devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 8 Actions Packages Projects 1 Releases Wiki Activity

merge/upstream-full #105

Manually merged
jabber.developer merged 407 commits from merge/upstream-full into master 2026-05-26 17:54:34 +00:00
Conversation 6 Commits 407 Files Changed 303 +14380 -37351
401 changed files with 14380 additions and 37351 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 247c44be30 - Show all commits

32
src/xmpp/message.c
View File

@@ -1067,9 +1067,12 @@ _handle_groupchat(xmpp_stanza_t* const stanza)
char* stanzaid = NULL;
xmpp_stanza_t* stanzaidst = xmpp_stanza_get_child_by_name_and_ns(stanza, STANZA_NAME_STANZA_ID, STANZA_NS_STABLE_ID);
if (stanzaidst) {
stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
if (stanzaid) {
message->stanzaid = strdup(stanzaid);
const char* by = xmpp_stanza_get_attribute(stanzaidst, "by");
jabber.developer marked this conversation as resolved Outdated
jabber.developer commented 2026-04-23 13:31:43 +00:00
Outdated
Review
Copy Link

I am not sure right now, but I recall one XEP mentioning that we shouldn't trust by. Further investigation is required.

I am not sure right now, but I recall one XEP mentioning that we shouldn't trust `by`. Further investigation is required.
jabber.developer2 commented 2026-04-28 14:46:54 +00:00
Outdated
Review
Copy Link

Will be handled in #112 — XEP-0359 §7 + §8 require a disco check (urn:xmpp:sid:0) before trusting the by attribute; current code only matches the JID.

Will be handled in [#112](https://git.jabber.space/devs/cproof/issues/112) — XEP-0359 §7 + §8 require a disco check (`urn:xmpp:sid:0`) before trusting the `by` attribute; current code only matches the JID.
if (by && (g_strcmp0(by, from_jid->barejid) == 0)) {
stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
if (stanzaid) {
message->stanzaid = strdup(stanzaid);
}
}
}
@@ -1389,9 +1392,12 @@ _handle_chat(xmpp_stanza_t* const stanza, gboolean is_mam, gboolean is_carbon, c
char* stanzaid = NULL;
xmpp_stanza_t* stanzaidst = xmpp_stanza_get_child_by_name_and_ns(stanza, STANZA_NAME_STANZA_ID, STANZA_NS_STABLE_ID);
if (stanzaidst) {
stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
if (stanzaid) {
message->stanzaid = strdup(stanzaid);
const char* by = xmpp_stanza_get_attribute(stanzaidst, "by");
jabber.developer marked this conversation as resolved Outdated
jabber.developer commented 2026-04-23 13:34:05 +00:00
Outdated
Review
Copy Link

same as earlier: trusting by is under question.

same as earlier: trusting `by` is under question.
jabber.developer2 commented 2026-04-28 14:47:30 +00:00
Outdated
Review
Copy Link

Same as previous — handled in #112

Same as previous — handled in [#112](https://git.jabber.space/devs/cproof/issues/112)
if (by && equals_our_barejid(by)) {
stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
if (stanzaid) {
message->stanzaid = strdup(stanzaid);
}
}
}
}
@@ -1524,6 +1530,20 @@ _handle_mam(xmpp_stanza_t* const stanza)
// <result xmlns='urn:xmpp:mam:2' queryid='f27' id='5d398-28273-f7382'>
// same as <stanza-id> from XEP-0359 for live messages
const char* by = xmpp_stanza_get_attribute(result, "by");
const char* from = xmpp_stanza_get_from(stanza);
if (by) {
if (g_strcmp0(by, from) != 0) {
log_warning("MAM result 'by' attribute (%s) does not match 'from' (%s)", by, from);
return TRUE;
}
} else {
if (from && !equals_our_barejid(from)) {
log_warning("MAM result from %s with no 'by' attribute (expected our own JID)", from);
return TRUE;
}
}
const char* result_id = xmpp_stanza_get_id(result);
GDateTime* timestamp = stanza_get_delay_from(forwarded, NULL);