mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-03 21:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

util.stanza: Reject ASCII control characters (fixes #1606)

Browse source
This commit is contained in:
Kim Alvefur 2020-11-11 16:00:41 +01:00
parent 63f44f3640
commit 8328e6681e
2 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
spec/util_stanza_spec.lua
View file

@ -200,6 +200,7 @@ describe("util.stanza", function()
["number"] = 1234, ["table"] = {};
["utf8"] = string.char(0xF4, 0x90, 0x80, 0x80);
["nil"] = "nil"; ["boolean"] = true;
["control characters"] = "\0\1\2\3";
};
for value_type, value in pairs(invalid_names) do

10
util/stanza.lua
View file

@ -45,6 +45,10 @@ local _ENV = nil;
local stanza_mt = { __name = "stanza" };
stanza_mt.__index = stanza_mt;
local function valid_xml_cdata(str, attr)
return not s_find(str, attr and "[^\1\9\10\13\20-~\128-\247]" or "[^\9\10\13\20-~\128-\247]");
end
local function check_name(name, name_type)
if type(name) ~= "string" then
error("invalid "..name_type.." name: expected string, got "..type(name));
@ -52,6 +56,8 @@ local function check_name(name, name_type)
error("invalid "..name_type.." name: empty string");
elseif s_find(name, "[<>& '\"]") then
error("invalid "..name_type.." name: contains invalid characters");
elseif not valid_xml_cdata(name, name_type == "attribute") then
error("invalid "..name_type.." name: contains control characters");
elseif not valid_utf8(name) then
error("invalid "..name_type.." name: contains invalid utf8");
end
@ -60,7 +66,9 @@ end
local function check_text(text, text_type)
if type(text) ~= "string" then
error("invalid "..text_type.." value: expected string, got "..type(text));
elseif not valid_utf8(text) then
elseif not valid_xml_cdata(text) then
error("invalid "..text_type.." value: contains control characters");
elseif not valid_utf8(text, false) then
error("invalid "..text_type.." value: contains invalid utf8");
end
end