This patch validates room name which was received via eventsource HTTP request using nodeprep. If the received node is not correct XMPP address it replies '400'.
Sorry, forgot the attachment. -- You received this message because you are subscribed to the Google Groups "prosody-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/prosody-dev. For more options, visit https://groups.google.com/d/optout.
# HG changeset patch # User Senya <[email protected]> # Date 1519412008 -7200 # Fri Feb 23 20:53:28 2018 +0200 # Node ID d8056f80db4d97de6c58d358a646c194a0c0ca80 # Parent 5ba6fc4c7791fd8f642b56107daa4eb9582fd4f6 mod_muc_eventsource: validate node with nodeprep diff -r 5ba6fc4c7791 -r d8056f80db4d mod_muc_eventsource/mod_muc_eventsource.lua --- a/mod_muc_eventsource/mod_muc_eventsource.lua Tue Feb 20 21:34:01 2018 +0200 +++ b/mod_muc_eventsource/mod_muc_eventsource.lua Fri Feb 23 20:53:28 2018 +0200 @@ -1,4 +1,5 @@ module:depends("http"); +local nodeprep = require "util.encodings".stringprep.nodeprep; local jid_split = require "util.jid".split; local json = require "util.json"; @@ -44,9 +45,15 @@ end function serve_stream(event, node) + local response = event.response; + + node = nodeprep(node); + if node == nil then + return 400; + end + module:log("debug", "Client subscribed to: %s", node); - local response = event.response; response.on_destroy = client_closed; response._eventsource_node = node;
signature.asc
Description: OpenPGP digital signature
