horazont / aioxmpp
98%
devel: 98%

LAST BUILD BRANCH: feature/rpc
DEFAULT BRANCH: devel
Repo Added
Files 128
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH feature/fix-guard
branch: feature/fix-guard
CHANGE BRANCH
x

1424

push

travis-ci

horazont 
xso: fix parser error handling

guard() was incorrectly counting the depth when either of the
following was true:

- the error occured inside the first "start" event on which guard()
  is used: in that case, guard() would fail to swallow the
  corresponding "end" event.

- after an error, further elements appear in the stream before the
  guard()-ed element is over. in that case, guard() would fail to
  account for the "start" events caused by those events, and thus
  let its depth counter go entirely out-of-sync with the XML tree

If this flaw is combined with the use of a supressing
xso_error_handler, it is possible to make elements appear higher
up in the XML stream tree than they actually are; this implies
that it is possible to inject elements in the XML stream.

It requires very specific circumstances for an application to be
vulnerable. Example of a vulnerable XSO definition is:

class Baz(aioxmpp.xso.XSO):
    TAG = ("https://xmlns.zombofant.net/aioxmpp/test", "baz")

class Bar(aioxmpp.xso.XSO):
    TAG = ("https://xmlns.zombofant.net/aioxmpp/test", "bar")

    validated = aioxmpp.xso.Attr(
        "foo",
        type_=aioxmpp.xso.JID()
    )

    children = aioxmpp.xso.ChildList([Baz])

@aioxmpp.IQ.as_payload_class
class Foo(aioxmpp.xso.XSO):
    TAG = ("https://xmlns.zombofant.net/aioxmpp/test", "foo")

    child = aioxmpp.xso.Child([Bar])

    def xso_error_handler(self, descriptor, ev_args, exc_info):
        return True

If an attacker sends:

    <iq ... type='result'><foo xmlns='https://xmlns.zombofant.net/aioxmpp/test'><bar foo='&quot;@bar'><baz/><baz/><baz/></bar></foo></iq>

to an application, it will see the "end" event of the </iq> *on the
stream level*, breaking the XML stream (because it expects a
"start" event instead of an "end" event).

More sophisticated attacks could be used to make an element appear
on the stream level instead, which would open the possibility of
injecting, for example, <message> stanzas remotely into the s... (continued)

12474 of 12739 relevant lines covered (97.92%)

0.98 hits per line

Relevant lines Covered
12739 RELEVANT LINES 12474 COVERED LINES
0.98 HITS PER LINE
Source Files on feature/fix-guard
Coverage ∆ File Lines Relevant Covered Missed Hits/Line

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
1424 feature/fix-guard xso: fix parser error handling guard() was incorrectly counting the depth when either of the following was true: - the error occured inside the first "start" event on which guard() is used: in that case, guard() would fail to swallow the cor... push horazont travis-ci pending completion  
1393 feature/fix-guard xso: fix parser error handling guard() was incorrectly counting the depth when either of the following was true: - the error occured inside the first "start" event on which guard() is used: in that case, guard() would fail to swallow the cor... Pull #268 web-flow travis-ci pending completion  
1392 feature/fix-guard xso: fix parser error handling guard() was incorrectly counting the depth when either of the following was true: - the error occured inside the first "start" event on which guard() is used: in that case, guard() would fail to swallow the cor... push horazont travis-ci pending completion  
See All Builds (1763)