From 8056721f8ecdfd368d191ce998c5d9c83320dc65 Mon Sep 17 00:00:00 2001
From: Georg Lukas <georg@op-co.de>
Date: Wed, 7 Apr 2021 18:59:10 +0200
Subject: [PATCH 1/5] XEP template: add `<cve>` element for security
 vulnerabilities

---
 xep-template.xml |  2 ++
 xep.dtd          | 16 ++++++++++------
 xep.xsd          | 16 ++++++++++++++++
 xep.xsl          | 20 ++++++++++++++++++++
 xmpp.css         |  5 +++++
 5 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/xep-template.xml b/xep-template.xml
index 1807dc66..23ad1121 100644
--- a/xep-template.xml
+++ b/xep-template.xml
@@ -109,6 +109,8 @@
   <query xmlns='http://jabber.org/protocol/disco#items'/>
 </iq>
 ]]></example>
+    <cve id="2017-5589" url="https://rt-solutions.de/en/cve-2017-5589_xmpp_carbons/">Name of a CVE relevant to the XEP</cve>
+    <cve id="2017-5589">Another CVE with no primary source</cve>
     <section3 topic='3rd Level Heading' anchor='syling-examples-3rd'>
       <p>Text in a Sub-Sub-Section.</p>
       <section4 topic='4th Level Heading' anchor='syling-examples-4th'>
diff --git a/xep.dtd b/xep.dtd
index 52c7e842..56a5afd7 100644
--- a/xep.dtd
+++ b/xep.dtd
@@ -68,27 +68,27 @@ THE SOFTWARE.
 <!ELEMENT initials (#PCDATA)* >
 <!ELEMENT remark (#PCDATA | p | ul)* >
 <!ELEMENT councilnote (#PCDATA)* >
-<!ELEMENT section1 ( div | p | section2 | example | code | ul | ol | dl | table )* >
+<!ELEMENT section1 ( div | p | section2 | example | code | cve | ul | ol | dl | table )* >
 <!ATTLIST section1
           topic CDATA ''
           anchor CDATA '' >
-<!ELEMENT section2 ( div | p | section3 | example | code | ul | ol | dl | table )* >
+<!ELEMENT section2 ( div | p | section3 | example | code | cve | ul | ol | dl | table )* >
 <!ATTLIST section2
           topic CDATA ''
           anchor CDATA '' >
-<!ELEMENT section3 ( div | p | section4 | example | code | ul | ol | dl | table )* >
+<!ELEMENT section3 ( div | p | section4 | example | code | cve | ul | ol | dl | table )* >
 <!ATTLIST section3
           topic CDATA ''
           anchor CDATA '' >
-<!ELEMENT section4 ( div | p | section5 | example | code | ul | ol | dl | table )* >
+<!ELEMENT section4 ( div | p | section5 | example | code | cve | ul | ol | dl | table )* >
 <!ATTLIST section4
           topic CDATA ''
           anchor CDATA '' >
-<!ELEMENT section5 ( div | p | example | code | ul | ol | dl | table )* >
+<!ELEMENT section5 ( div | p | example | code | cve | ul | ol | dl | table )* >
 <!ATTLIST section5
           topic CDATA ''
           anchor CDATA '' >
-<!ELEMENT div ( #PCDATA | div | p | example | code | ul | ol | dl | table | blockquote )* >
+<!ELEMENT div ( #PCDATA | div | p | example | code | cve | ul | ol | dl | table | blockquote )* >
 <!ATTLIST div
           class CDATA ''
           style CDATA '' >
@@ -130,6 +130,10 @@ THE SOFTWARE.
 <!ATTLIST example caption CDATA '' >
 <!ELEMENT code (#PCDATA | span | em | strong)* >
 <!ATTLIST code caption CDATA '' >
+<!ELEMENT cve (#PCDATA)* >
+<!ATTLIST cve
+          id CDATA ''
+          url CDATA '' >
 <!ELEMENT table (tr)* >
 <!ATTLIST table caption CDATA '' >
 <!ELEMENT tr ( th | td )* >
diff --git a/xep.xsd b/xep.xsd
index 9a62fa84..dbbbd427 100644
--- a/xep.xsd
+++ b/xep.xsd
@@ -209,6 +209,7 @@ THE SOFTWARE.
     <xs:complexType>
       <xs:choice maxOccurs='unbounded'>
         <xs:element ref='code' minOccurs='0' maxOccurs='unbounded'/>
+        <xs:element ref='cve' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='div' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='dl' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='example' minOccurs='0' maxOccurs='unbounded'/>
@@ -227,6 +228,7 @@ THE SOFTWARE.
     <xs:complexType>
       <xs:choice maxOccurs='unbounded'>
         <xs:element ref='code' minOccurs='0' maxOccurs='unbounded'/>
+        <xs:element ref='cve' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='div' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='dl' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='example' minOccurs='0' maxOccurs='unbounded'/>
@@ -245,6 +247,7 @@ THE SOFTWARE.
     <xs:complexType>
       <xs:choice maxOccurs='unbounded'>
         <xs:element ref='code' minOccurs='0' maxOccurs='unbounded'/>
+        <xs:element ref='cve' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='div' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='dl' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='example' minOccurs='0' maxOccurs='unbounded'/>
@@ -263,6 +266,7 @@ THE SOFTWARE.
     <xs:complexType>
       <xs:choice maxOccurs='unbounded'>
         <xs:element ref='code' minOccurs='0' maxOccurs='unbounded'/>
+        <xs:element ref='cve' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='div' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='dl' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='example' minOccurs='0' maxOccurs='unbounded'/>
@@ -283,6 +287,7 @@ THE SOFTWARE.
         <xs:element ref='p' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='example' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='code' minOccurs='0' maxOccurs='unbounded'/>
+        <xs:element ref='cve' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='ul' minOccurs='0' maxOccurs='unbounded'/>
         <xs:element ref='ol' minOccurs='0' maxOccurs='unbounded'/>
       </xs:choice>
@@ -379,6 +384,17 @@ THE SOFTWARE.
     </xs:complexType>
   </xs:element>
 
+  <xs:element name='cve'>
+    <xs:complexType>
+      <xs:simpleContent>
+        <xs:extension base='xs:string'>
+          <xs:attribute name='id' use='required'/>
+          <xs:attribute name='url' use='optional'/>
+        </xs:extension>
+      </xs:simpleContent>
+    </xs:complexType>
+  </xs:element>
+
   <xs:element name='table'>
     <xs:complexType>
       <xs:sequence>
diff --git a/xep.xsl b/xep.xsl
index 504e1435..21c3149e 100644
--- a/xep.xsl
+++ b/xep.xsl
@@ -1015,6 +1015,26 @@ content: "XEP-<xsl:value-of select='/xep/header/number'/>";
     </figure>
   </xsl:template>
 
+  <xsl:template match='cve'>
+    <figure class='cve'>
+      <figcaption>CVE-<xsl:value-of select='@id'/>
+	(<a><xsl:attribute name='href'>https://nvd.nist.gov/vuln/detail/CVE-<xsl:value-of select='@id'/></xsl:attribute>NIST</a>,
+	<a><xsl:attribute name='href'>https://cve.mitre.org/cgi-bin/cvename.cgi?name=<xsl:value-of select='@id'/></xsl:attribute>Mitre</a>)
+      </figcaption>
+      <xsl:choose>
+	<xsl:when test="@url != ''">
+	  <a>
+	    <xsl:attribute name='href'><xsl:value-of select='@url'/></xsl:attribute>
+	    <xsl:apply-templates/>
+	  </a>
+	</xsl:when>
+	<xsl:otherwise>
+	  <xsl:apply-templates/>
+	</xsl:otherwise>
+      </xsl:choose>
+    </figure>
+  </xsl:template>
+
   <xsl:template match='img'>
     <img>
       <xsl:attribute name='alt'><xsl:value-of select='@alt'/></xsl:attribute>
diff --git a/xmpp.css b/xmpp.css
index 562fa28c..70110627 100644
--- a/xmpp.css
+++ b/xmpp.css
@@ -1290,6 +1290,11 @@
         padding: 1.5em;
         border: 1px solid rgba(19, 181, 234, 1.0);
     }
+    figure.cve {
+        padding: 1.5em;
+        background-color: rgba(255, 220, 220, 1.0);
+        border: 5px solid rgba(180, 0, 0, 1.0);
+    }
 
     figure > figcaption {
         margin-bottom: 0.5em;

From c724ddc348a9d1a2264522a8056a34c456dabf4e Mon Sep 17 00:00:00 2001
From: Georg Lukas <georg@op-co.de>
Date: Wed, 7 Apr 2021 19:03:25 +0200
Subject: [PATCH 2/5] XEP-0280: add some CVEs

---
 xep-0280.xml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/xep-0280.xml b/xep-0280.xml
index 1eac33ba..8f1e4454 100644
--- a/xep-0280.xml
+++ b/xep-0280.xml
@@ -533,6 +533,9 @@
     <li>any copies that do not meet this requirement MUST be ignored.</li>
   </ul>
   <p>Outbound chat messages that are encrypted end-to-end are not often useful to receive on other resources.  As such, they should use the &lt;private/&gt; element specified above to avoid such copying, unless the encryption mechanism is able to accommodate this protocol.</p>
+  <cve id="2017-5589" url="https://rt-solutions.de/en/cve-2017-5589_xmpp_carbons/">Multiple XMPP Clients User Impersonation Vulnerability</cve>
+  <cve id="2019-16235" url="https://gultsch.de/dino_multiple.html">Multiple Vulnerabilities found in Dino</cve>
+  <cve id="2020-26547" url="https://monal.im/blog/cve-2020-26547/">Missing sender verification for Carbons and MAM in Monal before 4.9</cve>
 </section1>
 <section1 topic='IANA Considerations' anchor='iana'>
   <p>This document requires no interaction with &IANA;.</p>

From 0310636ca99ac7db41ebb26274f701f16e90491c Mon Sep 17 00:00:00 2001
From: Georg Lukas <georg@op-co.de>
Date: Thu, 8 Apr 2021 15:16:23 +0200
Subject: [PATCH 3/5] XEP style: fix CVE background in dark mode

---
 xmpp.css | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/xmpp.css b/xmpp.css
index 70110627..27310a84 100644
--- a/xmpp.css
+++ b/xmpp.css
@@ -1712,6 +1712,10 @@
     figure.example {
         background-color: #282828;
     }
+    figure.cve {
+        border: 5px solid rgba(120, 0, 0, 1.0);
+        background-color: #200000;
+    }
 
     .box {
         color: #ccc;

From 28957f6cc1f85491fc4a7de6d970df0f8891fed7 Mon Sep 17 00:00:00 2001
From: Georg Lukas <georg@op-co.de>
Date: Wed, 14 Apr 2021 16:55:15 +0200
Subject: [PATCH 4/5] CVE: remove background color

---
 xmpp.css | 2 --
 1 file changed, 2 deletions(-)

diff --git a/xmpp.css b/xmpp.css
index 27310a84..08a30a83 100644
--- a/xmpp.css
+++ b/xmpp.css
@@ -1292,7 +1292,6 @@
     }
     figure.cve {
         padding: 1.5em;
-        background-color: rgba(255, 220, 220, 1.0);
         border: 5px solid rgba(180, 0, 0, 1.0);
     }
 
@@ -1714,7 +1713,6 @@
     }
     figure.cve {
         border: 5px solid rgba(120, 0, 0, 1.0);
-        background-color: #200000;
     }
 
     .box {

From 6d942dcb3b02b92783cc2d19d568b36b8201d5f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonas=20Sch=C3=A4fer?= <j.wielicki@sotecware.net>
Date: Tue, 25 May 2021 17:08:23 +0200
Subject: [PATCH 5/5] XEP-0280: add revision block

---
 xep-0280.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xep-0280.xml b/xep-0280.xml
index 8f1e4454..47e8ccb4 100644
--- a/xep-0280.xml
+++ b/xep-0280.xml
@@ -53,6 +53,12 @@
     <email>georg@op-co.de</email>
     <jid>georg@yax.im</jid>
   </author>
+  <revision>
+    <version>0.13.4</version>
+    <date>2021-05-25</date>
+    <initials>gl</initials>
+    <remark><p>Add CVE references</p></remark>
+  </revision>
   <revision>
     <version>0.13.3</version>
     <date>2021-03-23</date>