Project

General

Profile

How TIgase handles special XML characters

Igor Khomenko
Added over 4 years ago

I have just found a case with "<" character where Tigase disconnects user

For example user sends next message

<message id="1412106001.487349" type="chat" to="15294386@chatstage.domain.com"><body>bana < na</body></message>

and user gets disconnected with error "Socket closed by remote peer"

I know that all next symbols

 "&", "<", ">", "\"", "\'"  

must be escaped as

"&amp;", "&lt;", "&gt;", "&quot;", "&apos;"

on the client side.

But is it possible to just skip such packets on the server side, not disconnect user?


Replies (8)

Avatar?id=6023&size=32x32

Added by Artur Hefczyc TigaseTeam over 4 years ago

Such characters make malformed XML data in the stream and the specification requires the server (or a client) to close the connection in such a case.

Please note, skipping such a packet is not even possible because when we have character like '<' or '>' it corrupts data in such a way that we cannot tell where/when is the end of the packet and what part actually should be skipped.

Added by Igor Khomenko over 4 years ago

Thanks,

I found this code in XMPPIOService class:

parser.parse(domHandler, data, 0, data.length);
if (domHandler.parseError()) {

    forceStop();

    return;
}

Can we just skip this packet by replacing

forceStop();

return;

with

data = readData();

continue;

What caveats do you see with this solution?

Added by Igor Khomenko over 4 years ago

Well, I went this way and looks like it works, at least for 1-1 chat

I replaced

forceStop();

return;

with

int elementsLimit = domHandler.getElementsLimit();
getSessionData().remove(domHandler);
domHandler = new XMPPDomBuilderHandler<RefObject>(this);
domHandler.setElementsLimit(elementsLimit);
getSessionData().put( DOM_HANDLER, domHandler );

readCompleted();
data = readData();
 continue;

what do you think about it?

Avatar?id=6023&size=32x32

Added by Artur Hefczyc TigaseTeam over 4 years ago

It may work but results are unpredictable. The use case you show us above is easy and most likely will not cause any problems but there are cases which can mess-up parser and cause OOM. Also, this way you make your installation vulnerable to garbage or binary data sent to the port which may also cause OOM or other side-effects.

Added by Igor Khomenko over 4 years ago

Okay, thanks Artur,

I have another case there, where server doesn't disconnect a user

for example User sent next message:

<message id="5448a98b86" type="groupchat" to="654@muc.chat.server.com"><body><banana984943658></body></message>

as you can see, I added body in brackets <>

so, server parses well this data, but after this message User can't do anything - server doesn't handle all further requests - just no response. User sends a presence - no response.

What can be the issue here?

I understand that user has to escape all such characters, but still

Avatar?id=6023&size=32x32

Added by Artur Hefczyc TigaseTeam over 4 years ago

Tigase does not perform a strict XML checking and validation. What the parser is doing really is this:

  1. It detects the first, top element for the incoming stanza ( in this case)

  2. Than it builds a simple DOM structure with all child elements it finds using stack to mark start of the element (i.e. ) and end of the element (i. e. )

  3. Until all child elements are closed by a corresponding closing element

  4. And until it finds the closing of the top element ( in this case)

What happens here is this:

It finds an opening child element: **** but it never finds a closing corresponding element. So everything which comes after this is considered a child of the **** stanza, all subsequent presence packets, iq, anything until it reach the limit of the stanza size at which point connection will be dropped.

Added by Igor Khomenko over 4 years ago

Ok, so,

what to do on this situation?

After this message user is stuck, he can't do anything, server doesn't handle all further requests - just no response. Server doesn't drop a connection.

So there is no a way to understand on the client side that something wrong happened.

Avatar?id=6023&size=32x32

Added by Artur Hefczyc TigaseTeam over 4 years ago

You need to fix your client to make sure it sends well-formed XML stanzas. This is the best way to solve the problem.

The server would eventually drop the connection when the number of elements in the stanza reach the limit. But if the client does not send too much data it may take some time.

    (1-8/8)