security: harden untrusted-input handling (issue #148)

T02: guard the receive-path handlers that dereferenced jid_create()
without a NULL check — MUC join errors, subscribed/unsubscribed
presence and, with silence.non-roster enabled, every incoming message.
A stanza with a missing or malformed 'from' crashed the client
(REQ-INP-01)

T11: restrict /url open and /url save to http, https and aesgcm, so a
received file:, javascript: or data: URL is refused (REQ-INP-06); spawn
terminal-notifier through g_spawn_async with an argv instead of
building a shell command for system() (REQ-INP-07); apply the XEP-0359
disco gate to MAM result ids, as live stanza-ids already do
(REQ-INP-05); replace control and bidi-reordering characters in
incoming message bodies with U+FFFD before they reach the terminal, the
logs and the database, keeping LRM/RLM for legitimate RTL text
(REQ-INP-08); cover JID part-length boundaries and invalid UTF-8
(REQ-INP-02)

T10: replace strcpy/strcat/alloca and sprintf with g_strdup_printf and
g_snprintf (REQ-MEM-03); allocate the OMEMO key buffers with g_malloc
so a failed allocation cannot reach the following memcpy (REQ-MEM-04);
remove the variable-length arrays and enforce -Werror=vla. Two of them
were sized from remote input: the disco#info feature count and a chat
message word length. The flag also caught a one-past-the-end write and
a leak in the plugin autocompleter bindings (REQ-MEM-09)

tests/unittests/test_common.c

@@ -1384,3 +1384,43 @@ str_xml_sanitize__strips_illegal_characters(void** state)
     assert_string_equal("UTF-8: üñîçøðé  and more", res5);
     g_free(res5);
 }
+
+void
+neutralize_untrusted_keeps_plain_text(void** state)
+{
+    gchar* result = str_neutralize_untrusted("hello world\ttabbed\nnewline");
+    assert_string_equal("hello world\ttabbed\nnewline", result);
+    g_free(result);
+}
+
+void
+neutralize_untrusted_replaces_escape_sequence(void** state)
+{
+    gchar* result = str_neutralize_untrusted("safe\x1b[31mred");
+    assert_string_equal("safe\xef\xbf\xbd[31mred", result);
+    g_free(result);
+}
+
+void
+neutralize_untrusted_replaces_bidi_override(void** state)
+{
+    // U+202E RIGHT-TO-LEFT OVERRIDE
+    gchar* result = str_neutralize_untrusted("file\xe2\x80\xaegnp.exe");
+    assert_string_equal("file\xef\xbf\xbdgnp.exe", result);
+    g_free(result);
+}
+
+void
+neutralize_untrusted_keeps_rtl_marks(void** state)
+{
+    // U+200F RIGHT-TO-LEFT MARK is legitimate in RTL text
+    gchar* result = str_neutralize_untrusted("\xe2\x80\x8fשלום");
+    assert_string_equal("\xe2\x80\x8fשלום", result);
+    g_free(result);
+}
+
+void
+neutralize_untrusted_handles_null(void** state)
+{
+    assert_null(str_neutralize_untrusted(NULL));
+}

tests/unittests/test_common.h

@@ -66,3 +66,8 @@ void release_is_new__tests__various(void** state);
 void str_xml_sanitize__strips_illegal_characters(void** state);
 
 #endif
+void neutralize_untrusted_keeps_plain_text(void** state);
+void neutralize_untrusted_replaces_escape_sequence(void** state);
+void neutralize_untrusted_replaces_bidi_override(void** state);
+void neutralize_untrusted_keeps_rtl_marks(void** state);
+void neutralize_untrusted_handles_null(void** state);

tests/unittests/unittests.c

@@ -183,6 +183,11 @@ main(int argc, char* argv[])
         cmocka_unit_test(jid_is_valid_user_jid__is__true_for_at_in_resource),
         cmocka_unit_test(jid_is_valid_user_jid__is__false_for_domain_jid),
         cmocka_unit_test(jid_is_valid_user_jid__is__false_for_invalid_jid),
+        cmocka_unit_test(jid_is_valid__boundary__localpart_length),
+        cmocka_unit_test(jid_is_valid__boundary__domainpart_length),
+        cmocka_unit_test(jid_is_valid__boundary__resourcepart_length),
+        cmocka_unit_test(jid_is_valid__boundary__total_length),
+        cmocka_unit_test(jid_is_valid__is__false_for_invalid_utf8),
         cmocka_unit_test(jid_is_valid__is__true_for_valid_jid),
         cmocka_unit_test(jid_is_valid__is__false_for_invalid_jid),
         cmocka_unit_test(jid_is_valid__is__false_for_null),
@@ -687,6 +692,11 @@ main(int argc, char* argv[])
         cmocka_unit_test(get_mentions__tests__various),
         cmocka_unit_test(release_is_new__tests__various),
         cmocka_unit_test(str_xml_sanitize__strips_illegal_characters),
+        cmocka_unit_test(neutralize_untrusted_keeps_plain_text),
+        cmocka_unit_test(neutralize_untrusted_replaces_escape_sequence),
+        cmocka_unit_test(neutralize_untrusted_replaces_bidi_override),
+        cmocka_unit_test(neutralize_untrusted_keeps_rtl_marks),
+        cmocka_unit_test(neutralize_untrusted_handles_null),
 
         cmocka_unit_test_setup_teardown(plugins_get_command_names__returns__no_commands,
                                         load_preferences,

tests/unittests/xmpp/test_jid.c

@@ -370,3 +370,75 @@ jid_is_valid__is__false_for_empty_string(void** state)
 {
     assert_false(jid_is_valid(""));
 }
+
+/* RFC 6122 size limits: 1023 bytes per part, 3071 for the full JID */
+void
+jid_is_valid__boundary__localpart_length(void** state)
+{
+    gchar* local_ok = g_strnfill(1023, 'a');
+    gchar* jid_ok = g_strdup_printf("%s@domain", local_ok);
+    assert_true(jid_is_valid(jid_ok));
+
+    gchar* local_over = g_strnfill(1024, 'a');
+    gchar* jid_over = g_strdup_printf("%s@domain", local_over);
+    assert_false(jid_is_valid(jid_over));
+
+    g_free(local_ok);
+    g_free(jid_ok);
+    g_free(local_over);
+    g_free(jid_over);
+}
+
+void
+jid_is_valid__boundary__domainpart_length(void** state)
+{
+    gchar* domain_ok = g_strnfill(1023, 'd');
+    assert_true(jid_is_valid(domain_ok));
+
+    gchar* domain_over = g_strnfill(1024, 'd');
+    assert_false(jid_is_valid(domain_over));
+
+    g_free(domain_ok);
+    g_free(domain_over);
+}
+
+void
+jid_is_valid__boundary__resourcepart_length(void** state)
+{
+    gchar* res_ok = g_strnfill(1023, 'r');
+    gchar* jid_ok = g_strdup_printf("user@domain/%s", res_ok);
+    assert_true(jid_is_valid(jid_ok));
+
+    gchar* res_over = g_strnfill(1024, 'r');
+    gchar* jid_over = g_strdup_printf("user@domain/%s", res_over);
+    assert_false(jid_is_valid(jid_over));
+
+    g_free(res_ok);
+    g_free(jid_ok);
+    g_free(res_over);
+    g_free(jid_over);
+}
+
+void
+jid_is_valid__boundary__total_length(void** state)
+{
+    // 1023 + '@' + 1023 + '/' + 1023 = 3071, the largest legal JID
+    gchar* local = g_strnfill(1023, 'a');
+    gchar* domain = g_strnfill(1023, 'd');
+    gchar* res = g_strnfill(1023, 'r');
+    gchar* jid_max = g_strdup_printf("%s@%s/%s", local, domain, res);
+    assert_true(jid_is_valid(jid_max));
+
+    g_free(local);
+    g_free(domain);
+    g_free(res);
+    g_free(jid_max);
+}
+
+void
+jid_is_valid__is__false_for_invalid_utf8(void** state)
+{
+    assert_false(jid_is_valid("user\xff\xfe@domain"));
+    assert_false(jid_is_valid("us\xc3@domain")); // truncated multi-byte sequence
+    assert_false(jid_is_valid("user@domain/res\x80")); // stray continuation byte
+}

tests/unittests/xmpp/test_jid.h

@@ -41,3 +41,8 @@ void jid_is_valid__is__false_for_null(void** state);
 void jid_is_valid__is__false_for_empty_string(void** state);
 
 #endif
+void jid_is_valid__boundary__localpart_length(void** state);
+void jid_is_valid__boundary__domainpart_length(void** state);
+void jid_is_valid__boundary__resourcepart_length(void** state);
+void jid_is_valid__boundary__total_length(void** state);
+void jid_is_valid__is__false_for_invalid_utf8(void** state);