moparisthebest/xeps
1
0
Fork 0
mirror of https://github.com/moparisthebest/xeps synced 2024-12-21 07:08:51 -05:00
Code Issues Releases Wiki Activity

Merge branch 'feature/xhtml-im-security-considerations' of https://github.com/horazont/xeps into feature/xep-0071

Browse Source
This commit is contained in:
Jonas Wielicki 2017-10-19 13:11:13 +02:00
commit 1544c743bf
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
xep-0071.xml
View File

@ -36,6 +36,12 @@
<url>http://www.xmpp.org/schemas/xhtml-im-model.xsd</url>
</schemaloc>
&stpeter;
<revision>
<version>1.5.2</version>
<date>2017-10-12</date>
<initials>jwi</initials>
<remark><p>Clarify security considerations.</p></remark>
</revision>
<revision>
<version>1.5.1</version>
<date>2016-01-05</date>
@ -838,7 +844,8 @@ That seems fine to me.
</section1>
<section1 topic='Security Considerations' anchor='security'>
<section2 topic='Malicious Objects' anchor='security-code'>
<p>The exclusion of scripts, applets, binary objects, and other potentially executable code from XHTML-IM reduces the risk of exposure to harmful or malicious objects caused by inclusion of XHTML content. To further reduce the risk of such exposure, an implementation MAY choose to:</p>
<p>While scripts, applets, binary objects and other potentially executable code is excluded from the profiles used in XHTML-IM, malicious entities still may inject those and thus exploit entities which rely on this exclusion. Entities thus MUST assume that inbound XHTML-IM may be mailicious and MUST sanitize it according to the profile used, by ignoring elements and removing attributes as needed.</p>
<p>To further reduce the risk of such exposure, an implementation MAY choose to:</p>
<ul>
<li>Not make hyperlinks clickable</li>
<li>Not fetch or present images but instead show only the 'alt' text.</li>