Skip to content

feat: Sanitize illegal XML characters from outgoing messages#2116

Merged
jubalh merged 1 commit intomasterfrom
sanitzexml
Mar 19, 2026
Merged

feat: Sanitize illegal XML characters from outgoing messages#2116
jubalh merged 1 commit intomasterfrom
sanitzexml

Conversation

@jubalh
Copy link
Copy Markdown
Member

@jubalh jubalh commented Mar 19, 2026

Filter out control characters (U+0000 to U+001F) from outgoing messages, as they are illegal in XML 1.0 (except for \t, \n, and \r). This prevents XMPP servers from closing the connection when such characters are accidentally or intentionally included in a message.

Fixes: #1437

@jubalh jubalh added this to the next milestone Mar 19, 2026
@jubalh jubalh requested a review from sjaeckel March 19, 2026 08:42
@jubalh jubalh self-assigned this Mar 19, 2026
Copy link
Copy Markdown
Member

@sjaeckel sjaeckel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Basically LGTM.

Comment thread src/common.c Outdated
Comment thread src/event/client_events.c Outdated
Comment thread src/event/client_events.c Outdated
Comment thread src/event/client_events.c Outdated
Comment thread src/event/client_events.c Outdated
Comment thread src/event/client_events.c Outdated
Comment thread src/event/client_events.c Outdated
Comment thread src/common.c Outdated
Comment thread src/common.h Outdated
Filter out control characters (U+0000 to U+001F) from outgoing
messages, as they are illegal in XML 1.0 (except for \t, \n, and \r).
This prevents XMPP servers from closing the connection when such
characters are accidentally or intentionally included in a message.

Fixes: #1437
@jubalh jubalh merged commit d616e16 into master Mar 19, 2026
7 checks passed
@jubalh jubalh deleted the sanitzexml branch March 19, 2026 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Profanity doesn't prevent sending illegal sequences

2 participants