Changeset 86fd261 for otr.c


Ignore:
Timestamp:
2015-08-11T06:48:25Z (6 years ago)
Author:
dequis <dx@…>
Branches:
master
Children:
b39859e
Parents:
654112d4
git-author:
dequis <dx@…> (11-08-15 06:40:11)
git-committer:
dequis <dx@…> (11-08-15 06:48:25)
Message:

otr: add otr_filter_colors, replaces '\x03' with '?' for "security"

Fixes trac ticket 835, "an attacker can spoof color codes"

Which had "major" priority, and was open for a few years.

Yeah.

Every time I looked at that ticket I thought about lowering the
priority, but then saw that pesco opened the bug. Welp.

Anyway, it's gone now. Yay.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • otr.c

    r654112d4 r86fd261  
    215215/* close all active OTR connections */
    216216void otr_disconnect_all(irc_t *irc);
     217
     218/* modifies string in-place, replacing \x03 with '?',
     219   as a quick way to prevent remote users from messing with irc colors */
     220static char *otr_filter_colors(char *msg);
    217221
    218222/* functions to be called for certain events */
     
    454458        } else if (!newmsg) {
    455459                /* this was a non-OTR message */
    456                 return msg;
     460                return otr_filter_colors(msg);
    457461        } else {
    458462                /* we're done with the original msg, which will be caller-freed. */
     
    745749}
    746750
     751static char *otr_filter_colors(char *msg) {
     752        int i;
     753        for (i = 0; msg[i]; i++) {
     754                if (msg[i] == '\x03') {
     755                        msg[i] = '?';
     756                }
     757        }
     758        return msg;
     759}
     760
    747761/* returns newly allocated string */
    748762static char *otr_color_encrypted(char *msg, char *color, gboolean is_query) {
     
    777791                }
    778792
    779                 g_string_append(out, line);
     793                g_string_append(out, otr_filter_colors(line));
    780794        }
    781795
Note: See TracChangeset for help on using the changeset viewer.