2 Commits

Author	SHA1	Message	Date
jabber.developer2	250703a0bf	security: harden untrusted-input handling (issue #148) ... T02: guard the receive-path handlers that dereferenced jid_create() without a NULL check — MUC join errors, subscribed/unsubscribed presence and, with silence.non-roster enabled, every incoming message. A stanza with a missing or malformed 'from' crashed the client (REQ-INP-01) T11: restrict /url open and /url save to http, https and aesgcm, so a received file:, javascript: or data: URL is refused (REQ-INP-06); spawn terminal-notifier through g_spawn_async with an argv instead of building a shell command for system() (REQ-INP-07); apply the XEP-0359 disco gate to MAM result ids, as live stanza-ids already do (REQ-INP-05); replace control and bidi-reordering characters in incoming message bodies with U+FFFD before they reach the terminal, the logs and the database, keeping LRM/RLM for legitimate RTL text (REQ-INP-08); cover JID part-length boundaries and invalid UTF-8 (REQ-INP-02) T10: replace strcpy/strcat/alloca and sprintf with g_strdup_printf and g_snprintf (REQ-MEM-03); allocate the OMEMO key buffers with g_malloc so a failed allocation cannot reach the following memcpy (REQ-MEM-04); remove the variable-length arrays and enforce -Werror=vla. Two of them were sized from remote input: the disco#info feature count and a chat message word length. The flag also caught a one-past-the-end write and a leak in the plugin autocompleter bindings (REQ-MEM-09)	2026-08-01 13:39:19 +03:00
Jabber Developer	72f4f186da	merge: sync upstream profanity-im/profanity ... Sync with upstream profanity-im/profanity. Major upstream changes incorporated: Memory management - Replace malloc+memset with g_new0 throughout codebase - Adopt auto_gchar / auto_gcharv / auto_gerror / auto_jid cleanup macros - Replace free() with g_free() for GAlloc'd memory Editor rewrite - Remove pthread-based async editor; use GChildWatch callback API - New launch_editor(initial_content, callback, user_data) interface - Proper signal handling (SIGINT, SIGTSTP, SIGPIPE reset in child) - ui_suspend()/ui_resume() integration for TTY management OMEMO improvements - Dual backend support: libsignal-protocol-c and libomemo-c - Proper pre-key removal after use (XEP-0384 compliance) - Automatic pre-key regeneration when store drops below threshold - New functions: omemo_is_device_active(), omemo_is_jid_trusted() - omemo_get_jid_untrusted_fingerprints() for better error messages - Fingerprint notifications on new device identity discovery - Deterministic pre-key ID generation tracking max_pre_key_id - omemo_trust_changed() UI updates on trust state changes JID validation - RFC 6122-compliant validation in jid_is_valid() - Character-level checks (RFC 6122 forbidden chars: & ' / : < > @) - Length limits: 1023 per component, 3071 total - New jid_is_valid_user_jid() for user vs. service JID distinction Database - Schema migration v3: UNIQUE constraint on archive_id for deduplication - Triggers for corrected message tracking (replaces_db_id / replaced_by_db_id) - db_history_result_t return type, _truncate_datetime_suffix() UI / console - win_warn_needed() / win_warn_sent() warning deduplication hash table - PAD_MIN_HEIGHT dynamic pad sizing with PAD_THRESHOLD auto-cleanup - Spellcheck integration in input field with Unicode word detection - cons_spellcheck_setting() for /settings ui output - /[command]? shortcut for command help Account config - Account name sanitization for GKeyFile special chars ([ ] = # \n \r) - Replace popen() with g_spawn_sync() for eval_password - TLS policy: add "direct" option alongside legacy Connection - Port validation with g_assert (0–65535) - SHA-256 certificate fingerprint support (XMPP_CERT_PUBKEY_FINGERPRINT_SHA256) - "direct" TLS policy alias for legacy SSL Common utilities - str_xml_sanitize() for XML 1.0 illegal character removal - string_matches_one_of() with formatted error messages - valid_tls_policy_option() helper - prof_date_time_format_iso8601() utility - Improved strip_arg_quotes() with backslash unescaping - prof_occurrences() uses g_slist_prepend + reverse for performance PGP / OX - Proper GPGME resource cleanup with goto-cleanup pattern - g_string_free(xmppuri) leak fix in _ox_key_lookup CSV export - Use GString + g_file_set_contents instead of raw write() syscalls Tests - Restructured into subdirectories: command/, config/, xmpp/, ui/, omemo/, otr/, pgp/ - New test_cmd_ac.c for autocompleter unit tests - Updated stubs for new UI suspend/resume functions License headers - Migrate to SPDX-3.0 identifiers (GPL-3.0-or-later WITH OpenSSL-exception) ──────────────────────────────────────────────────── cproof-specific preservations: - XEP-0308 LMC: replace_id ?: id logic in message/stanza/omemo - Force encryption: cmd_force_encryption, test_forced_encryption - CWE-134: format string protection (cons_show("%s", ...)) - y_start_pos-based paging in window.c - db_history_result_t return type, _truncate_datetime_suffix() Merge-time fixes: - common.c: format-security (-Werror) — cons_show(errmsg) → cons_show("%s", errmsg) - database.c: null-deref guard — !msg->timestamp → msg && !msg->timestamp - console.c: implicit size_t → int cast — (int)(maxlen + 1) - tlscerts.c: %d for size_t — %zu Build system: - Kept autotools (Makefile.am, configure.ac); upstream uses Meson - Restored deleted files: bootstrap.sh, autogen.sh, ax_valgrind_check.m4, configure-debug - Updated Makefile.am test paths for subdirectory structure - Added test_cmd_ac, test_forced_encryption to test sources Functional tests: - Use cproof version; upstream requires stbbr_for_xmlns from updated stabber - Not yet available in devs/stabber fork Closes #64 Merge author: jabber.developer2 Commits authors: Michael Vetter <jubalh@iodoru.org> & Steffen Jaeckel <s@jaeckel.eu>	2026-05-26 17:48:14 +00:00