jdev - 2021-09-04

Hey. I was reading the XMPP address format RFC, and it states [0] that "domainpart = IP-literal / IPv4address / ifqdn", where ifqdn should satisfy the Nameprep profile of stringprep. That profile [1] does not prohibit spaces [2]. The domainpart section [3] of the XMPP address format RFC also states that "The domainpart for every XMPP service MUST be a fully qualified domain name (FQDN; see [DNS]), IPv4 address, IPv6 address, or unqualified hostname (i.e., a text label that is resolvable on a local network)", and according to the linked DNS RFC [4], a domain name can consist of a single space character. Does all of this mean " " is a valid JID domainpart (and automatically a valid JID)? Does this also mean that any other domainpart containing spaces is invalid? I really hope there is some other specification I'm unaware of that prohibits both, otherwise this makes a little sense to me as I never heard of any such domain names before. If all of this is (unfortunately) correct, would it be safe to disregard the standards and simply assume that any space-containing domainpart is invalid? [0]: https://datatracker.ietf.org/doc/html/rfc6122#section-2.1 [1]: https://datatracker.ietf.org/doc/html/rfc3491#section-5 [2]: https://datatracker.ietf.org/doc/html/rfc3454#appendix-C.1.1 [3]: https://datatracker.ietf.org/doc/html/rfc6122#section-2.2 [4]: https://datatracker.ietf.org/doc/html/rfc1035#section-2.3.1

selurvedu, I think what you're missing is in IDNA

{name,sasl,node}prep never cease to amaze me

Someone configured Prosody with `VirtualHost "https://www.example.com/"` and nothing complained, but nothing worked either.

Maybe do a pass of idna on it, before accepting it as a valid JID?

which idna though?

Ugh.

:)

It's also a completely valid JID

Link Mauve, oh and that would break the Dino room and some others :)

how?

How what?

how would using IDNA break the dino room?

Can you guess?

no

`@` is not valid in IDNA

sooo?

Zash, parse it as a JID, then do the IDNA on the domainpart?

Yes.

`@` is not part of the dino room's domainpart?

I'm confused

It is, as far as Prosody is concerned. Sorta.

Whole thing is a dirty hack of course.

thank you for letting me know that bit I didn't want to know

It's an undocumented hack, so maybe one day it'll just disappear...