diff --git a/xep-0231.xml b/xep-0231.xml index f31481ea..727ea1e1 100644 --- a/xep-0231.xml +++ b/xep-0231.xml @@ -18,12 +18,19 @@ XMPP Core RFC 2045 RFC 2111 + RFC 2965 RFC 4648 NOT_YET_ASSIGNED &stpeter; + + 0.4 + 2008-08-05 + psa +

Generalized text regarding inclusion of parameters in type attribute per RFC 2045; added max-age attribute, matching semantics from RFC 2965; added section on caching of data; more clearly specified generation of Content-ID.

 + 0.3 2008-06-18 @@ -89,12 +96,17 @@ cid - A Content-ID that can be mapped to a cid: URL as specified in &rfc2111;. + A Content-ID that can be mapped to a cid: URL as specified in &rfc2111;. The 'cid' value MUST be generated so that the local-part is a UUID as specified in &rfc4122; and the domain is the XMPP domain identifier portion of the sending entity's JabberID. RECOMMENDED + + max-age + A suggestion regarding how long (in seconds) to cache the data; the meaning matches the Max-Age attribute from &rfc2965;. + RECOMMENDED when sending a <data/> element containing XML character data + type - The MIME type of the data (e.g., "image/png") as described in &rfc2045;. The MIME type SHOULD be as registered in the &ianamedia;. The 'type' attribute MAY include the codecs parameter as specified in &rfc4281;, as shown in the example of the "audio/ogg" media type in the example below. + The value of the 'type' attribute MUST match the syntax specified in &rfc2045;. That is, the value MUST include a top-level media type, the "/" character, and a subtype; in addition, it MAY include one or more optional parameters (e.g., the "audio/ogg" MIME type in the example shown below includes a "codecs" parameter as specified in &rfc4281;). The "type/subtype" string SHOULD be registered in the &ianamedia;, but MAY be an unregistered or yet-to-be-registered value. REQUIRED @@ -103,6 +115,7 @@ iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAABGdBTUEAALGP C/xhBQAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9YGARc5KB0XV+IA @@ -114,6 +127,15 @@ ]]> + +

When one party sends a data element to another party, it SHOULD NOT include the data itself unless the data is particularly small (e.g., less than 1k) or is ephemeral and therefore will never be used again. Instead, it SHOULD send an empty <data/> element with a 'cid' attribute, then depend on the receiving party to retrieve the data if not cached.

+

As a hint regarding the suggested period for caching the data, the sending party SHOULD include a 'max-age' attribute whenever it sends a non-empty <data/> element. The semantics of the 'max-age' attribute exactly matches that of the Max-Age attribute from RFC 2965.

+

It is RECOMMENDED for the receiving entity to cache data; however, the receiving entity MAY opt not to cache data, for example because it runs on an a device that does not have sufficient space for data storage.

+

The default behavior is for the receiving entity to cache the data only for the life of the entity's application session (not a controlling user's presence session with the server or the controlling user's communication session with the contact from whom the user received the data); that is, the receiving entity would clear the cache when the application is terminated or restarted.

+

If it is not suggested to cache the data (e.g., because it is ephemeral), the value of the 'max-age' attribute MUST be "0" (the number zero).

+

A receiving entity MUST cache based on the JID of the sending entity; this helps to prevent certain data poisoning attacks.

+ +

The <data/> element can be used in conjunction with &xep0071; and the cid: URL scheme to point to binary data that is provided in-band within a &MESSAGE; stanza.

@@ -135,6 +157,7 @@ iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAABGdBTUEAALGP C/xhBQAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9YGARc5KB0XV+IA @@ -180,8 +203,7 @@ - [ ... base64-encoded-audio ... ] + type='audio/ogg; codecs=speex'/> ]]> @@ -204,6 +226,7 @@ name='image.png'> iVBORw0KGgoAAAANSUhEUgAAADkAAABACAIAAAAvV0jbAAAACXBIWXMAAA4mAAAOJgGi7yX8AAAc SUlEQVRogX2aeYwlx33fv31V39d78+Y+d/a+eZMizcukKFlmTB2GEcmypQSJ7SBSnAOG4QAJEhix @@ -370,6 +393,7 @@ iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAABGdBTUEAALGP C/xhBQAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9YGARc5KB0XV+IA @@ -388,6 +412,7 @@

The ability to include arbitrary binary data implies that it is possible to send scripts, applets, images, and executable code, which may be potentially harmful. To reduce the risk of such exposure, an implementation MAY choose to not display or process such data but instead either completely ignore the data, show only the value of the 'alt' attribute, or prompt a human user for approval (either explicitly via user action or implicitly via a list of approved entities from whom the user will accept binary data without per-event approval).

+

The receiving entity SHOULD cache data based on the sender's JabberID; this helps to avoid data poisoning attacks.

 @@ -432,6 +457,7 @@ + @@ -443,7 +469,7 @@ -

Thanks to Rachel Blackman, Dave Cridland, and Tomasz Sterna for their feedback.

+

Thanks to Rachel Blackman, Dave Cridland, Pavel Šimerda, and Tomasz Sterna for their feedback.