iq 'from' attributes are not checked everywhere about strophejs

[Gordin]

Thanks for finding this, there really is no check for this in strophe. I made a fix here: Gordin/strophejs@strophe:master...websocket
This allows more than the RFC does when the to is empty because some servers are broken, but spoofing should not be possible any more.
Can you test this and verify that this fixes the problem?

[xnyhps]

Sorry for the delay. I've verified that it works with those changes, the spoofed replies are now properly ignored.

[isfarax]

errrm, do you guys realise that some stanzas are not required to have certain attributes.

for example, when requesting your own vCard, you do not always need to provide 'from' attribute.

[xnyhps]

@isfarax A client never needs to specify a 'from' attribute. This isn't about specifying attributes, this is about verifying them on incoming stanzas.
If you request your own vCard, you want to make sure the reply comes from your own server, not from a malicious contact.

[isfarax]

ok, makes sense.

Can you give us a method to repeat this scenario please. I would like to investigate this problem.

[Flowdalic]

Is this issue fixed?

[jcbrand]

This appears to be fixed in 42340f5

Closing.