Re: IQ Handling vulnerabilities

Am 07.02.2014 13:21, schrieb Kevin Smith:
> On Fri, Feb 7, 2014 at 11:23 AM, Alexander Holler <[email protected]> wrote:

>> A simple rule for clients could be to check that the JID of IQ replies where
>> the origin should be the connected server is either the JID of the server
>> (no node, no resource) or the received bare JID (stripping a possible
>> resource) is the bare JID of the client.
>
> The rules here are clear. If a client sends a stanza without a 'to',
> the server is to handle it as if it was sent to the bare JID of the
> client's session. The server replying with the server JID is a bug.

The rules are only clear for the current RFC 6120, but not for that 
obsolet RFC 3120, which I assume was the base for most available 
XMPP-servers (and many clients).

Regards,

Alexander Holler