Subject: [xmpp] #59: checking of 'from' address on client-generated stanzas

From: "xmpp issue tracker" <[email-masked]>
Date: Tue, 22 Jun 2010 01:48:33 -0000

#59: checking of 'from' address on client-generated stanzas
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |       Owner:  stpeter@…         
     Type:  defect              |      Status:  new               
 Priority:  minor               |   Milestone:                    
Component:  3920bis             |     Version:                    
 Severity:  In WG Last Call     |    Keywords:                    
--------------------------------+-------------------------------------------
 Section 8.1.2.1 (Client-to-Server Streams) states:

 > 2.  When the server receives an XML stanza from a client and the
 > stanza includes a 'from' attribute, the server MUST either (a)
 > validate that the value of the 'from' attribute provided by the
 > client is that of a connected resource for the associated entity
 > or (b) override the provided 'from' attribute by adding a 'from'
 > attribute as specified under Rule #1.

 Waqas Hussain commented: "Does this mean a resource is allowed to send
 stanzas on behalf of another resource? This is rather surprising."

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/59>
xmpp <http://tools.ietf.org/xmpp/>

---

From: "xmpp issue tracker" <[email-masked]>
Date: Fri, 25 Jun 2010 05:03:34 -0000

#59: checking of 'from' address on client-generated stanzas
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |        Owner:  stpeter@…         
     Type:  defect              |       Status:  closed            
 Priority:  minor               |    Milestone:                    
Component:  3920bis             |      Version:                    
 Severity:  In WG Last Call     |   Resolution:  fixed             
 Keywords:                      |  
--------------------------------+-------------------------------------------
Changes (by stpeter@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Provisionally resolved with this text:

    1.  When the server receives an XML stanza from a client, the server
        MUST add a 'from' attribute to the stanza or override the 'from'
        attribute specified by the client, where the value of the 'from'
        attribute is the full JID (<localpart@domainpart/resource>)
        determined by the server for the connected resource that
        generated the stanza (see Section 4.2.6), or the bare JID
        (<localpart@domainpart>) in the case of subscription-related
        presence stanzas (see [XMPP-IM]).

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/59#comment:1>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 24 Jun 2010 23:15:33 -0600

> #59: checking of 'from' address on client-generated stanzas

That is rather surprising, and unintentional. Fixed.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/