+-- Prosody IM
+-- Copyright (C) 2008-2010 Matthew Wild
+-- Copyright (C) 2008-2010 Waqas Hussain
+--
+-- This project is MIT/X11 licensed. Please see the
+-- COPYING file in the source package for more information.
+--
+
+
require "util.stanza"
local tostring = tostring;
local pairs = pairs;
local ipairs = ipairs;
-local type = type;
-local print = print;
-local format = string.format;
-local m_random = math.random;
local t_insert = table.insert;
-local t_remove = table.remove;
local t_concat = table.concat;
-local t_concatall = function (t, sep) local tt = {}; for _, s in ipairs(t) do t_insert(tt, tostring(s)); end return t_concat(tt, sep); end
-local sm_destroy_session = import("core.sessionmanager", "destroy_session");
local default_log = require "util.logger".init("xmlhandlers");
+-- COMPAT: w/LuaExpat 1.1.0
+local lxp_supports_doctype = pcall(lxp.new, { StartDoctypeDecl = false });
+
+if not lxp_supports_doctype then
+ default_log("warn", "The version of LuaExpat on your system leaves Prosody "
+ .."vulnerable to denial-of-service attacks. You should upgrade to "
+ .."LuaExpat 1.1.1 or higher as soon as possible. See "
+ .."http://prosody.im/doc/depends#luaexpat for more information.");
+end
+
local error = error;
module "xmlhandlers"
["http://www.w3.org/XML/1998/namespace"] = "xml";
}
-function init_xmlhandlers(session, streamopened)
+function init_xmlhandlers(session, stream_callbacks)
local ns_stack = { "" };
- local curr_ns = "";
local curr_tag;
local chardata = {};
local xml_handlers = {};
local log = session.log or default_log;
- --local print = function (...) log("info", "xmlhandlers", t_concatall({...}, "\t")); end
- local send = session.send;
+ local cb_streamopened = stream_callbacks.streamopened;
+ local cb_streamclosed = stream_callbacks.streamclosed;
+ local cb_error = stream_callbacks.error or function (session, e) error("XML stream error: "..tostring(e)); end;
+ local cb_handlestanza = stream_callbacks.handlestanza;
+
+ local stream_tag = stream_callbacks.stream_tag;
+ local stream_default_ns = stream_callbacks.default_ns;
local stanza
- function xml_handlers:StartElement(name, attr)
+ function xml_handlers:StartElement(tagname, attr)
if stanza and #chardata > 0 then
-- We have some character data in the buffer
stanza:text(t_concat(chardata));
chardata = {};
end
- curr_ns,name = name:match("^(.+)|([%w%-]+)$");
- if curr_ns ~= "jabber:server" then
+ local curr_ns,name = tagname:match("^([^\1]*)\1?(.*)$");
+ if name == "" then
+ curr_ns, name = "", curr_ns;
+ end
+
+ if curr_ns ~= stream_default_ns then
attr.xmlns = curr_ns;
end
-- FIXME !!!!!
- for i, k in ipairs(attr) do
- if type(k) == "string" then
- local ns, nm = k:match("^([^|]+)|?([^|]-)$")
- if ns and nm then
- ns = ns_prefixes[ns];
- if ns then
- attr[ns..":"..nm] = attr[k];
- attr[i] = ns..":"..nm;
- attr[k] = nil;
- end
+ for i=1,#attr do
+ local k = attr[i];
+ attr[i] = nil;
+ local ns, nm = k:match("^([^\1]*)\1?(.*)$");
+ if nm ~= "" then
+ ns = ns_prefixes[ns];
+ if ns then
+ attr[ns..":"..nm] = attr[k];
+ attr[k] = nil;
end
end
end
if not stanza then --if we are not currently inside a stanza
if session.notopen then
- if name == "stream" then
- streamopened(session, attr);
- return;
+ if tagname == stream_tag then
+ if cb_streamopened then
+ cb_streamopened(session, attr);
+ end
+ else
+ -- Garbage before stream?
+ cb_error(session, "no-stream");
end
- error("Client failed to open stream successfully");
+ return;
end
if curr_ns == "jabber:client" and name ~= "iq" and name ~= "presence" and name ~= "message" then
- error("Client sent invalid top-level stanza");
+ cb_error(session, "invalid-top-level-element");
end
- stanza = st.stanza(name, attr); --{ to = attr.to, type = attr.type, id = attr.id, xmlns = curr_ns });
+ stanza = st.stanza(name, attr);
curr_tag = stanza;
else -- we are inside a stanza, so add a tag
attr.xmlns = nil;
- if curr_ns ~= "jabber:server" and curr_ns ~= "jabber:client" then
+ if curr_ns ~= stream_default_ns then
attr.xmlns = curr_ns;
end
stanza:tag(name, attr);
t_insert(chardata, data);
end
end
- function xml_handlers:EndElement(name)
- curr_ns,name = name:match("^(.+)|([%w%-]+)$");
- if (not stanza) or #stanza.last_add < 0 or (#stanza.last_add > 0 and name ~= stanza.last_add[#stanza.last_add].name) then
- if name == "stream" then
- log("debug", "Stream closed");
- sm_destroy_session(session);
- return;
+ function xml_handlers:EndElement(tagname)
+ local curr_ns,name = tagname:match("^([^\1]*)\1?(.*)$");
+ if name == "" then
+ curr_ns, name = "", curr_ns;
+ end
+ if (not stanza) or (#stanza.last_add > 0 and name ~= stanza.last_add[#stanza.last_add].name) then
+ if tagname == stream_tag then
+ if cb_streamclosed then
+ cb_streamclosed(session);
+ end
elseif name == "error" then
- error("Stream error: "..tostring(name)..": "..tostring(stanza));
+ cb_error(session, "stream-error", stanza);
else
- error("XML parse error in client stream");
+ cb_error(session, "parse-error", "unexpected-element-close", name);
end
+ stanza, chardata = nil, {};
+ return;
end
- if stanza and #chardata > 0 then
+ if #chardata > 0 then
-- We have some character data in the buffer
stanza:text(t_concat(chardata));
chardata = {};
end
-- Complete stanza
if #stanza.last_add == 0 then
- session.stanza_dispatch(stanza);
+ cb_handlestanza(session, stanza);
stanza = nil;
else
stanza:up();
end
end
+
+ local function restricted_handler()
+ cb_error(session, "parse-error", "restricted-xml", "Restricted XML, see RFC 6120 section 11.1.");
+ end
+
+ if lxp_supports_doctype then
+ xml_handlers.StartDoctypeDecl = restricted_handler;
+ end
+ xml_handlers.Comment = restricted_handler;
+ xml_handlers.ProcessingInstruction = restricted_handler;
+
return xml_handlers;
end
projects / prosody.git / blobdiff