Bug 15384

Summary:	telepathy-gabble allows sending characters that will get you disconnected from the XMPP service
Product:	Telepathy	Reporter:	Mart Raudsepp <leio>
Component:	gabble	Assignee:	Telepathy bugs list <telepathy-bugs>
Status:	RESOLVED MOVED	QA Contact:	Telepathy bugs list <telepathy-bugs>
Severity:	normal
Priority:	medium	CC:	bug
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Mart Raudsepp 2008-04-07 04:53:49 UTC

I copy pasted to someone a line from gnome-terminal that contained characters below 0x32 character values and sent it off with empathy. After that I got disconnected from my jabber server immediately and the message didn't go through.

The line tries was basically
./appname: line 1: <0x7F>ELF<0x02><0x01><0x01><0x02>: not found

Where <0xnn> was the actual character (rendered with 00nn in a box by pango).

on #telepathy people told that these characters shouldn't be allowed to be sent at all and Send() should reject it or filter them out or replace with something.

For example:
<smcv> (reject / replace with <0xfoo> / replace with spaces / delete would seem to be the vaguely sane possibilities)

It might be useful for there to be a way for advanced client applications to know something was done, to report it for the user.

Comment 1 Simon McVittie 2008-05-19 04:15:55 UTC

The allowed characters are:

- U+000D (tab), U+000A (newline) and U+000D (carriage return)

- U+0020 (space) to U+D7FF

- U+E000 to U+FFFD

- U+10000 to U+10FFFF

i.e. the characters that are explicitly excluded are the ASCII control characters (apart from tab/LF/CR/space), the surrogate blocks, FFFE and FFFF.

Document authors are also encouraged to avoid:

[#x7F-#x84], [#x86-#x9F], [#xFDD0-#xFDDF],
[#x1FFFE-#x1FFFF], [#x2FFFE-#x2FFFF], [#x3FFFE-#x3FFFF],
[#x4FFFE-#x4FFFF], [#x5FFFE-#x5FFFF], [#x6FFFE-#x6FFFF],
[#x7FFFE-#x7FFFF], [#x8FFFE-#x8FFFF], [#x9FFFE-#x9FFFF],
[#xAFFFE-#xAFFFF], [#xBFFFE-#xBFFFF], [#xCFFFE-#xCFFFF],
[#xDFFFE-#xDFFFF], [#xEFFFE-#xEFFFF], [#xFFFFE-#xFFFFF],
[#x10FFFE-#x10FFFF]

(control characters and characters that are permanently undefined), but these are allowed, and consequently shouldn't get us disconnected.

Comment 2 Will Thompson 2009-06-07 07:50:24 UTC

I think these characters should just be stripped. The definition of the Sent signal has a provision for this:

> "If the message was, or will be, altered during transmission, this argument SHOULD reflect what other contacts will receive rather than being a copy of the argument to Send. "

(from <http://telepathy.freedesktop.org/spec/org.freedesktop.Telepathy.Channel.Type.Text.html#org.freedesktop.Telepathy.Channel.Type.Text.Sent>).

Comment 3 Simon McVittie 2009-09-08 11:24:50 UTC

References:

http://www.w3.org/TR/REC-xml/#charsets

http://xmpp.org/rfcs/rfc3920.html#xml-restrictions

Comment 4 Simon McVittie 2010-11-02 12:08:38 UTC

*** Bug 31335 has been marked as a duplicate of this bug. ***

Comment 5 GitLab Migration User 2019-12-03 19:17:41 UTC

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/telepathy/telepathy-gabble/issues/8.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.