Changes in / [e4fc493:191ac9d]

Files:

• configure (modified) (1 diff)
• otr.c (modified) (7 diffs)
• protocols/msn/ns.c (modified) (1 diff)
• protocols/msn/soap.c (modified) (1 diff)

configure

@@ -28 +28 @@
 yahoo=1
 twitter=1
-twitter=1
 purple=0
 

otr.c

@@ -185 +185 @@
 /* find a private key by fingerprint prefix (given as any number of hex strings) */
 OtrlPrivKey *match_privkey(irc_t *irc, const char **args);
+
+/* check whether a string is safe to use in a path component */
+int strsane(const char *s);
 
 /* functions to be called for certain events */
@@ -275 +278 @@
         int kg=0;
 
-        g_snprintf(s, 511, "%s%s.otr_keys", global.conf->configdir, irc->user->nick);
-        e = otrl_privkey_read(irc->otr->us, s);
-        if(e && e!=enoent) {
-                irc_rootmsg(irc, "otr load: %s: %s", s, gcry_strerror(e));
-        }
-        g_snprintf(s, 511, "%s%s.otr_fprints", global.conf->configdir, irc->user->nick);
-        e = otrl_privkey_read_fingerprints(irc->otr->us, s, NULL, NULL);
-        if(e && e!=enoent) {
-                irc_rootmsg(irc, "otr load: %s: %s", s, gcry_strerror(e));
+        if(strsane(irc->user->nick)) {
+                g_snprintf(s, 511, "%s%s.otr_keys", global.conf->configdir, irc->user->nick);
+                e = otrl_privkey_read(irc->otr->us, s);
+                if(e && e!=enoent) {
+                        irc_rootmsg(irc, "otr load: %s: %s", s, gcry_strerror(e));
+                }
+                g_snprintf(s, 511, "%s%s.otr_fprints", global.conf->configdir, irc->user->nick);
+                e = otrl_privkey_read_fingerprints(irc->otr->us, s, NULL, NULL);
+                if(e && e!=enoent) {
+                        irc_rootmsg(irc, "otr load: %s: %s", s, gcry_strerror(e));
+                }
         }
         
@@ -306 +311 @@
         gcry_error_t e;
 
-        g_snprintf(s, 511, "%s%s.otr_fprints", global.conf->configdir, irc->user->nick);
-        e = otrl_privkey_write_fingerprints(irc->otr->us, s);
-        if(e) {
-                irc_rootmsg(irc, "otr save: %s: %s", s, gcry_strerror(e));
-        }
-        chmod(s, 0600);
+        if(strsane(irc->user->nick)) {
+                g_snprintf(s, 511, "%s%s.otr_fprints", global.conf->configdir, irc->user->nick);
+                e = otrl_privkey_write_fingerprints(irc->otr->us, s);
+                if(e) {
+                        irc_rootmsg(irc, "otr save: %s: %s", s, gcry_strerror(e));
+                }
+                chmod(s, 0600);
+        }
 }
 
@@ -318 +325 @@
         char s[512];
         
-        g_snprintf(s, 511, "%s%s.otr_keys", global.conf->configdir, nick);
-        unlink(s);
-        g_snprintf(s, 511, "%s%s.otr_fprints", global.conf->configdir, nick);
-        unlink(s);
+        if(strsane(nick)) {
+                g_snprintf(s, 511, "%s%s.otr_keys", global.conf->configdir, nick);
+                unlink(s);
+                g_snprintf(s, 511, "%s%s.otr_fprints", global.conf->configdir, nick);
+                unlink(s);
+        }
 }
 
@@ -328 +337 @@
         char s[512], t[512];
         
-        g_snprintf(s, 511, "%s%s.otr_keys", global.conf->configdir, onick);
-        g_snprintf(t, 511, "%s%s.otr_keys", global.conf->configdir, nnick);
-        rename(s,t);
-        g_snprintf(s, 511, "%s%s.otr_fprints", global.conf->configdir, onick);
-        g_snprintf(t, 511, "%s%s.otr_fprints", global.conf->configdir, nnick);
-        rename(s,t);
+        if(strsane(nnick) && strsane(onick)) {
+                g_snprintf(s, 511, "%s%s.otr_keys", global.conf->configdir, onick);
+                g_snprintf(t, 511, "%s%s.otr_keys", global.conf->configdir, nnick);
+                rename(s,t);
+                g_snprintf(s, 511, "%s%s.otr_fprints", global.conf->configdir, onick);
+                g_snprintf(t, 511, "%s%s.otr_fprints", global.conf->configdir, nnick);
+                rename(s,t);
+        }
 }
 
@@ -1777 +1788 @@
         irc_rootmsg(irc, "%s", msg);
         if(filename[0]) {
-                char *kf = g_strdup_printf("%s%s.otr_keys", global.conf->configdir, irc->user->nick);
-                char *tmp = g_strdup_printf("%s.new", kf);
-                copyfile(filename, tmp);
-                unlink(filename);
-                rename(tmp,kf);
-                otrl_privkey_read(irc->otr->us, kf);
-                g_free(kf);
-                g_free(tmp);
+                if(strsane(irc->user->nick)) {
+                        char *kf = g_strdup_printf("%s%s.otr_keys", global.conf->configdir, irc->user->nick);
+                        char *tmp = g_strdup_printf("%s.new", kf);
+                        copyfile(filename, tmp);
+                        unlink(filename);
+                        rename(tmp,kf);
+                        otrl_privkey_read(irc->otr->us, kf);
+                        g_free(kf);
+                        g_free(tmp);
+                } else {
+                        otrl_privkey_read(irc->otr->us, filename);
+                        unlink(filename);
+                }
         }
         
@@ -1859 +1875 @@
 }
 
+/* check whether a string is safe to use in a path component */
+int strsane(const char *s)
+{
+        return strpbrk(s, "/\\") == NULL;
+}
+
 /* vim: set noet ts=4 sw=4: */

protocols/msn/ns.c

@@ -480 +480 @@
                 else
                 {
-                        imcb_error( ic, "Session terminated by remote server (reason unknown)" );
+                        imcb_error( ic, "Session terminated by remote server (%s)",
+                                    cmd[1] ? cmd[1] : "reason unknown)" );
                 }
                 

protocols/msn/soap.c

@@ -215 +215 @@
                 return;
         
-        if( ( s = strstr( headers, "\r\n\r\n" ) ) )
-                st = write( 1, headers, s - headers + 4 );
-        else
-                st = write( 1, headers, strlen( headers ) );
+        if( headers )
+        {
+                if( ( s = strstr( headers, "\r\n\r\n" ) ) )
+                        st = write( 1, headers, s - headers + 4 );
+                else
+                        st = write( 1, headers, strlen( headers ) );
+        }
         
 #ifdef DEBUG
+        if( payload )
         {
                 struct xt_node *xt = xt_from_string( payload );