matty/peertube-plugin-livechat
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Reverting usage of RE2 (WIP):

Browse Source 
**Breaking changes**

The livechat v13 introduced a new library to handle regular expressions in forbidden words, to avoid
[ReDOS](https://en.wikipedia.org/wiki/ReDoS) attacks.
Unfortunately, this library was not able to install itself properly on some systems, and some admins were not able
to install the livechat plugin.

That's why we have disabled this library in v14, and introduce a new settings to enable regexp in forbidden words.
By default this settings is disabled, and your users won't be able to use regexp in their forbidden words.

The risk by enabling this feature is that a malicious user could cause a denial of service for the chat bot, by using a
special crafted regular expression in their channel options, and sending a special crafter message in one of their
rooms. If you trust your users (those who have rights to livestream), you can enable the settings. Otherwise it is not
recommanded. See the documentation for more informations.

**Minor changes and fixes**

* Channel's forbidden words: new "enable" column.
* New settings to enable regular expressions for channel forbidden words.
* "Channel advanced configuration" settings: removing the "experimental feature" label.
This commit is contained in:
John Livingston
2025-06-19 12:07:39 +02:00
parent e41529b61f
commit 3624dd5c3c
65 changed files with 343 additions and 2145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
server/lib/settings.ts
View File

@ -60,7 +60,9 @@ async function initSettings (options: RegisterServerOptions): Promise<void> {
}
loadOidcs() // we don't have to wait (can take time, it will do external http requests)
let currentProsodyRoomtype = (await settingsManager.getSettings(['prosody-room-type']))['prosody-room-type']
const tmpSettings = await settingsManager.getSettings(['prosody-room-type', 'enable-users-regexp'])
let currentProsodyRoomtype = tmpSettings['prosody-room-type']
let currentUsersRegexp = tmpSettings['enable-users-regexp']
// ********** settings changes management
settingsManager.onSettingsChange(async (settings: any) => {
@ -84,8 +86,12 @@ async function initSettings (options: RegisterServerOptions): Promise<void> {
await BotsCtl.singleton().start()
// In case prosody-room-type changed, we must rebuild room-channel links.
if (settings['prosody-room-type'] !== currentProsodyRoomtype) {
peertubeHelpers.logger.info('Setting prosody-room-type has changed value, must rebuild room-channel infos')
// In case enable-users-regexp becomes false, we must rebuild to make sure regexp lines are disabled
if (
settings['prosody-room-type'] !== currentProsodyRoomtype ||
(currentUsersRegexp && !settings['enable-users-regexp'])
) {
peertubeHelpers.logger.info('Settings changed, must rebuild room-channel infos')
// doing it without waiting, could be long!
RoomChannel.singleton().rebuildData().then(
() => peertubeHelpers.logger.info('Room-channel info rebuild ok.'),
@ -93,6 +99,7 @@ async function initSettings (options: RegisterServerOptions): Promise<void> {
)
}
currentProsodyRoomtype = settings['prosody-room-type']
currentUsersRegexp = settings['enable-users-regexp']
})
}
@ -363,11 +370,6 @@ function initAdvancedChannelCustomizationSettings ({ registerSetting }: Register
private: true,
descriptionHTML: loc('configuration_description')
})
registerSetting({
type: 'html',
private: true,
descriptionHTML: loc('experimental_warning')
})
registerSetting({
name: 'disable-channel-configuration',
label: loc('disable_channel_configuration_label'),
@ -376,6 +378,19 @@ function initAdvancedChannelCustomizationSettings ({ registerSetting }: Register
default: false,
private: false
})
registerSetting({
// For now (v14), this settings is used to enable/disable regexp for forbidden words.
// This settings is basically here to say if you trust your users or not concerning regexp
// (because there is a risk of ReDOS on the chatbot).
// This settings could be used for other purpose later on (if we implement regexp anywhere else).
// So we use a pretty standard name, `enable-users-regexp`, that could apply for other uses.
name: 'enable-users-regexp',
label: loc('enable_users_regexp'),
descriptionHTML: loc('enable_users_regexp_description'),
type: 'input-checkbox',
default: false,
private: false
})
}
/**