From d6d9e5913958390a91bdd5f4c137027020c42322 Mon Sep 17 00:00:00 2001
From: Matthew Wild <mwild1@gmail.com>
Date: Sun, 30 Mar 2014 09:15:28 +0100
Subject: util.dependencies: Log error when LuaExpat is not capable of
enforcing stanza size limits
---
util/dependencies.lua | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/util/dependencies.lua b/util/dependencies.lua
index 53d2719d..e55b2405 100644
--- a/util/dependencies.lua
+++ b/util/dependencies.lua
@@ -140,7 +140,15 @@ function log_warnings()
if not pcall(lxp.new, { StartDoctypeDecl = false }) then
log("error", "The version of LuaExpat on your system leaves Prosody "
.."vulnerable to denial-of-service attacks. You should upgrade to "
- .."LuaExpat 1.1.1 or higher as soon as possible. See "
+ .."LuaExpat 1.3.0 or higher as soon as possible. See "
+ .."http://prosody.im/doc/depends#luaexpat for more information.");
+ end
+ if not lxp.new({}).getcurrentbytecount then
+ log("error", "The version of LuaExpat on your system does not support "
+ .."stanza size limits, which may leave servers on untrusted "
+ .."networks (e.g. the internet) vulnerable to denial-of-service "
+ .."attacks. You should upgrade to LuaExpat 1.3.0 or higher as "
+ .."soon as possible. See "
.."http://prosody.im/doc/depends#luaexpat for more information.");
end
end
--
cgit v1.2.3