[Standards] OBSOLETED: XEP-0071 (XHTML-IM)

Jonas Wielicki jonas at wielicki.name
Wed Mar 7 18:18:46 UTC 2018

Due to popular request, I’m going to re-post the reply I gave earlier on 

The core reason is that it caused quite a few XSS vulnerabilities. There are 
lengthy threads on the standars mailing list:

* starting with Security issues with XHTML-IM (again) [1]
* some discussion on replacement in Rich(er) text in IM vs XHTML docs [2] 
* collection of replacement requirements in Formatting Use Cases [3]

And much more. I recommend you to browse the archives if you really want to 
get the whole picture. The XMPP standards community has discussed this at 
length and the final ruling of the council is in the respective meeting 
minutes: Council Minutes 2018-02-14 [4] and MUC logs of the meeting [5]. 


As for an replacement, it depends on your use-case. There’s [XEP-0393] 
(Message Styling) which should cover many IM use-cases. I started to work on 
[XEP-0394] (Message Markup) which intends to do a bit more, with a more 
flexible approach. Note that I intend to overhaul XEP-0394 and I don’t know of 
any implementations. XEP-0393 is implemented in a few clients already (I know 
of Conversations and yaxim).

kind regards,

   [1]: https://mail.jabber.org/pipermail/standards/2017-October/033546.html
   [2]: https://mail.jabber.org/pipermail/standards/2017-October/033596.html
   [3]: https://mail.jabber.org/pipermail/standards/2017-October/033702.html
   [4]: https://mail.jabber.org/pipermail/standards/2018-February/034302.html
   [5]: http://logs.xmpp.org/council/2018-02-14/#16:03:14
   [XEP-0393]: https://xmpp.org/extensions/xep-0393.html
   [XEP-0394]: https://xmpp.org/extensions/xep-0394.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://mail.jabber.org/pipermail/standards/attachments/20180307/5660e81b/attachment-0001.sig>

More information about the Standards mailing list