jabber.developer2
55c73ee21a
Some checks failed
CI Code / Check spelling (pull_request) Successful in 19s
CI Code / Check coding style (pull_request) Successful in 34s
CI Code / Code Coverage (pull_request) Failing after 9m56s
CI Code / Linux (arch) (pull_request) Failing after 13m41s
CI Code / Linux (debian) (pull_request) Failing after 15m0s
CI Code / Linux (ubuntu) (pull_request) Failing after 15m9s
Reject client-forged <delay> timestamps in the incoming message handlers. The displayed timestamp was taken from an unfiltered delay scan, so a remote peer could place a message anywhere in history by injecting <delay from='...' stamp='...'>. - _handle_groupchat: oldest delay from room bare JID -> room domain -> our server domain, else now. - _handle_muc_private_message / _handle_chat: delay from our server domain -> sender domain, else now. Add stanza_get_oldest_delay_from(); stanza_get_oldest_delay() delegates with from=NULL. The MAM <forwarded> path stays unfiltered (trusted by construction). The original PR's XEP-0359 <stanza-id> 'by' edits are dropped: master already validates 'by'.