message, caption: mention offsets point past characters XML cannot carry #24

New issue

Closed

opened 2026-11-07 21:54:42 +00:00 by asxpi · 1 comment

asxpi commented

2026-11-07 21:54:42 +00:00

Member

Summary

message send drops the characters XML 1.0 forbids from the body (XmlText)
and then checks the caller's -mentions against the cleaned body without
moving them. When something is stripped before a mention, its
<reference/>/<mention/> (and the stored row) point at the wrong text.
Captions (send_file, send_album, set_caption) have the same problem.

Spec

XEP-0426 0.3.0 §2: offsets index the body as sent, counted in code points.

Steps to reproduce

message send -chat ai1b@… -body "bad112af0 ctl\x01 nonchar lone\uD83D @Bee end" \
  -mentions [{begin 30 end 34 uri xmpp:ai1b@…}]

30..34 is @Bee in the body as given.

Expected

<reference begin='28' end='32'/>, which is @Bee in the body sent (or the send refused).

Actual

<body>bad112af0 ctl nonchar lone� @Bee end</body>
<reference xmlns='urn:xmpp:reference:0' begin='30' end='34' type='mention' uri='xmpp:ai1b@prosody.asxp.io'/>

30..34 now covers ee e.

The same happens in an OMEMO chat (reproduced by hand in anotherim-js
0.8.0-beta5 on 2026-11-08 with OMEMO on): the body sealed in the envelope is
stripped as well, and the mention keeps its old offsets. In a client this
shows as the wrong text highlighted, or no highlight at all when the shifted
end runs past the body, in the sender's own row too. A paste of
hi\x01\x02 before a picked @Nick is enough.

Root cause

tacky/xmpp/modules/message.tcl:5089-5091 (1dae0a6c): XmlText, then
CheckMentions on the cleaned body. CaptionMentions shifts only for the
trimmed leading space.

Affected versions

v1.2.0-rc2 and v1.2.0 (1dae0a6c).

Interop runs

rc2: https://dev.another.im/another-im/interop/src/branch/ai-runs-2026-11-07/runs/20261107-132640-XEP-0426-slixmpp-prosody (also anotherim-server 131221 and ejabberd 153155)
v1.2.0: https://dev.another.im/another-im/interop/src/branch/ai-runs-2026-11-07/runs/20261107-190433-XEP-0426-slixmpp-prosody (R9 FAIL)

## Summary `message send` drops the characters XML 1.0 forbids from the body (`XmlText`) and then checks the caller's `-mentions` against the cleaned body without moving them. When something is stripped before a mention, its `<reference/>`/`<mention/>` (and the stored row) point at the wrong text. Captions (`send_file`, `send_album`, `set_caption`) have the same problem. ## Spec XEP-0426 0.3.0 §2: offsets index the body as sent, counted in code points. ## Steps to reproduce ``` message send -chat ai1b@… -body "bad112af0 ctl\x01 nonchar lone\uD83D @Bee end" \ -mentions [{begin 30 end 34 uri xmpp:ai1b@…}] ``` `30..34` is `@Bee` in the body as given. ## Expected `<reference begin='28' end='32'/>`, which is `@Bee` in the body sent (or the send refused). ## Actual ```xml <body>bad112af0 ctl nonchar lone� @Bee end</body> <reference xmlns='urn:xmpp:reference:0' begin='30' end='34' type='mention' uri='xmpp:ai1b@prosody.asxp.io'/> ``` `30..34` now covers `ee e`. The same happens in an OMEMO chat (reproduced by hand in anotherim-js 0.8.0-beta5 on 2026-11-08 with OMEMO on): the body sealed in the envelope is stripped as well, and the mention keeps its old offsets. In a client this shows as the wrong text highlighted, or no highlight at all when the shifted end runs past the body, in the sender's own row too. A paste of `hi\x01\x02 ` before a picked `@Nick` is enough. ## Root cause `tacky/xmpp/modules/message.tcl:5089-5091` (1dae0a6c): `XmlText`, then `CheckMentions` on the cleaned body. `CaptionMentions` shifts only for the trimmed leading space. ## Affected versions v1.2.0-rc2 and v1.2.0 (1dae0a6c). ## Interop runs - rc2: https://dev.another.im/another-im/interop/src/branch/ai-runs-2026-11-07/runs/20261107-132640-XEP-0426-slixmpp-prosody (also anotherim-server 131221 and ejabberd 153155) - v1.2.0: https://dev.another.im/another-im/interop/src/branch/ai-runs-2026-11-07/runs/20261107-190433-XEP-0426-slixmpp-prosody (R9 FAIL)

asxpi referenced this issue from a pull request that will close it,

2026-11-07 21:57:39 +00:00

message, caption: move mention offsets past the characters XML cannot carry #25

asxpi referenced this issue from another-im/interop

2026-11-07 21:58:03 +00:00

Verify libtacky bugs from the AI interop runs (v1.2.0-rc2, 71 found) #1

asxpi commented

2026-11-08 00:19:37 +00:00

Author

Member

Fixed upstream in v1.2.1 by 67d627cf ("message: mentions move past the characters XML cannot carry, so a mention still marks the words it marked (interop C3)"). It has the same code and tests as this branch (git patch-id), so this is closed as a duplicate.

Found by hand since filing, in anotherim-js develop with libtacky develop 56d29734:

The bug also hits OMEMO chats.
Second symptom: when the mention is the last thing in the message, the stripped characters push its end past the body, message send refuses the whole send, and the message silently isn't sent.
With the fix, the same message goes out with begin='3' end='21' (exactly @Nick).

Fixed upstream in v1.2.1 by 67d627cf ("message: mentions move past the characters XML cannot carry, so a mention still marks the words it marked (interop C3)"). It has the same code and tests as this branch (`git patch-id`), so this is closed as a duplicate. Found by hand since filing, in anotherim-js `develop` with libtacky `develop` 56d29734: - The bug also hits **OMEMO chats**. - **Second symptom:** when the mention is the last thing in the message, the stripped characters push its end past the body, `message send` refuses the whole send, and the message silently isn't sent. - With the fix, the same message goes out with `begin='3' end='21'` (exactly `@Nick`).

asxpi closed this issue

2026-11-08 00:19:38 +00:00