devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 9 Actions Packages Projects 1 Releases Wiki Activity
7,643 Commits 65 Branches 0 Tags
a7da9e2add352172e16ede5e6d869eaca37a029e
Commit Graph

67 Commits

Author SHA1 Message Date
Jabber Developer
9ec01fa8cc fix: CWE-134 format string audit and compiler hardening
All checks were successful
CI Code / Check spelling (push) Successful in 20s
Details
CI Code / Check coding style (push) Successful in 36s
Details
CI Code / Code Coverage (push) Successful in 5m38s
Details
CI Code / Linux (ubuntu) (push) Successful in 7m1s
Details
CI Code / Linux (debian) (push) Successful in 7m5s
Details
CI Code / Linux (arch) (push) Successful in 7m19s
Details 
Security:
Fix CWE-134 in iq.c: user-controlled string passed as format argument
Add G_GNUC_PRINTF annotations to all variadic printf-like wrappers
in ui.h, log.h and http_common.h
Compiler flags (configure.ac):

Replace basic -Wformat/-Wformat-nonliteral with -Wformat=2
Add -Wextra, -Wnull-dereference, -Wpointer-arith,
-Wimplicit-function-declaration, -Wundef, -Wfloat-equal,
-Wredundant-decls, -Walloc-zero
Add -fstack-protector-strong, -fno-common, -D_FORTIFY_SOURCE=2
Add GCC-specific flags via AC_COMPILE_IFELSE: -Wlogical-op,
-Wduplicated-cond, -Wduplicated-branches, -Wstringop-overflow,
-Warray-bounds=2
Suppress noisy -Wextra sub-warnings: -Wno-unused-parameter,
-Wno-missing-field-initializers, -Wno-sign-compare,
-Wno-cast-function-type
Remove AM_CFLAGS/CFLAGS duplication
Bug fixes found by new warnings:

chatlog.c: non-MUCPM redact path passed resourcepart instead of NULL
rosterwin.c: merge duplicated if/else branches into single condition
omemo.c: redundant else-if in omemo_automatic_start; remove
unnecessary scope block and goto, use early return
console.c: pointer compared to integer 0 instead of NULL
stanza.c: increase pri_str/idle_str buffers from 10 to 12 bytes
(INT_MIN = -2147483648 needs 12 bytes including NUL)
vcard.c: NULL guard for filename before g_file_set_contents
api.c: broken log_warning() calls with extra format argument
Format mismatch fixes:

chatwin.c: Jid* → char* for %s
connection.c: %x → %lx for long flags
cmd_funcs.c: %d → %zu for size_t; cast gpointer to char* for %s
cmd_defs.c: %d → %u for g_list_length() return (guint)
iq.c: barejid → fulljid for from_jid
console.c, mucwin.c, privwin.c, account.c, omemo.c, presence.c:
gpointer → (char*) casts for %s
Const-correctness and cleanup:

database.c: const for type, query, sort variables
form.c/xmpp.h: const for form_set_value parameter
files.c: refactor to early return, eliminating NULL logfile path
muc.c/muc.h: remove meaningless top-level const on return type
common.c: const for URL string literal
Remove stale declarations: cons_show_desktop_prefs (ui.h),
connection_set_priority (connection.h),
omemo_devicelist_configure_and_request (omemo.h)
test_common.c: add currb NULL check to silence -Wnull-dereference
Tooling (check-cwe134.sh):

Reduce from 5 checks to 2 (checks 1-3 redundant with -Wformat=2)
Check 1: verify known wrappers have G_GNUC_PRINTF attribute
Check 2: auto-detect unannotated variadic printf-like functions
Match both const char* and const gchar* in variadic patterns

Author: jabber.developer2 <jabber.developer2@jabber.space>
 2026-03-07 11:55:50 +01:00
Steffen Jaeckel
b4c088232e Improve const correctness 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-12-12 18:27:09 +01:00
Steffen Jaeckel
8cd53acfd7 fix /reconnect now 
This fixes #1846
Issue introduced by a0aa26b6fa

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 2023-05-10 18:12:11 +02:00
Michael Vetter
46c8245af9 Format new register code correctly 2021-10-13 21:32:44 +02:00
swirl
87d2c95c87 registration: remove auth param and excess functions 2021-08-17 14:09:48 -04:00
swirl
4d3f26154e hacky fix(?) for register 
very bad and spaghetti will fix later
 2021-08-17 14:09:48 -04:00
swirl
d9366a26d6 initial register command test 2021-08-17 14:09:48 -04:00
Michael Vetter
8c50b63e56 Goodbye beautiful IDs 
It was a great ride!

IDs look instead of
`TE5BTDc2ZTc3YTMwZGU3MDgzMzllOTliNGExNjVmMjZkMTY1ZmUyZGEyNTUxMjVmODBkMmQzOGMxYWI2ZjAxNzdiM2Q=`
more like `7HcnNSoO1MVvb0p9a9e293152922853e910b8b1a65bb26e225a0568` now.

Regards https://github.com/profanity-im/profanity/issues/1520

We still has our identifier into it to filter MUC reflected messages.

profident maybe should be changed to be longer or be generated upon each
start.
 2021-04-14 22:47:58 +02:00
Michael Vetter
a2726b6a7d Apply coding style 2020-07-07 14:18:57 +02:00
Michael Vetter
a4cadf78fa Revert "Apply coding style" 
This reverts commit 9b55f2dec0.

Sorting the includes creates some problems.
 2020-07-07 13:53:30 +02:00
Michael Vetter
9b55f2dec0 Apply coding style 
Regards https://github.com/profanity-im/profanity/issues/1396
 2020-07-07 09:43:28 +02:00
Dmitry Podgorny
ac410445af Add option for legacy authentication 
New options:
  /connect <account> [auth default|legacy]
  /account <account> set auth default|legacy

Fixes #1236.
 2020-06-05 11:37:51 +03:00
Michael Vetter
46fd7150e5 Add vim modeline 2019-11-13 12:11:05 +01:00
Michael Vetter
5c6f5ba0f7 Add connection_get_profanity_identifier stub 
And move defintion to xmpp.h
 2019-10-18 11:23:30 +02:00
Michael Vetter
430b2eaa0d Log incoming MUC messages if origin-id sais they dont come from us 
Regards https://github.com/profanity-im/profanity/issues/1201
 2019-10-18 10:40:24 +02:00
Michael Vetter
53640f6e97 Remove prefix from stanza id 
We sent `prof_prefix_uuid` as id. Where the prefix was also optional.
We don't need this at all.
 2019-10-17 15:40:40 +02:00
Paul Fariello
4ad6904216 Wait for discovery end to publish omemo devicelist and bundle 
Add sv_ev_connection_features_received for that purpose
 2019-04-10 17:23:46 +02:00
Michael Vetter
706af9a900 Update copyright to include 2019 2019-01-22 11:31:45 +01:00
Michael Vetter
6d80700329 Move ID generation to xmpp folder 
create_unique_id() was changed to use UUIDs instead of a counter in the
last commit. Since now it depends on connection_create_uuid() which is
in the xmpp subfolder the function should also be moved there.

Renamed it to connection_create_stanza_id() and moved it to
src/xmpp/connection.c.

Discussion happened in https://github.com/boothj5/profanity/pull/1010
 2018-08-30 11:17:04 +02:00
James Booth
250e972b7a Update copyright 2018-01-21 15:00:02 +00:00
James Booth
68a3daedb9 Update Copyright 2017-01-28 17:24:22 +00:00
James Booth
2b7894ccff Remove status from cl_ev_presence_send 
fixes #888
 2017-01-15 23:59:31 +00:00
James Booth
609d05366c Use server features for account muc service 
issue #878
 2016-11-20 02:09:34 +00:00
James Booth
0649aad80d Move event timeout to connection module 2016-07-24 14:08:30 +01:00
James Booth
e8fc80f5c1 Update GPL link in headers 2016-07-24 01:14:49 +01:00
James Booth
b935b4621c Add connection_set_disconnected() 2016-05-11 00:02:39 +01:00
James Booth
7e079f3684 Add connection_clear_data() 2016-05-10 23:53:44 +01:00
James Booth
a7fa27df01 Remove connection_free_conn(), connection_free_ctx() 2016-05-10 23:34:25 +01:00
James Booth
a67d199581 Add connection_shutdown() 2016-05-10 23:27:16 +01:00
James Booth
3d20c85ada Remove JABBER_STARTED, JABBER_UNDEFINED connection states 2016-05-10 23:18:11 +01:00
James Booth
ec51ae689c Free features on disconnect 2016-05-08 03:14:22 +01:00
James Booth
ac3ab39e23 Use hash table for disco features 2016-05-08 03:04:36 +01:00
James Booth
29380a39cd Remove connection_get_disco_infos() 2016-05-08 02:37:02 +01:00
James Booth
188df60cfe Rename diso_items->diso_infos 2016-05-08 02:30:34 +01:00
James Booth
31e6cc8e38 Add connection_get_disco_info() 2016-05-08 02:25:34 +01:00
James Booth
137202e5dd Add connection_item_for_feature() 2016-05-08 01:45:22 +01:00
James Booth
f28655c5c8 Move logic to connection_set_disco_items 2016-05-08 01:10:42 +01:00
James Booth
f1cf444e05 Move conneciton initialisation to _connection_handler 2016-05-08 00:21:06 +01:00
James Booth
6ce8edc194 Move disco info struct to connection 2016-05-07 23:28:16 +01:00
James Booth
9596591610 Move available resources to connection struct 2016-05-07 23:04:50 +01:00
James Booth
81e95966cf Remove redundant tls secured function 2016-05-06 02:18:31 +01:00
James Booth
c009144b3d Tidy connect function 2016-05-06 02:08:10 +01:00
James Booth
3cb60399a1 Move connection_connect 2016-05-06 02:02:23 +01:00
James Booth
88f423afea Rename jabber_ functions 2016-05-06 00:53:03 +01:00
James Booth
3bb1f12410 Add session.c 2016-05-05 23:51:49 +01:00
James Booth
f6fa63b374 Renamed connection.c -> session.c 2016-05-05 22:10:10 +01:00
James Booth
ccabc08fef Tidy xmpp headers 2016-05-04 01:19:51 +01:00
James Booth
39fb05577a Rename id_handler_add -> iq_id_handler_add 2016-05-02 21:50:39 +01:00
James Booth
9b177a9e01 Removed #AX_PREFIX_CONFIG_H 2016-03-31 21:05:02 +01:00
James Booth
d39e48ba18 Use one stanza handler per type (message, iq, presence) 
Allows plugins to stop stanza processing
 2016-03-28 01:25:48 +01:00