movim / movim

Movim - Decentralized social platform
https://movim.eu
GNU Affero General Public License v3.0
1.74k stars 252 forks source link

Angle brackets escaped when sent over the wire #1157

Closed Ppjet6 closed 1 year ago

Ppjet6 commented 1 year ago

It seems Movim is sending > and < as XML entities (or rather, what would be displayed as XML entities) on the wire. I have only noticed it in replies for now, I don't know if it happens in normal messages or anything.

As seen from poezio: image

According to slixmpp, Movim sent the following, note the &amp:

2023-02-19 11:15:33,753 DEBUG:xmlstream:RECV: <message to="pep@bouah.net/poezio-foo" type="groupchat" id="9f681544-1826-45b7-bdbb-9c63b4e6bf0a" from="movim@conference.movim.eu/edhelas" xml:lang="en">
  <archived xmlns="urn:xmpp:mam:tmp" id="1676805320882920" by="movim@conference.movim.eu" />
  <stanza-id xmlns="urn:xmpp:sid:0" id="1676805320882920" by="movim@conference.movim.eu" />
  <reply xmlns="urn:xmpp:reply:0" id="1676805299975183" to="movim@conference.movim.eu/bar" />
  <fallback xmlns="urn:xmpp:fallback:0" for="urn:xmpp:reply:0"><body start="0" end="579" /></fallback>
  <active xmlns="http://jabber.org/protocol/chatstates" />
  <origin-id xmlns="urn:xmpp:sid:0" id="9f681544-1826-45b7-bdbb-9c63b4e6bf0a" />
  <body>&gt; &amp;gt;&amp;gt; https://github.com/movim/movim/wiki/Configure%20ejabberd#pubsub
&gt; &amp;gt;&amp;gt;
&gt; &amp;gt;&amp;gt; https://github.com/movim/movim/wiki/Configure%20prosody#pep-and-pubsub
&gt; &amp;gt;
&gt; &amp;gt; edhelas:
&gt; &amp;gt; _I found the issue. Issue was even before i have not set `pep_max_items` value i have used movim and the issue is movim client set my PEP value as *default to 1.*_
&gt; &amp;gt; _even if i change value on server. The Movim client still keeps it in value *1*._
&gt; &amp;gt; _So is there any client or any way i can manage to edit my PEP value of Movim?_
&gt;
&gt; edhelas: Any comments for this. :)
So prosody ?</body>
</message>
edhelas commented 1 year ago

This is handled by the PHP XML lib automagically. A CDATA would be required to have raw >, < and other XML characters in the body. Seems legit. See https://stackoverflow.com/a/54713577