+11
| | | | names are encountered in the element tree.
* util.stanza, util.xml, util.xmppstream: Add support for tracking defined ↵Matthew Wild2015-12-081-1/+16
| | | | namespaces and their prefix (stanza.namespaces), knowing/preserving prefix names is required for some applications (thanks daurnimator)
* util.*: Remove use of module() function, make all module functions local and ↵Kim Alvefur2015-02-211-3/+4
| | | | return them in a table at the end
* util.xml: Remove unused parameter (thanks, luacheck)Matthew Wild2015-05-061-1/+1
|
* portmanager, s2smanager, sessionmanager, stanza_router, storagemanager, ↵Matthew Wild2015-05-061-0/+1
| | | | usermanager, util.xml: Add luacheck annotations
* Remove all trailing whitespaceFlorian Zeitz2013-08-091-2/+2
|
* util.xml: Fix module name.Waqas Hussain2012-12-031-1/+1
|
* util.xml: Initial commit; exposes parse(), which is now the canonical way to ↵Waqas Hussain2012-12-031-0/+57
convert a string to a stanza.