How can I send an image on the web in an XMPP (Jabber) message?

ruby security image xmpp xmpp4r
Josh picture Josh · Nov 16, 2010 · Viewed 12k times · Source

For the XMPP interface for the Stack Overflow chat, I am currently taking the HTML of the chat messages and converting to valid XML, and setting that as the html child element of the XMPP message object. In my Mac OS X jabber client this was working great! It meant that when users in the SO chat posted a oneboxed image, the image would show up in my XMPP client (Adium for OS X):

My Mind Is Blown

However I just updated Adium to the latest version and apparently they considered what I was doing to be a security hole and against XMPP specs, and changed that behavior. Their reasoning was that XMPP should not reveal your Ip address, and to fetch an image over HTTP would reveal my IP address.

So now the chats are imageless over XMPP. How can I make images work over XMPP? Should my XMPP component download the images and embed them into the <Message> stanzas? Can the images be proxied through the XMPP server? Or is this an impossibility?

Answer

Dan Lecocq picture Dan Lecocq · Oct 8, 2011

Adium, iChat and Pidgin all support XEP-0231, which allows you to send the provide binary data, including images to this purpose. Basically, it allows you to specify a unique identifier as the source for an image, and then the other client can decide if he wants to request the data in a <iq> request.

I've been working with this in python's Twisted, but meeting with some frustration. I do know that Adium and iChat at least use it to request the data.

Related questions

Looking for suggestions for building a secure REST API within Ruby on Rails

I'm getting started on building a REST API for a project I'm working on, and it led me to do a little research as to the best way to build an API using RoR. I find out pretty quickly that …

Read More
Forming sanitary shell commands or system calls in Ruby

I'm building a daemon that will help me manage my server(s). Webmin works fine, as does just opening a shell to the server, but I'd prefer to be able to control server operations from a UI I design, and …

Read More
Secure Password Generation With Random Chars

I am trying to generate a random password that contains special chars using ruby. I would like to know if there is a standard for generating such passwords. I have considered using a weighted probability distribution and assigning weights such …

Read More