mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-04 21:57:45 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_websocket: Verify that the client-sent Origin header matches cross_domain_websocket (fixes #652)

Browse source
This commit is contained in:
Kim Alvefur 2016-12-05 12:22:41 +01:00
parent 1ec77e632e
commit bcf02d74c7
1 changed files with 13 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
plugins/mod_websocket.lua
View file

@ -29,16 +29,16 @@ local t_concat = table.concat;
local stream_close_timeout = module:get_option_number("c2s_close_timeout", 5);
local consider_websocket_secure = module:get_option_boolean("consider_websocket_secure");
local cross_domain = module:get_option("cross_domain_websocket");
if cross_domain then
local cross_domain = module:get_option_set("cross_domain_websocket", {});
if cross_domain:contains("*") or cross_domain:contains(true) then
cross_domain = true;
end
local function check_origin(origin)
if cross_domain == true then
cross_domain = "*";
elseif type(cross_domain) == "table" then
cross_domain = t_concat(cross_domain, ", ");
end
if type(cross_domain) ~= "string" then
cross_domain = nil;
return true;
end
return cross_domain:contains(origin);
end
local xmlns_framing = "urn:ietf:params:xml:ns:xmpp-framing";
@ -150,6 +150,11 @@ function handle_request(event)
return 501;
end
if not check_origin(request.headers.origin or "") then
module:log("debug", "Origin %s is not allowed by 'cross_domain_websocket'", request.headers.origin or "(missing header)");
return 403;
end
local function websocket_close(code, message)
conn:write(build_close(code, message));
conn:close();
@ -284,7 +289,6 @@ function handle_request(event)
response.headers.connection = "Upgrade";
response.headers.sec_webSocket_accept = base64(sha1(request.headers.sec_websocket_key .. "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"));
response.headers.sec_webSocket_protocol = "xmpp";
response.headers.access_control_allow_origin = cross_domain;
session.log("debug", "Sending WebSocket handshake");