Chapril/xmpp.chapril.org-conversejs
Chapril
/
xmpp.chapril.org-conversejs
24
0
Fork 0
Code Issues Pull Requests Projects Releases Activity

Prevent forging of messages via carbons.

This commit is contained in:
JC Brand 2017-01-31 22:18:26 +00:00
parent 0cf9903726
commit e81eaf323e
3 changed files with 53 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/CHANGES.md
View File

@ -10,6 +10,7 @@
- Bugfix. Login form wasn't rendered after logging out (when `auto_reconnect` is `true`). [jcbrand]
- Bugfix. Properly disconnect upon "host-unknown" error. [jcbrand]
- Bugfix. Minimized chats weren't removed when logging out. [jcbrand]
- Security fix: Prevent message forging via carbons. (Thanks to ge0rg) [jcbrand]
## 2.0.4 (2016-12-13)
- #737: Bugfix. Translations weren't being applied. [jcbrand]

45
spec/chatbox.js
View File

@ -766,7 +766,7 @@
var msgtext = 'This is a carbon message';
var sender_jid = mock.cur_names[1].replace(/ /g,'.').toLowerCase() + '@localhost';
var msg = $msg({
'from': converse.bare_jid,
'from': sender_jid,
'id': (new Date()).getTime(),
'to': converse.connection.jid,
'type': 'chat',
@ -844,6 +844,49 @@
expect(msg_txt).toEqual(msgtext);
}));
it("will be discarded if it's a malicious message meant to look like a carbon copy", mock.initConverse(function (converse) {
test_utils.createContacts(converse, 'current');
test_utils.openControlBox();
test_utils.openContactsPanel(converse);
/* <message from="mallory@evil.example" to="b@xmpp.example">
* <received xmlns='urn:xmpp:carbons:2'>
* <forwarded xmlns='urn:xmpp:forward:0'>
* <message from="alice@xmpp.example" to="bob@xmpp.example/client1">
* <body>Please come to Creepy Valley tonight, alone!</body>
* </message>
* </forwarded>
* </received>
* </message>
*/
spyOn(converse, 'log');
var msgtext = 'Please come to Creepy Valley tonight, alone!';
var sender_jid = mock.cur_names[1].replace(/ /g,'.').toLowerCase() + '@localhost';
var impersonated_jid = mock.cur_names[2].replace(/ /g,'.').toLowerCase() + '@localhost';
var msg = $msg({
'from': sender_jid,
'id': (new Date()).getTime(),
'to': converse.connection.jid,
'type': 'chat',
'xmlns': 'jabber:client'
}).c('received', {'xmlns': 'urn:xmpp:carbons:2'})
.c('forwarded', {'xmlns': 'urn:xmpp:forward:0'})
.c('message', {
'xmlns': 'jabber:client',
'from': impersonated_jid,
'to': converse.connection.jid,
'type': 'chat'
}).c('body').t(msgtext).tree();
converse.chatboxes.onMessage(msg);
// Check that chatbox for impersonated user is not created.
var chatbox = converse.chatboxes.get(impersonated_jid);
expect(chatbox).not.toBeDefined();
// Check that the chatbox for the malicous user is not created
chatbox = converse.chatboxes.get(sender_jid);
expect(chatbox).not.toBeDefined();
}));
it("received for a minimized chat box will increment a counter on its header", mock.initConverse(function (converse) {
test_utils.createContacts(converse, 'current');
test_utils.openControlBox();

9
src/converse-core.js
View File

@ -1447,7 +1447,14 @@
}
$forwarded = $message.find('forwarded');
if ($forwarded.length) {
$message = $forwarded.children('message');
var $forwarded_message = $forwarded.children('message');
if (Strophe.getBareJidFromJid($forwarded_message.attr('from')) !== from_jid) {
// Prevent message forging via carbons
//
// https://xmpp.org/extensions/xep-0280.html#security
return true;
}
$message = $forwarded_message;
$delay = $forwarded.children('delay');
from_jid = $message.attr('from');
to_jid = $message.attr('to');