search

hannesm / jackline

minimalistic secure XMPP client in OCaml
BSD 2-Clause "Simplified" License
251 stars 20 forks source link

Can't remove unauthorized roster entry of non-existing jid #221

Open sternenseemann opened 3 years ago

sternenseemann commented 3 years ago

Had an JID in my roster which never approved or rejected my /add because the account did not exist. I was unable to remove the JID with the error message below (that's the entire log concerning this, I'd be happy to do more testing if you tell me what to look for).

My jabber server is systemli's (idk which software they are running). The server the JID belongs to exists, but the added JID does not. I was able to remove the JID from my roster in Pidgin.

12:04:28 * /add <JID>: ; <JID> * has been subscribed (approval pending)
12:05:56 <JID>: Failed to remove: modify bad-request
hannesm commented 3 years ago

yes, this is an issue. a first step could be to sanitize/validate ids in /add. I'm not sure where the remove error originates from, eventually the server? but then since you're able from a different client to modify the roster, it may be an encoding issue in jackline (or erm_xmpp/erm_xml). sorry, I don't have much time for jackline atm.