projects
/
citadel.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
358d851
)
Guard against 'billion laughs' attack in our XMPP service
author
Art Cancro
<ajc@uncensored.citadel.org>
Tue, 3 May 2011 17:04:29 +0000
(13:04 -0400)
committer
Wilfried Goesgens
<dothebart@citadel.org>
Sun, 4 Sep 2011 20:14:00 +0000
(20:14 +0000)
citadel/modules/xmpp/serv_xmpp.c
patch
|
blob
|
history
diff --git
a/citadel/modules/xmpp/serv_xmpp.c
b/citadel/modules/xmpp/serv_xmpp.c
index 94d35b1d0f33ffd759456ce4394103d913fadcbf..795112b1c50e16835e428234223049dc1c95aefd 100644
(file)
--- a/
citadel/modules/xmpp/serv_xmpp.c
+++ b/
citadel/modules/xmpp/serv_xmpp.c
@@
-1,8
+1,8
@@
/*
* XMPP (Jabber) service for the Citadel system
/*
* XMPP (Jabber) service for the Citadel system
- * Copyright (c) 2007-201
0
by Art Cancro
+ * Copyright (c) 2007-201
1
by Art Cancro
*
*
- * This program is
fre
e software; you can redistribute it and/or modify
+ * This program is
open sourc
e software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
@@
-57,8
+57,30
@@
#include "ctdl_module.h"
#include "serv_xmpp.h"
#include "ctdl_module.h"
#include "serv_xmpp.h"
+#if XML_MAJOR_VERSION > 0
+/* XML_StopParser is present in expat 2.x */
+#define HAVE_XML_STOPPARSER
+#endif
+
struct xmpp_event *xmpp_queue = NULL;
struct xmpp_event *xmpp_queue = NULL;
+
+
+#ifdef HAVE_XML_STOPPARSER
+/* Stop the parser if an entity declaration is hit. */
+static void xmpp_entity_declaration(void *userData, const XML_Char *entityName,
+ int is_parameter_entity, const XML_Char *value,
+ int value_length, const XML_Char *base,
+ const XML_Char *systemId, const XML_Char *publicId,
+ const XML_Char *notationName
+) {
+ syslog(LOG_WARNING, "Illegal entity declaration encountered; stopping parser.");
+ XML_StopParser(XMPP->xp, XML_FALSE);
+}
+#endif
+
+
+
/*
* Given a source string and a target buffer, returns the string
* properly escaped for insertion into an XML stream. Returns a
/*
* Given a source string and a target buffer, returns the string
* properly escaped for insertion into an XML stream. Returns a
@@
-532,6
+554,17
@@
void xmpp_greeting(void) {
XML_SetCharacterDataHandler(XMPP->xp, xmpp_xml_chardata);
// XML_SetUserData(XMPP->xp, something...);
XML_SetCharacterDataHandler(XMPP->xp, xmpp_xml_chardata);
// XML_SetUserData(XMPP->xp, something...);
+ /* Prevent the "billion laughs" attack against expat by disabling
+ * internal entity expansion. With 2.x, forcibly stop the parser
+ * if an entity is declared - this is safer and a more obvious
+ * failure mode. With older versions, simply prevent expansion
+ * of such entities. */
+#ifdef HAVE_XML_STOPPARSER
+ XML_SetEntityDeclHandler(XMPP->xp, xmpp_entity_declaration);
+#else
+ XML_SetDefaultHandler(XMPP->xp, NULL);
+#endif
+
CC->can_receive_im = 1; /* This protocol is capable of receiving instant messages */
}
CC->can_receive_im = 1; /* This protocol is capable of receiving instant messages */
}