Skip to content

Commit d3c4eab

Browse files
author
Christophe Romain
committed
Fix Denial of Service when user sends malformed publish stanza (thanks to Oleg Smirnov) (EJAB-1498)
1 parent 1c62edc commit d3c4eab

File tree

3 files changed

+39
-33
lines changed

3 files changed

+39
-33
lines changed

‎src/mod_pubsub/mod_pubsub.erl

+5-2
Original file line numberDiff line numberDiff line change
@@ -2509,8 +2509,11 @@ publish_item(Host, ServerHost, Node, Publisher, ItemId, Payload) ->
25092509
case lists:member("auto-create", features(Type)) of
25102510
true ->
25112511
case create_node(Host, ServerHost, Node, Publisher, Type) of
2512-
{result, _} ->
2513-
publish_item(Host, ServerHost, Node, Publisher, ItemId, Payload);
2512+
{result, Reply2} ->
2513+
NewNode = exmpp_xml:get_path(Reply2, [{element, 'create'},
2514+
{attribute, <<"node">>}]),
2515+
publish_item(Host, ServerHost, NewNode, Publisher, ItemId,
2516+
Payload);
25142517
_ ->
25152518
{error, 'item-not-found'}
25162519
end;

‎src/mod_pubsub/mod_pubsub_odbc.erl

+5-2
Original file line numberDiff line numberDiff line change
@@ -2301,8 +2301,11 @@ publish_item(Host, ServerHost, Node, Publisher, ItemId, Payload) ->
23012301
case lists:member("auto-create", features(Type)) of
23022302
true ->
23032303
case create_node(Host, ServerHost, Node, Publisher, Type) of
2304-
{result, _} ->
2305-
publish_item(Host, ServerHost, Node, Publisher, ItemId, Payload);
2304+
{result, Reply2} ->
2305+
NewNode = exmpp_xml:get_path(Reply2, [{element, 'create'},
2306+
{attribute, <<"node">>}]),
2307+
publish_item(Host, ServerHost, NewNode, Publisher, ItemId,
2308+
Payload);
23062309
_ ->
23072310
{error, 'item-not-found'}
23082311
end;

‎src/mod_pubsub/pubsub_odbc.patch

+29-29
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
--- mod_pubsub.erl 2011-08-31 16:42:23.000000000 +0200
2-
+++ mod_pubsub_odbc.erl 2011-08-31 16:42:23.000000000 +0200
1+
--- mod_pubsub.erl 2011-09-21 14:40:16.000000000 +0200
2+
+++ mod_pubsub_odbc.erl 2011-09-21 14:40:29.000000000 +0200
33
@@ -42,7 +42,7 @@
44
%%% 6.2.3.1, 6.2.3.5, and 6.3. For information on subscription leases see
55
%%% XEP-0060 section 12.18.
@@ -621,7 +621,7 @@
621621
{PayloadCount, PayloadNS} = payload_els_ns(Payload),
622622
PayloadSize = size(term_to_binary(Payload))-2, % size(term_to_binary([])) == 2
623623
PayloadMaxSize = get_option(Options, max_payload_size),
624-
@@ -2642,7 +2434,7 @@
624+
@@ -2645,7 +2437,7 @@
625625
%% <p>The permission are not checked in this function.</p>
626626
%% @todo We probably need to check that the user doing the query has the right
627627
%% to read the items.
@@ -630,7 +630,7 @@
630630
MaxItems =
631631
if
632632
SMaxItems == "" -> get_max_items_node(Host);
633-
@@ -2656,12 +2448,13 @@
633+
@@ -2659,12 +2451,13 @@
634634
{error, Error} ->
635635
{error, Error};
636636
_ ->
@@ -645,7 +645,7 @@
645645
{PresenceSubscription, RosterGroup} = get_presence_and_roster_permissions(Host, From, Owners, AccessModel, AllowedGroups),
646646
if
647647
not RetreiveFeature ->
648-
@@ -2674,11 +2467,11 @@
648+
@@ -2677,11 +2470,11 @@
649649
node_call(Type, get_items,
650650
[Nidx, From,
651651
AccessModel, PresenceSubscription, RosterGroup,
@@ -659,7 +659,7 @@
659659
SendItems = case ItemIds of
660660
[] ->
661661
Items;
662-
@@ -2691,7 +2484,7 @@
662+
@@ -2694,7 +2487,7 @@
663663
%% number of items sent to MaxItems:
664664
{result, #xmlel{ns = ?NS_PUBSUB, name = 'pubsub', children =
665665
[#xmlel{ns = ?NS_PUBSUB, name = 'items', attrs = nodeAttr(Node), children =
@@ -668,7 +668,7 @@
668668
Error ->
669669
Error
670670
end
671-
@@ -2707,8 +2500,8 @@
671+
@@ -2710,8 +2503,8 @@
672672
).
673673

674674
get_items(Host, NodeId) ->
@@ -679,7 +679,7 @@
679679
end,
680680
case transaction(Host, NodeId, Action, sync_dirty) of
681681
{result, {_, Items}} -> Items
682-
@@ -2725,13 +2518,24 @@
682+
@@ -2728,13 +2521,24 @@
683683
).
684684

685685
get_item(Host, NodeId, ItemId) ->
@@ -706,7 +706,7 @@
706706

707707
%% @spec (Host, Node, NodeId, Type, LJID, Number) -> any()
708708
%% Host = pubsubHost()
709-
@@ -2742,32 +2546,32 @@
709+
@@ -2745,32 +2549,32 @@
710710
%% Number = last | integer()
711711
%% @doc <p>Resend the items of a node to the user.</p>
712712
%% @todo use cache-last-item feature
@@ -761,7 +761,7 @@
761761
{result, []} ->
762762
[];
763763
{result, Items} ->
764-
@@ -2789,20 +2593,7 @@
764+
@@ -2792,20 +2596,7 @@
765765
[#xmlel{ns = ?NS_PUBSUB_EVENT, name = 'items', attrs = nodeAttr(Node), children =
766766
itemsEls(ToSend)}])
767767
end,
@@ -783,7 +783,7 @@
783783

784784
%% @spec (Host, JID, Plugins) -> {error, Reason} | {result, Response}
785785
%% Host = host()
786-
@@ -2905,7 +2696,8 @@
786+
@@ -2908,7 +2699,8 @@
787787
error ->
788788
{error, 'bad-request'};
789789
_ ->
@@ -793,7 +793,7 @@
793793
case lists:member(Owner, Owners) of
794794
true ->
795795
OwnerJID = exmpp_jid:make(Owner),
796-
@@ -2915,24 +2707,8 @@
796+
@@ -2918,24 +2710,8 @@
797797
end,
798798
lists:foreach(
799799
fun({JID, Affiliation}) ->
@@ -820,7 +820,7 @@
820820
end, FilteredEntities),
821821
{result, []};
822822
_ ->
823-
@@ -2961,7 +2737,7 @@
823+
@@ -2964,7 +2740,7 @@
824824
Error -> Error
825825
end.
826826

@@ -829,7 +829,7 @@
829829
Subscriber = try exmpp_jid:parse(JID) of
830830
J -> jlib:short_jid(J)
831831
catch
832-
@@ -2969,7 +2745,7 @@
832+
@@ -2972,7 +2748,7 @@
833833
exmpp_jid:make("", "", "") %% TODO, check if use <<>> instead of ""
834834
end,
835835
{result, Subs} = node_call(Type, get_subscriptions,
@@ -838,7 +838,7 @@
838838
SubIds = lists:foldl(fun({subscribed, SID}, Acc) ->
839839
[SID | Acc];
840840
(_, Acc) ->
841-
@@ -2979,17 +2755,17 @@
841+
@@ -2982,17 +2758,17 @@
842842
{_, []} ->
843843
{error, extended_error('not-acceptable', "not-subscribed")};
844844
{[], [SID]} ->
@@ -861,7 +861,7 @@
861861
OptionsEl = #xmlel{ns = ?NS_PUBSUB, name = 'options',
862862
attrs = [ ?XMLATTR(<<"jid">>, exmpp_jid:to_binary(Subscriber)),
863863
?XMLATTR(<<"subid">>, SubId) | nodeAttr(Node)],
864-
@@ -3021,8 +2797,8 @@
864+
@@ -3024,8 +2800,8 @@
865865
Error -> Error
866866
end.
867867

@@ -872,7 +872,7 @@
872872
{result, GoodSubOpts} -> GoodSubOpts;
873873
_ -> invalid
874874
end,
875-
@@ -3032,7 +2808,7 @@
875+
@@ -3035,7 +2811,7 @@
876876
_ -> exmpp_jid:make("", "", "") %% TODO, check if use <<>> instead of ""
877877
end,
878878
{result, Subs} = node_call(Type, get_subscriptions,
@@ -881,7 +881,7 @@
881881
SubIds = lists:foldl(fun({subscribed, SID}, Acc) ->
882882
[SID | Acc];
883883
(_, Acc) ->
884-
@@ -3042,19 +2818,19 @@
884+
@@ -3045,19 +2821,19 @@
885885
{_, []} ->
886886
{error, extended_error('not-acceptable', "not-subscribed")};
887887
{[], [SID]} ->
@@ -907,7 +907,7 @@
907907
{result, _} ->
908908
{result, []};
909909
{error, _} ->
910-
@@ -3228,8 +3004,8 @@
910+
@@ -3231,8 +3007,8 @@
911911
?XMLATTR(<<"subsription">>, subscription_to_string(Sub)) | nodeAttr(Node)]}]}]},
912912
ejabberd_router:route(service_jid(Host), JID, Stanza)
913913
end,
@@ -918,7 +918,7 @@
918918
true ->
919919
Result = lists:foldl(fun({JID, Subscription, SubId}, Acc) ->
920920

921-
@@ -3583,7 +3359,7 @@
921+
@@ -3586,7 +3362,7 @@
922922
Collection = tree_call(Host, get_parentnodes_tree, [Host, Node, service_jid(Host)]),
923923
{result, [{Depth, [{N, sub_with_options(N)} || N <- Nodes]} || {Depth, Nodes} <- Collection]}
924924
end,
@@ -927,7 +927,7 @@
927927
{result, CollSubs} -> subscribed_nodes_by_jid(NotifyType, CollSubs);
928928
_ -> []
929929
end.
930-
@@ -3641,19 +3417,19 @@
930+
@@ -3644,19 +3420,19 @@
931931
{_, JIDSubs} = lists:foldl(DepthsToDeliver, {[], []}, SubsByDepth),
932932
JIDSubs.
933933

@@ -953,7 +953,7 @@
953953
_ -> {JID, SubId, []}
954954
end.
955955

956-
@@ -3765,6 +3541,30 @@
956+
@@ -3768,6 +3544,30 @@
957957
Result
958958
end.
959959

@@ -984,7 +984,7 @@
984984
%% @spec (Host, Options) -> MaxItems
985985
%% Host = host()
986986
%% Options = [Option]
987-
@@ -4288,9 +4088,14 @@
987+
@@ -4291,9 +4091,14 @@
988988

989989
tree_action(Host, Function, Args) ->
990990
?DEBUG("tree_action ~p ~p ~p",[Host,Function,Args]),
@@ -1002,7 +1002,7 @@
10021002

10031003
%% @doc <p>node plugin call.</p>
10041004
-spec(node_call/3 ::
1005-
@@ -4328,7 +4133,7 @@
1005+
@@ -4331,7 +4136,7 @@
10061006

10071007
node_action(Host, Type, Function, Args) ->
10081008
?DEBUG("node_action ~p ~p ~p ~p",[Host,Type,Function,Args]),
@@ -1011,7 +1011,7 @@
10111011
node_call(Type, Function, Args)
10121012
end, sync_dirty).
10131013

1014-
@@ -4343,7 +4148,7 @@
1014+
@@ -4346,7 +4151,7 @@
10151015
).
10161016

10171017
transaction(Host, NodeId, Action, Trans) ->
@@ -1020,7 +1020,7 @@
10201020
case tree_call(Host, get_node, [Host, NodeId]) of
10211021
#pubsub_node{} = Node ->
10221022
case Action(Node) of
1023-
@@ -4357,7 +4162,7 @@
1023+
@@ -4360,7 +4165,7 @@
10241024
end, Trans).
10251025

10261026

@@ -1029,7 +1029,7 @@
10291029
(
10301030
Host :: string() | host(),
10311031
Action :: fun(),
1032-
@@ -4365,21 +4170,28 @@
1032+
@@ -4368,21 +4173,28 @@
10331033
-> {'result', Nodes :: [] | [Node::pubsubNode()]}
10341034
).
10351035

@@ -1063,7 +1063,7 @@
10631063
{result, Result} -> {result, Result};
10641064
{error, Error} -> {error, Error};
10651065
{atomic, {result, Result}} -> {result, Result};
1066-
@@ -4387,6 +4199,15 @@
1066+
@@ -4390,6 +4202,15 @@
10671067
{aborted, Reason} ->
10681068
?ERROR_MSG("transaction return internal error: ~p~n", [{aborted, Reason}]),
10691069
{error, 'internal-server-error'};
@@ -1079,7 +1079,7 @@
10791079
{'EXIT', Reason} ->
10801080
?ERROR_MSG("transaction return internal error: ~p~n", [{'EXIT', Reason}]),
10811081
{error, 'internal-server-error'};
1082-
@@ -4395,6 +4216,16 @@
1082+
@@ -4398,6 +4219,16 @@
10831083
{error, 'internal-server-error'}
10841084
end.
10851085

0 commit comments

Comments
 (0)