IRC/libcommuni backend: newline/multi line broken #305
Comments
|
I have take a bit more look on it and see issue is different, yes, we need to make two commands from one message |
Niluge-KiWi
changed the title
|
OK, I'll work soon on a spectrum2 PR to split messages into multiple commands ! |
|
By the way, how it works with libpurple-irc plugin? |
|
I was not aware spectrum2 supported libpurple irc as backend, this is not documented: https://spectrum.im/documentation/backends/libpurple.html They seem to split the outgoing message on each As a side note, which was going to be my next issue and PR, they also handle max size for irc messages by also splitting the message into multiple |
I'm thinking it is documented :D |
Indeed, I did not see that... The big table of protocols made me think it was the whole list, without IRC... Anyway, here is a PR: #306 ! |
Setup
Scenario
xmpp client sends a message in a room with multiple lines:
Expected result
Since IRC (version < 3) forbids CR and LF (newlines), I expect the message to either be rejected (not sure if it's possible...) or better: converted into multiple IRC messages: one per line.
Actual result
First line is correctly sent, but the second line is interpreted as a command by the IRC server, and rejects it as unknown.
Analysis
Spectrum frontend logs
spectrum backend logs
network trace between spectrum backend and IRC server
(technically it's just a
LF(0x0A) betweenAandB, instead of a fullCRLF, but the server (ZNC) seems to tolerate that and interpret it asCRLFanyway, and the issue is the same: we could probably construct an xmpp message withCRLF).Expected network trace
In fact it could even be used to inject any IRC command, maybe creating security issues?
How to fix it?
I followed the code and found that the message is directly passed to
libcommuni:spectrum2/backends/libcommuni/ircnetworkplugin.cpp
Line 211 in 4bb61b9
Maybe the message could be split there? Or should it be
libcommunito handle that? I could not find any issue or documentation here or there about newline/multi lines...I'm willing to create a PR to fix this issue in spectrum2 if a maintainer confirms the strategy for the fix.
The text was updated successfully, but these errors were encountered: