devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 9 Actions Packages Projects 1 Releases Wiki Activity
7,659 Commits 65 Branches 0 Tags
a283c4e7b49e8e905d899a1cbb45bfed67035c03
Commit Graph

235 Commits

Author SHA1 Message Date
jabber.developer2
a283c4e7b4 fix(xmpp): treat disco#info result without 'from' as from the server
All checks were successful
CI Code / Check spelling (pull_request) Successful in 14s
Details
CI Code / Check coding style (pull_request) Successful in 24s
Details
CI Code / Linux (ubuntu) (pull_request) Successful in 8m29s
Details
CI Code / Linux (debian) (pull_request) Successful in 8m53s
Details
CI Code / Code Coverage (pull_request) Successful in 9m7s
Details
CI Code / Linux (arch) (pull_request) Successful in 12m11s
Details 
RFC 6120 §8.1.2.1: a stanza received over a c2s stream without a 'from'
attribute must be treated as coming from the server itself. The
on-connect disco#info handler passed the absent attribute as NULL into
connection_features_received(), where g_str_hash() dereferenced the NULL
key and crashed (remotely triggerable DoS on connect).

Substitute connection_get_domain() at both disco#info handler
boundaries, and make connection_features_received() and
connection_get_features() NULL-safe as defense in depth. Add a stabber
regression test answering the on-connect disco#info with a from-less
result.

Fixes #168
 2026-07-21 09:09:49 +03:00
Jabber Developer
72f4f186da merge: sync upstream profanity-im/profanity
All checks were successful
CI Code / Check spelling (push) Successful in 18s
Details
CI Code / Check coding style (push) Successful in 34s
Details
CI Code / Code Coverage (push) Successful in 2m36s
Details
CI Code / Linux (debian) (push) Successful in 4m41s
Details
CI Code / Linux (ubuntu) (push) Successful in 4m52s
Details
CI Code / Linux (arch) (push) Successful in 5m40s
Details 
Sync with upstream profanity-im/profanity.

Major upstream changes incorporated:

Memory management
  - Replace malloc+memset with g_new0 throughout codebase
  - Adopt auto_gchar / auto_gcharv / auto_gerror / auto_jid cleanup macros
  - Replace free() with g_free() for GAlloc'd memory

Editor rewrite
  - Remove pthread-based async editor; use GChildWatch callback API
  - New launch_editor(initial_content, callback, user_data) interface
  - Proper signal handling (SIGINT, SIGTSTP, SIGPIPE reset in child)
  - ui_suspend()/ui_resume() integration for TTY management

OMEMO improvements
  - Dual backend support: libsignal-protocol-c and libomemo-c
  - Proper pre-key removal after use (XEP-0384 compliance)
  - Automatic pre-key regeneration when store drops below threshold
  - New functions: omemo_is_device_active(), omemo_is_jid_trusted()
  - omemo_get_jid_untrusted_fingerprints() for better error messages
  - Fingerprint notifications on new device identity discovery
  - Deterministic pre-key ID generation tracking max_pre_key_id
  - omemo_trust_changed() UI updates on trust state changes

JID validation
  - RFC 6122-compliant validation in jid_is_valid()
  - Character-level checks (RFC 6122 forbidden chars: & ' / : < > @)
  - Length limits: 1023 per component, 3071 total
  - New jid_is_valid_user_jid() for user vs. service JID distinction

Database
  - Schema migration v3: UNIQUE constraint on archive_id for deduplication
  - Triggers for corrected message tracking (replaces_db_id / replaced_by_db_id)
  - db_history_result_t return type, _truncate_datetime_suffix()

UI / console
  - win_warn_needed() / win_warn_sent() warning deduplication hash table
  - PAD_MIN_HEIGHT dynamic pad sizing with PAD_THRESHOLD auto-cleanup
  - Spellcheck integration in input field with Unicode word detection
  - cons_spellcheck_setting() for /settings ui output
  - /[command]? shortcut for command help

Account config
  - Account name sanitization for GKeyFile special chars ([ ] = # \n \r)
  - Replace popen() with g_spawn_sync() for eval_password
  - TLS policy: add "direct" option alongside legacy

Connection
  - Port validation with g_assert (0–65535)
  - SHA-256 certificate fingerprint support (XMPP_CERT_PUBKEY_FINGERPRINT_SHA256)
  - "direct" TLS policy alias for legacy SSL

Common utilities
  - str_xml_sanitize() for XML 1.0 illegal character removal
  - string_matches_one_of() with formatted error messages
  - valid_tls_policy_option() helper
  - prof_date_time_format_iso8601() utility
  - Improved strip_arg_quotes() with backslash unescaping
  - prof_occurrences() uses g_slist_prepend + reverse for performance

PGP / OX
  - Proper GPGME resource cleanup with goto-cleanup pattern
  - g_string_free(xmppuri) leak fix in _ox_key_lookup

CSV export
  - Use GString + g_file_set_contents instead of raw write() syscalls

Tests
  - Restructured into subdirectories: command/, config/, xmpp/, ui/, omemo/, otr/, pgp/
  - New test_cmd_ac.c for autocompleter unit tests
  - Updated stubs for new UI suspend/resume functions

License headers
  - Migrate to SPDX-3.0 identifiers (GPL-3.0-or-later WITH OpenSSL-exception)

────────────────────────────────────────────────────
cproof-specific preservations:

  - XEP-0308 LMC: replace_id ?: id logic in message/stanza/omemo
  - Force encryption: cmd_force_encryption, test_forced_encryption
  - CWE-134: format string protection (cons_show("%s", ...))
  - y_start_pos-based paging in window.c
  - db_history_result_t return type, _truncate_datetime_suffix()

Merge-time fixes:

  - common.c: format-security (-Werror) — cons_show(errmsg) → cons_show("%s", errmsg)
  - database.c: null-deref guard — !msg->timestamp → msg && !msg->timestamp
  - console.c: implicit size_t → int cast — (int)(maxlen + 1)
  - tlscerts.c: %d for size_t — %zu

Build system:
  - Kept autotools (Makefile.am, configure.ac); upstream uses Meson
  - Restored deleted files: bootstrap.sh, autogen.sh, ax_valgrind_check.m4, configure-debug
  - Updated Makefile.am test paths for subdirectory structure
  - Added test_cmd_ac, test_forced_encryption to test sources

Functional tests:
  - Use cproof version; upstream requires stbbr_for_xmlns from updated stabber
  - Not yet available in devs/stabber fork

Closes #64

Merge author: jabber.developer2
Commits authors:
 Michael Vetter <jubalh@iodoru.org>
& Steffen Jaeckel <s@jaeckel.eu>
 2026-05-26 17:48:14 +00:00
Jabber Developer
9ec01fa8cc fix: CWE-134 format string audit and compiler hardening
All checks were successful
CI Code / Check spelling (push) Successful in 20s
Details
CI Code / Check coding style (push) Successful in 36s
Details
CI Code / Code Coverage (push) Successful in 5m38s
Details
CI Code / Linux (ubuntu) (push) Successful in 7m1s
Details
CI Code / Linux (debian) (push) Successful in 7m5s
Details
CI Code / Linux (arch) (push) Successful in 7m19s
Details 
Security:
Fix CWE-134 in iq.c: user-controlled string passed as format argument
Add G_GNUC_PRINTF annotations to all variadic printf-like wrappers
in ui.h, log.h and http_common.h
Compiler flags (configure.ac):

Replace basic -Wformat/-Wformat-nonliteral with -Wformat=2
Add -Wextra, -Wnull-dereference, -Wpointer-arith,
-Wimplicit-function-declaration, -Wundef, -Wfloat-equal,
-Wredundant-decls, -Walloc-zero
Add -fstack-protector-strong, -fno-common, -D_FORTIFY_SOURCE=2
Add GCC-specific flags via AC_COMPILE_IFELSE: -Wlogical-op,
-Wduplicated-cond, -Wduplicated-branches, -Wstringop-overflow,
-Warray-bounds=2
Suppress noisy -Wextra sub-warnings: -Wno-unused-parameter,
-Wno-missing-field-initializers, -Wno-sign-compare,
-Wno-cast-function-type
Remove AM_CFLAGS/CFLAGS duplication
Bug fixes found by new warnings:

chatlog.c: non-MUCPM redact path passed resourcepart instead of NULL
rosterwin.c: merge duplicated if/else branches into single condition
omemo.c: redundant else-if in omemo_automatic_start; remove
unnecessary scope block and goto, use early return
console.c: pointer compared to integer 0 instead of NULL
stanza.c: increase pri_str/idle_str buffers from 10 to 12 bytes
(INT_MIN = -2147483648 needs 12 bytes including NUL)
vcard.c: NULL guard for filename before g_file_set_contents
api.c: broken log_warning() calls with extra format argument
Format mismatch fixes:

chatwin.c: Jid* → char* for %s
connection.c: %x → %lx for long flags
cmd_funcs.c: %d → %zu for size_t; cast gpointer to char* for %s
cmd_defs.c: %d → %u for g_list_length() return (guint)
iq.c: barejid → fulljid for from_jid
console.c, mucwin.c, privwin.c, account.c, omemo.c, presence.c:
gpointer → (char*) casts for %s
Const-correctness and cleanup:

database.c: const for type, query, sort variables
form.c/xmpp.h: const for form_set_value parameter
files.c: refactor to early return, eliminating NULL logfile path
muc.c/muc.h: remove meaningless top-level const on return type
common.c: const for URL string literal
Remove stale declarations: cons_show_desktop_prefs (ui.h),
connection_set_priority (connection.h),
omemo_devicelist_configure_and_request (omemo.h)
test_common.c: add currb NULL check to silence -Wnull-dereference
Tooling (check-cwe134.sh):

Reduce from 5 checks to 2 (checks 1-3 redundant with -Wformat=2)
Check 1: verify known wrappers have G_GNUC_PRINTF attribute
Check 2: auto-detect unannotated variadic printf-like functions
Match both const char* and const gchar* in variadic patterns

Author: jabber.developer2 <jabber.developer2@jabber.space>
 2026-03-07 11:55:50 +01:00
Jabber Developer
467222d0ca fix(ui,db): harden NULL handling, fix CWE-134, optimize iterations
Some checks failed
CI Code / Code Coverage (push) Failing after 10m34s
Details
CI Code / Check spelling (push) Failing after 10m47s
Details
CI Code / Check coding style (push) Failing after 11m4s
Details
CI Code / Linux (ubuntu) (push) Failing after 11m19s
Details
CI Code / Linux (debian) (push) Failing after 11m28s
Details
CI Code / Linux (arch) (push) Failing after 11m38s
Details 
security(CWE-134): fix format string injections + add CI check
fix(ui): subwindow lifecycle, newwin/newpad guards, fallback timestamps
fix(db): sqlite cleanup on failures, sqlite3_close_v2
fix(xmpp): queued_messages loop, barejid leak
perf(core): g_hash_table_iter_init instead of g_hash_table_get_keys
refactor(ui): CLAMP macro in _check_subwin_width
test: XEP-0012 and XEP-0045 functional tests

Author: jabber.developer2
Closes #58, #85
 2026-02-06 19:27:40 +01:00
Jabber Developer
84d6253561 fix(xmpp): format debug logging statements for consistency
All checks were successful
CI Code / Check spelling (push) Successful in 16s
Details
CI Code / Check coding style (push) Successful in 33s
Details
CI Code / Linux (arch) (push) Successful in 9m54s
Details
CI Code / Linux (debian) (push) Successful in 13m35s
Details
CI Code / Linux (ubuntu) (push) Successful in 13m56s
Details 
Add debug output tracking connection lifecycle.
    - Track disconnects and reconnects
    - Record session login, logout, and reconnection attempts
    - Use [CONNDBG] tag for easy log filtering
 2025-11-21 10:03:50 +01:00
Jabber Developer
3738be4af1 fix: prevent autoping disable on false negative ping support check
All checks were successful
CI Code / Check spelling (pull_request) Successful in 21s
Details
CI Code / Check coding style (pull_request) Successful in 36s
Details
CI Code / Linux (arch) (pull_request) Successful in 12m57s
Details
CI Code / Linux (ubuntu) (pull_request) Successful in 13m59s
Details
CI Code / Linux (debian) (pull_request) Successful in 16m35s
Details
CI Code / Check spelling (push) Successful in 19s
Details
CI Code / Check coding style (push) Successful in 38s
Details
CI Code / Linux (arch) (push) Successful in 10m10s
Details
CI Code / Linux (debian) (push) Successful in 13m50s
Details
CI Code / Linux (ubuntu) (push) Successful in 16m42s
Details 
Remove autodisable logic (prefs_set_autoping(0)) and early return in autoping
to treat intermittent false negatives from connection_supports(XMPP_FEATURE_PING).
Add one-time error display with debug features print for monitoring; warn on first failing
check without aborting to maintain functionality while investigating root cause.
 2025-10-14 12:42:00 +02:00
Michael Vetter
07dfeec816 Release 0.15.0 2025-03-27 20:06:38 +01:00
Steffen Jaeckel
95c2199ca2 Some more memory improvements 
* Less leaks
* Less allocations

Signed-off-by: Steffen Jaeckel <s@jaeckel.eu>
 2025-03-12 10:09:41 +01:00
Steffen Jaeckel
2696989ce5 Fix a bunch of obvious memory leaks at termination 
Signed-off-by: Steffen Jaeckel <s@jaeckel.eu>
 2025-01-28 16:43:13 +01:00
Michael Vetter
569e37f018 Update copyright to 2024 2024-01-22 16:03:48 +01:00
Steffen Jaeckel
b4c088232e Improve const correctness 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-12-12 18:27:09 +01:00
Steffen Jaeckel
bac24601da Introduce equals_our_barejid() 
Instead of always repeating the same pattern, introduce a helper function.

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-12-12 18:27:02 +01:00
Steffen Jaeckel
835ea397ac Tidy up some code 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-12-12 18:26:21 +01:00
Steffen Jaeckel
847a86de50 add connection_get_jid() 
Use a singleton `Jid` inside the connection instead of always re-creating
a `Jid` from the same string.

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-12-12 18:26:21 +01:00
Steffen Jaeckel
2b51675e89 Save SM queue on /reconnect now 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-12-12 16:31:42 +01:00
Steffen Jaeckel
ff32f51f4f Fix libstrophe verbosity level always being set to 0 on start 
Fixup/revert of e55f6d7f4d

This line had been added because an earlier release of libstrophe missed
the initialisation of that variable, which has since been fixed.

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-12-12 16:30:19 +01:00
Steffen Jaeckel
64046bcdf3 Fix some things regarding char* vs. gchar* 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-12-09 15:09:52 +01:00
Steffen Jaeckel
ca2df180d8 Introduce a shared implementation for keyfile loading 
Instead of copy&pasting the same code over again, use a common
implementation.

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-09-04 09:59:09 +02:00
Michael Vetter
215e35b198 Fix my email address 2023-07-31 16:42:45 +02:00
John Hernandez
029f1caa52 Cleanup jid_destroy to auto_jid 
Remove unused variables
Apply minor cleanups
 2023-07-13 17:05:07 +02:00
John Hernandez
e1d137f4e6 Change char->free to auto_char char for autocleanup 
Replace `gchar` and `g_free` to `auto_gchar`
Correct certain  `char` functions/variables to `gchar`

Related to #1819.

Edited by @jubalh.
 2023-07-11 13:26:37 +02:00
Steffen Jaeckel
8d3c1f79ac fix memory leaks 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-05-10 18:12:11 +02:00
John Hernandez
07cc19ce10 Add sessions_alarm 
Introduce new feature: sessions_alarm.

Added new account setting: max_connections. On exceeding this number,
user will get an alert. If number is less than 1, no alert will happen.

Tests altered to fit new feature.
 2023-04-18 14:28:20 +02:00
Martin Dosch
e1ffc64a65 User proper ellipsis char 
As stated in
https://github.com/profanity-im/profanity/pull/1820#issuecomment-1498083383
profanity uses "..." (three dots) in a lot of places instead the proper
ellipsis char "…".
 2023-04-09 12:19:18 +02:00
Steffen Jaeckel
e99c4b7128 simplify some code 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-03-11 15:05:03 +01:00
Steffen Jaeckel
92eed34fb3 remove compat code 
We already depend on libstrophe >= 0.12, so this code can go.

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-03-11 15:05:03 +01:00
Steffen Jaeckel
b602d619f6 prevent setting invalid combination of libstrophe flags 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-01-27 17:04:48 +01:00
Steffen Jaeckel
b1b6c6f62d add /strophe command to modify libstrophe-specific settings 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-01-18 17:04:41 +01:00
Michael Vetter
3adc399da0 Update copyright year 2023-01-10 10:37:25 +01:00
Steffen Jaeckel
65acffcf07 fixup 11f52ad547 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-08-08 17:15:58 +02:00
Steffen Jaeckel
11f52ad547 integrate XEP-0198 Stream-Management 
* save SM state and send-queue entries on disconnect
* restore SM state and send-queue entries on reconnect

fixes #698

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-08-08 13:39:58 +02:00
Michael Vetter
1330ad4e1e Update copyright year 2022-05-09 15:43:33 +02:00
Steffen Jaeckel
3a03496817 clean-up connection (act I) 
* use custom memory descriptor that `abort()`s on `malloc()` failure
* use static log descriptor
* don't always re-create all contexts
* de-duplicate code of `.._connect()` and `.._register()`

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-03-30 18:26:10 +02:00
Steffen Jaeckel
7c56eac154 also store PEM in TLSCertificate 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-03-22 11:34:23 +01:00
Steffen Jaeckel
764a7fb71b prevent segfault 
In case we're not connected yet and press Alt+c a segfault occurred
since `conn.xmpp_conn` is dereferenced while it's still `NULL`.

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-03-13 13:21:40 +01:00
Michael Vetter
e55f6d7f4d Set libstrophe log verbosity 
Set this to 0.
We might want to have this configurable later.

For now we fix the valgrind report:

```
Conditional jump or move depends on uninitialised value
xmpp_debug_verbose()
```

Which will be fixed in libstrophe > 0.11.0 by commit
28f3ce19b8
 2022-02-21 21:53:33 +01:00
Steffen Jaeckel
569525c6c7 Fix off-by-one 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-02-01 17:41:19 +01:00
Steffen Jaeckel
ad87bdffc2 add missing IPv6 handling 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-02-01 16:56:26 +01:00
Steffen Jaeckel
196f20a7d5 add fall-back for older GLib versions 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-02-01 16:33:22 +01:00
Steffen Jaeckel
0e58509c16 handle see-other-host XMPP stream error 
Fixes #1628

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-02-01 15:52:08 +01:00
Steffen Jaeckel
9cf78e59d5 auto-format 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2022-02-01 15:01:28 +01:00
Steffen Jaeckel
7f646e3668 use new libstrophe API 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2021-10-27 22:45:44 +02:00
Steffen Jaeckel
ffc0b49ab1 first step to remove libmesode 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2021-10-27 22:45:44 +02:00
Michael Vetter
46c8245af9 Format new register code correctly 2021-10-13 21:32:44 +02:00
Michael Vetter
e0e45b7b24 Merge pull request #1574 from binex-dsk/master 
Add in-band account registration
Fix https://github.com/profanity-im/profanity/issues/199
 2021-10-13 21:19:22 +02:00
swirl
0653200965 registration: memory leaks, error checking 2021-10-13 15:02:05 -04:00
swirl
feaa770444 fixed crashes when server doesn't support registration 2021-10-10 15:43:14 -04:00
Michael Vetter
f21595597f Format code correctly 2021-10-05 10:01:27 +02:00
swirl
87d2c95c87 registration: remove auth param and excess functions 2021-08-17 14:09:48 -04:00
Michael Vetter
f53b4353fd REGISTRATION FIXED 2021-08-17 14:09:48 -04:00