Skip to content

Commit d5b4d67

Browse files
author
Christophe Romain
committed
Fix Denial of Service when user sends malformed publish stanza (thanks to Oleg Smirnov) (EJAB-1498)
1 parent 9f4ae07 commit d5b4d67

File tree

3 files changed

+31
-27
lines changed

3 files changed

+31
-27
lines changed

‎src/mod_pubsub/mod_pubsub.erl

+4-2
Original file line numberDiff line numberDiff line change
@@ -2108,8 +2108,10 @@ publish_item(Host, ServerHost, Node, Publisher, ItemId, Payload) ->
21082108
case lists:member("auto-create", features(Type)) of
21092109
true ->
21102110
case create_node(Host, ServerHost, Node, Publisher, Type) of
2111-
{result, _} ->
2112-
publish_item(Host, ServerHost, Node, Publisher, ItemId, Payload);
2111+
{result, [{xmlelement, "pubsub", [{"xmlns", ?NS_PUBSUB}],
2112+
[{xmlelement, "create", [{"node", NewNode}], []}]}]} ->
2113+
publish_item(Host, ServerHost, list_to_binary(NewNode),
2114+
Publisher, ItemId, Payload);
21132115
_ ->
21142116
{error, ?ERR_ITEM_NOT_FOUND}
21152117
end;

‎src/mod_pubsub/mod_pubsub_odbc.erl

+4-2
Original file line numberDiff line numberDiff line change
@@ -1921,8 +1921,10 @@ publish_item(Host, ServerHost, Node, Publisher, ItemId, Payload) ->
19211921
case lists:member("auto-create", features(Type)) of
19221922
true ->
19231923
case create_node(Host, ServerHost, Node, Publisher, Type) of
1924-
{result, _} ->
1925-
publish_item(Host, ServerHost, Node, Publisher, ItemId, Payload);
1924+
{result, [{xmlelement, "pubsub", [{"xmlns", ?NS_PUBSUB}],
1925+
[{xmlelement, "create", [{"node", NewNode}], []}]}]} ->
1926+
publish_item(Host, ServerHost, list_to_binary(NewNode),
1927+
Publisher, ItemId, Payload);
19261928
_ ->
19271929
{error, ?ERR_ITEM_NOT_FOUND}
19281930
end;

‎src/mod_pubsub/pubsub_odbc.patch

+23-23
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
--- mod_pubsub.erl 2011-08-31 16:08:42.000000000 +0200
2-
+++ mod_pubsub_odbc.erl 2011-08-31 16:08:42.000000000 +0200
1+
--- mod_pubsub.erl 2011-09-21 14:37:16.000000000 +0200
2+
+++ mod_pubsub_odbc.erl 2011-09-21 14:37:36.000000000 +0200
33
@@ -42,7 +42,7 @@
44
%%% 6.2.3.1, 6.2.3.5, and 6.3. For information on subscription leases see
55
%%% XEP-0060 section 12.18.
@@ -554,7 +554,7 @@
554554
case Result of
555555
default -> {result, Reply};
556556
_ -> {result, Result}
557-
@@ -2241,7 +2054,7 @@
557+
@@ -2243,7 +2056,7 @@
558558
%% <p>The permission are not checked in this function.</p>
559559
%% @todo We probably need to check that the user doing the query has the right
560560
%% to read the items.
@@ -563,7 +563,7 @@
563563
MaxItems =
564564
if
565565
SMaxItems == "" -> get_max_items_node(Host);
566-
@@ -2255,12 +2068,13 @@
566+
@@ -2257,12 +2070,13 @@
567567
{error, Error} ->
568568
{error, Error};
569569
_ ->
@@ -578,7 +578,7 @@
578578
{PresenceSubscription, RosterGroup} = get_presence_and_roster_permissions(Host, From, Owners, AccessModel, AllowedGroups),
579579
if
580580
not RetreiveFeature ->
581-
@@ -2273,11 +2087,11 @@
581+
@@ -2275,11 +2089,11 @@
582582
node_call(Type, get_items,
583583
[NodeId, From,
584584
AccessModel, PresenceSubscription, RosterGroup,
@@ -592,7 +592,7 @@
592592
SendItems = case ItemIDs of
593593
[] ->
594594
Items;
595-
@@ -2290,7 +2104,8 @@
595+
@@ -2292,7 +2106,8 @@
596596
%% number of items sent to MaxItems:
597597
{result, [{xmlelement, "pubsub", [{"xmlns", ?NS_PUBSUB}],
598598
[{xmlelement, "items", nodeAttr(Node),
@@ -602,7 +602,7 @@
602602
Error ->
603603
Error
604604
end
605-
@@ -2312,10 +2127,15 @@
605+
@@ -2314,10 +2129,15 @@
606606
Error -> Error
607607
end.
608608
get_allowed_items_call(Host, NodeIdx, From, Type, Options, Owners) ->
@@ -619,7 +619,7 @@
619619

620620

621621
%% @spec (Host, Node, NodeId, Type, LJID, Number) -> any()
622-
@@ -2327,31 +2147,29 @@
622+
@@ -2329,31 +2149,29 @@
623623
%% Number = last | integer()
624624
%% @doc <p>Resend the items of a node to the user.</p>
625625
%% @todo use cache-last-item feature
@@ -670,7 +670,7 @@
670670
ToSend = case node_action(Host, Type, get_items, [NodeId, LJID]) of
671671
{result, []} ->
672672
[];
673-
@@ -2374,20 +2192,7 @@
673+
@@ -2376,20 +2194,7 @@
674674
[{xmlelement, "items", nodeAttr(Node),
675675
itemsEls(ToSend)}])
676676
end,
@@ -692,7 +692,7 @@
692692

693693
%% @spec (Host, JID, Plugins) -> {error, Reason} | {result, Response}
694694
%% Host = host()
695-
@@ -2489,7 +2294,8 @@
695+
@@ -2491,7 +2296,8 @@
696696
error ->
697697
{error, ?ERR_BAD_REQUEST};
698698
_ ->
@@ -702,7 +702,7 @@
702702
case lists:member(Owner, Owners) of
703703
true ->
704704
OwnerJID = jlib:make_jid(Owner),
705-
@@ -2499,24 +2305,7 @@
705+
@@ -2501,24 +2307,7 @@
706706
end,
707707
lists:foreach(
708708
fun({JID, Affiliation}) ->
@@ -728,7 +728,7 @@
728728
end, FilteredEntities),
729729
{result, []};
730730
_ ->
731-
@@ -2569,11 +2358,11 @@
731+
@@ -2571,11 +2360,11 @@
732732
end.
733733

734734
read_sub(Subscriber, Node, NodeID, SubID, Lang) ->
@@ -742,7 +742,7 @@
742742
OptionsEl = {xmlelement, "options", [{"jid", jlib:jid_to_string(Subscriber)},
743743
{"subid", SubID}|nodeAttr(Node)],
744744
[XdataEl]},
745-
@@ -2599,7 +2388,7 @@
745+
@@ -2601,7 +2390,7 @@
746746
end.
747747

748748
set_options_helper(Configuration, JID, NodeID, SubID, Type) ->
@@ -751,7 +751,7 @@
751751
{result, GoodSubOpts} -> GoodSubOpts;
752752
_ -> invalid
753753
end,
754-
@@ -2628,7 +2417,7 @@
754+
@@ -2630,7 +2419,7 @@
755755
write_sub(_Subscriber, _NodeID, _SubID, invalid) ->
756756
{error, extended_error(?ERR_BAD_REQUEST, "invalid-options")};
757757
write_sub(Subscriber, NodeID, SubID, Options) ->
@@ -760,7 +760,7 @@
760760
{error, notfound} ->
761761
{error, extended_error(?ERR_NOT_ACCEPTABLE, "invalid-subid")};
762762
{result, _} ->
763-
@@ -2796,8 +2585,8 @@
763+
@@ -2798,8 +2587,8 @@
764764
{"subscription", subscription_to_string(Sub)} | nodeAttr(Node)], []}]}]},
765765
ejabberd_router:route(service_jid(Host), jlib:make_jid(JID), Stanza)
766766
end,
@@ -771,7 +771,7 @@
771771
true ->
772772
Result = lists:foldl(fun({JID, Subscription, SubId}, Acc) ->
773773

774-
@@ -3152,7 +2941,7 @@
774+
@@ -3154,7 +2943,7 @@
775775
{Depth, [{N, get_node_subs(N)} || N <- Nodes]}
776776
end, tree_call(Host, get_parentnodes_tree, [Host, Node, service_jid(Host)]))}
777777
end,
@@ -780,7 +780,7 @@
780780
{result, CollSubs} -> CollSubs;
781781
_ -> []
782782
end.
783-
@@ -3166,9 +2955,9 @@
783+
@@ -3168,9 +2957,9 @@
784784

785785
get_options_for_subs(NodeID, Subs) ->
786786
lists:foldl(fun({JID, subscribed, SubID}, Acc) ->
@@ -792,7 +792,7 @@
792792
_ -> Acc
793793
end;
794794
(_, Acc) ->
795-
@@ -3357,6 +3146,30 @@
795+
@@ -3359,6 +3148,30 @@
796796
Result
797797
end.
798798

@@ -823,7 +823,7 @@
823823
%% @spec (Host, Options) -> MaxItems
824824
%% Host = host()
825825
%% Options = [Option]
826-
@@ -3753,7 +3566,13 @@
826+
@@ -3755,7 +3568,13 @@
827827
tree_action(Host, Function, Args) ->
828828
?DEBUG("tree_action ~p ~p ~p",[Host,Function,Args]),
829829
Fun = fun() -> tree_call(Host, Function, Args) end,
@@ -838,7 +838,7 @@
838838

839839
%% @doc <p>node plugin call.</p>
840840
node_call(Type, Function, Args) ->
841-
@@ -3773,13 +3592,13 @@
841+
@@ -3775,13 +3594,13 @@
842842

843843
node_action(Host, Type, Function, Args) ->
844844
?DEBUG("node_action ~p ~p ~p ~p",[Host,Type,Function,Args]),
@@ -854,7 +854,7 @@
854854
case tree_call(Host, get_node, [Host, Node]) of
855855
N when is_record(N, pubsub_node) ->
856856
case Action(N) of
857-
@@ -3791,13 +3610,19 @@
857+
@@ -3793,13 +3612,19 @@
858858
Error
859859
end
860860
end, Trans).
@@ -878,7 +878,7 @@
878878
{result, Result} -> {result, Result};
879879
{error, Error} -> {error, Error};
880880
{atomic, {result, Result}} -> {result, Result};
881-
@@ -3805,6 +3630,15 @@
881+
@@ -3807,6 +3632,15 @@
882882
{aborted, Reason} ->
883883
?ERROR_MSG("transaction return internal error: ~p~n", [{aborted, Reason}]),
884884
{error, ?ERR_INTERNAL_SERVER_ERROR};
@@ -894,7 +894,7 @@
894894
{'EXIT', Reason} ->
895895
?ERROR_MSG("transaction return internal error: ~p~n", [{'EXIT', Reason}]),
896896
{error, ?ERR_INTERNAL_SERVER_ERROR};
897-
@@ -3813,6 +3647,17 @@
897+
@@ -3815,6 +3649,17 @@
898898
{error, ?ERR_INTERNAL_SERVER_ERROR}
899899
end.
900900

0 commit comments

Comments
 (0)