fix(ui,db): harden NULL handling, fix CWE-134, optimize iterations

security(CWE-134): fix format string injections + add CI check
fix(ui): subwindow lifecycle, newwin/newpad guards, fallback timestamps
fix(db): sqlite cleanup on failures, sqlite3_close_v2
fix(xmpp): queued_messages loop, barejid leak
perf(core): g_hash_table_iter_init instead of g_hash_table_get_keys
refactor(ui): CLAMP macro in _check_subwin_width
test: XEP-0012 and XEP-0045 functional tests

Author: jabber.developer2
Closes #58, #85

tests/functionaltests/functionaltests.c

@@ -52,6 +52,7 @@
 #include "test_software.h"
 #include "test_muc.h"
 #include "test_disconnect.h"
+#include "test_lastactivity.h"
 
 /* Macro to wrap each test with setup/teardown functions */
 #define PROF_FUNC_TEST(test) cmocka_unit_test_setup_teardown(test, init_prof_test, close_prof_test)
@@ -104,6 +105,10 @@ main(int argc, char* argv[])
         PROF_FUNC_TEST(display_software_version_result_when_from_domainpart),
         PROF_FUNC_TEST(show_message_in_chat_window_when_no_resource),
         PROF_FUNC_TEST(display_software_version_result_in_chat),
+
+        /* Last Activity - XEP-0012 */
+        PROF_FUNC_TEST(responds_to_last_activity_request),
+        PROF_FUNC_TEST(last_activity_request_to_contact),
     };
 
     /* ============================================================
@@ -188,6 +193,10 @@ main(int argc, char* argv[])
         PROF_FUNC_TEST(shows_first_message_in_console_when_window_not_focussed),
         PROF_FUNC_TEST(shows_no_message_in_console_when_window_not_focussed),
 
+        /* MUC moderation - XEP-0045 room admin */
+        PROF_FUNC_TEST(sends_affiliation_list_request),
+        PROF_FUNC_TEST(sends_kick_request),
+
         /* Message Carbons - XEP-0280 (message sync across devices) */
         PROF_FUNC_TEST(send_enable_carbons),
         PROF_FUNC_TEST(connect_with_carbons_enabled),

tests/functionaltests/test_lastactivity.c

@@ -0,0 +1,63 @@
+/*
+ * test_lastactivity.c
+ * Functional tests for Last Activity (XEP-0012)
+ */
+#include <glib.h>
+#include "prof_cmocka.h"
+#include <stdlib.h>
+#include <string.h>
+
+#include <stabber.h>
+
+#include "proftest.h"
+
+void
+responds_to_last_activity_request(void **state)
+{
+    prof_connect();
+
+    // Send incoming last activity request
+    stbbr_send(
+        "<iq id='last1' type='get' to='stabber@localhost/profanity' from='buddy1@localhost/mobile'>"
+            "<query xmlns='jabber:iq:last'/>"
+        "</iq>"
+    );
+
+    // Verify that CProof responds with last activity info
+    // The 'seconds' attribute indicates idle time
+    assert_true(stbbr_received(
+        "<iq id='last1' type='result' to='buddy1@localhost/mobile'>"
+            "<query xmlns='jabber:iq:last' seconds='*'/>"
+        "</iq>"
+    ));
+}
+
+void
+last_activity_request_to_contact(void **state)
+{
+    prof_connect();
+
+    stbbr_send(
+        "<presence to='stabber@localhost' from='buddy1@localhost/mobile'>"
+            "<priority>10</priority>"
+            "<status>I'm here</status>"
+        "</presence>"
+    );
+    assert_true(prof_output_exact("Buddy1 (mobile) is online, \"I'm here\""));
+
+    // Register response for last activity query
+    stbbr_for_query("jabber:iq:last",
+        "<iq id='*' type='result' from='buddy1@localhost/mobile' to='stabber@localhost/profanity'>"
+            "<query xmlns='jabber:iq:last' seconds='120'/>"
+        "</iq>"
+    );
+
+    prof_input("/lastactivity get buddy1@localhost/mobile");
+
+    // Verify the request was sent
+    assert_true(stbbr_received(
+        "<iq id='*' to='buddy1@localhost/mobile' type='get'>"
+            "<query xmlns='jabber:iq:last'/>"
+        "</iq>"
+    ));
+}

tests/functionaltests/test_lastactivity.h

@@ -0,0 +1,7 @@
+/*
+ * test_lastactivity.h
+ * Header for Last Activity tests (XEP-0012)
+ */
+
+void responds_to_last_activity_request(void **state);
+void last_activity_request_to_contact(void **state);

tests/functionaltests/test_muc.c

@@ -393,3 +393,83 @@ shows_no_message_in_console_when_window_not_focussed(void **state)
     assert_false(prof_output_regex("testroom@conference\\.localhost \\(win 2\\)"));
     prof_timeout_reset();
 }
+
+void
+sends_affiliation_list_request(void **state)
+{
+    prof_connect();
+
+    stbbr_for_presence_to("testroom@conference.localhost/stabber",
+        "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<x xmlns='http://jabber.org/protocol/muc#user'>"
+                "<item role='moderator' jid='stabber@localhost/profanity' affiliation='owner'/>"
+            "</x>"
+            "<status code='110'/>"
+        "</presence>"
+    );
+
+    prof_input("/join testroom@conference.localhost");
+    assert_true(prof_output_regex("-> You have joined the room as stabber, role: moderator, affiliation: owner"));
+
+    prof_input("/affiliation owner list");
+
+    assert_true(stbbr_received(
+        "<iq id='*' to='testroom@conference.localhost' type='get'>"
+            "<query xmlns='http://jabber.org/protocol/muc#admin'>"
+                "<item affiliation='owner'/>"
+            "</query>"
+        "</iq>"
+    ));
+}
+
+void
+sends_kick_request(void **state)
+{
+    prof_connect();
+
+    // Enable MUC presence messages to see occupant join/leave
+    prof_input("/presence room all");
+    assert_true(prof_output_regex("All presence updates will appear"));
+
+    stbbr_for_presence_to("testroom@conference.localhost/stabber",
+        "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<x xmlns='http://jabber.org/protocol/muc#user'>"
+                "<item role='moderator' jid='stabber@localhost/profanity' affiliation='admin'/>"
+            "</x>"
+            "<status code='110'/>"
+        "</presence>"
+    );
+
+    prof_input("/join testroom@conference.localhost");
+    assert_true(prof_output_regex("-> You have joined the room as stabber, role: moderator, affiliation: admin"));
+
+    // Simulate another user in the room
+    stbbr_send(
+        "<presence to='stabber@localhost/profanity' from='testroom@conference.localhost/baduser'>"
+            "<x xmlns='http://jabber.org/protocol/muc#user'>"
+                "<item role='participant' jid='baduser@localhost/phone' affiliation='none'/>"
+            "</x>"
+        "</presence>"
+    );
+    sleep(1);
+    assert_true(prof_output_regex("baduser has joined"));
+
+    // Register success response for kick
+    stbbr_for_query("http://jabber.org/protocol/muc#admin",
+        "<iq id='*' type='result' from='testroom@conference.localhost'/>"
+    );
+
+    prof_input("/kick baduser \"spamming\"");
+
+    assert_true(stbbr_received(
+        "<iq id='*' to='testroom@conference.localhost' type='set'>"
+            "<query xmlns='http://jabber.org/protocol/muc#admin'>"
+                "<item nick='baduser' role='none'>"
+                    "<reason>spamming</reason>"
+                "</item>"
+            "</query>"
+        "</iq>"
+    ));
+}

tests/functionaltests/test_muc.h

@@ -12,3 +12,5 @@ void shows_me_message_from_self(void **state);
 void shows_all_messages_in_console_when_window_not_focussed(void **state);
 void shows_first_message_in_console_when_window_not_focussed(void **state);
 void shows_no_message_in_console_when_window_not_focussed(void **state);
+void sends_affiliation_list_request(void **state);
+void sends_kick_request(void **state);