Re: IQ Handling vulnerabilities

Am 06.02.2014 12:26, schrieb Kevin Smith:
> Hi folks,
>    Discussion in the XSF and at the recent XMPP Summit has shown that
> there are widespread issues with handling of iq responses in XMPP
> software. This is probably something we need to consider handling.

This is something the WG should do.

> The basis of this is that many libraries/clients
> a) Only check the id of an iq error/result, not the sender, to check
> it matches one they've sent (Very Wrong)

Well, http://xmpp.org/rfcs/rfc6120.html#stanzas-semantics-iq says
	the interaction is tracked by the requesting entity through use
	of the 'id' attribute.
That's easy to to get wrong :-/

> b) Use predictably generated ids for stanzas (ill-advised, but not
> strictly wrong)

We need to fix the advice given in
http://xmpp.org/rfcs/rfc6120.html#stanzas-attributes-id