jdev - 2026-06-07

yeah, but i have them in another table

so it is important that i get the jid correct which the error belongs to, otherwise the join will not yield the error

File Uploads may have a limited file types that are allowed to upload. The discovery allow to specify file max size in a form, maybe we can add the allowed file types too? Then a client can hide unsupported files in a file chooser dialog. https://xmpp.org/extensions/xep-0363.html

The XEP for File Upload input form has such element to specify allowed files https://xmpp.org/extensions/xep-0505.html

Sergey Ponomarev, The content type in XEP-0363 is not meant to restrict uploads, it's meant so that servers can send a reasonable content-type header in GET/HEAD responses.

yea limiting file types doesn't make much sense, extension can be anything and they are often/usually encrypted

In XEP-0505, the file type restriction is due to the file being further processed by the form processor. In that case a file type restriction can make sense (as the processing will fail if the file type mismatches)

I mean in the Prosody you can specify allowed file types I.e. allow images but not binaries. But a user may not now that his zip will be rejected

why though ? because a user who wants to share a zip will just rename it to end in png

This is a protection from fishing. An attacker may upload an exe file and inexperienced user may download it. But even if it will be renamed to png that would be enough protection for my old mom because she can't rename files

> why though ? because a user who wants to share a zip will just rename it to end in png Then you can check magic bytes, or check the mimetype if they forgot to also edit that ↺

not really a thing in practice, you can easily hide an executable in a jpg or whatever

>> why though ? because a user who wants to share a zip will just rename it to end in png > > Then you can check magic bytes, or check the mimetype if they forgot to also edit that nope, see: encryption ↺

> File Uploads may have a limited file types that are allowed to upload. The discovery allow to specify file max size in a form, maybe we can add the allowed file types too? Then a client can hide unsupported files in a file chooser dialog. > > https://xmpp.org/extensions/xep-0363.html You can look at the filename, but that's not future proof ↺

Nor does it protect against OMEMO-encrypted files that are renamed to something else

Maybe someday there'll be a new XEP that also encrypts the filename

good clients will never use the original filename with encryption, conversations for example

But do they preserve the file extension?

I think so

That's what I'm talking about

There might be a new XEP that'll encrypt the file extension too, then you (as the host) will have no info to go off of

nothing stops a client from randomizing the extension right now

Yes but you need the other side to unscramble the extension

For it to be useful

Maybe include it within the fragment part of the URL (where the AES-256 key is stored)

or you could sniff content after decryption

but yea SCE encrypts all the XML and not just the body so you can put lots more structured data in there