4 Commits

Author	SHA1	Message	Date
jabber.developer2	f9e184eda7	revert: restore pre-upstream-merge baseline (tree of 3b673150b) ... Roll the tree back to the pre-merge tip 3b673150b, undoing the upstream sync merge 72f4f186d (303 files) and the 13 post-merge commits layered on top of it. Purpose: restore the last pre-sync baseline so the reported OMEMO/OTR encryption regressions can be reproduced against a known-good state and the upstream sync ruled in or out as the cause. Nothing is dropped from history; the merge and every post-merge commit remain reachable and can be cherry-picked back selectively. Baseline: 3b673150b chore(chatlog): disable background message file logging (stage 1) Undoes merge: 72f4f186d merge: sync upstream profanity-im/profanity	2026-06-29 12:17:01 +03:00
Jabber Developer	72f4f186da	merge: sync upstream profanity-im/profanity ... Sync with upstream profanity-im/profanity. Major upstream changes incorporated: Memory management - Replace malloc+memset with g_new0 throughout codebase - Adopt auto_gchar / auto_gcharv / auto_gerror / auto_jid cleanup macros - Replace free() with g_free() for GAlloc'd memory Editor rewrite - Remove pthread-based async editor; use GChildWatch callback API - New launch_editor(initial_content, callback, user_data) interface - Proper signal handling (SIGINT, SIGTSTP, SIGPIPE reset in child) - ui_suspend()/ui_resume() integration for TTY management OMEMO improvements - Dual backend support: libsignal-protocol-c and libomemo-c - Proper pre-key removal after use (XEP-0384 compliance) - Automatic pre-key regeneration when store drops below threshold - New functions: omemo_is_device_active(), omemo_is_jid_trusted() - omemo_get_jid_untrusted_fingerprints() for better error messages - Fingerprint notifications on new device identity discovery - Deterministic pre-key ID generation tracking max_pre_key_id - omemo_trust_changed() UI updates on trust state changes JID validation - RFC 6122-compliant validation in jid_is_valid() - Character-level checks (RFC 6122 forbidden chars: & ' / : < > @) - Length limits: 1023 per component, 3071 total - New jid_is_valid_user_jid() for user vs. service JID distinction Database - Schema migration v3: UNIQUE constraint on archive_id for deduplication - Triggers for corrected message tracking (replaces_db_id / replaced_by_db_id) - db_history_result_t return type, _truncate_datetime_suffix() UI / console - win_warn_needed() / win_warn_sent() warning deduplication hash table - PAD_MIN_HEIGHT dynamic pad sizing with PAD_THRESHOLD auto-cleanup - Spellcheck integration in input field with Unicode word detection - cons_spellcheck_setting() for /settings ui output - /[command]? shortcut for command help Account config - Account name sanitization for GKeyFile special chars ([ ] = # \n \r) - Replace popen() with g_spawn_sync() for eval_password - TLS policy: add "direct" option alongside legacy Connection - Port validation with g_assert (0–65535) - SHA-256 certificate fingerprint support (XMPP_CERT_PUBKEY_FINGERPRINT_SHA256) - "direct" TLS policy alias for legacy SSL Common utilities - str_xml_sanitize() for XML 1.0 illegal character removal - string_matches_one_of() with formatted error messages - valid_tls_policy_option() helper - prof_date_time_format_iso8601() utility - Improved strip_arg_quotes() with backslash unescaping - prof_occurrences() uses g_slist_prepend + reverse for performance PGP / OX - Proper GPGME resource cleanup with goto-cleanup pattern - g_string_free(xmppuri) leak fix in _ox_key_lookup CSV export - Use GString + g_file_set_contents instead of raw write() syscalls Tests - Restructured into subdirectories: command/, config/, xmpp/, ui/, omemo/, otr/, pgp/ - New test_cmd_ac.c for autocompleter unit tests - Updated stubs for new UI suspend/resume functions License headers - Migrate to SPDX-3.0 identifiers (GPL-3.0-or-later WITH OpenSSL-exception) ──────────────────────────────────────────────────── cproof-specific preservations: - XEP-0308 LMC: replace_id ?: id logic in message/stanza/omemo - Force encryption: cmd_force_encryption, test_forced_encryption - CWE-134: format string protection (cons_show("%s", ...)) - y_start_pos-based paging in window.c - db_history_result_t return type, _truncate_datetime_suffix() Merge-time fixes: - common.c: format-security (-Werror) — cons_show(errmsg) → cons_show("%s", errmsg) - database.c: null-deref guard — !msg->timestamp → msg && !msg->timestamp - console.c: implicit size_t → int cast — (int)(maxlen + 1) - tlscerts.c: %d for size_t — %zu Build system: - Kept autotools (Makefile.am, configure.ac); upstream uses Meson - Restored deleted files: bootstrap.sh, autogen.sh, ax_valgrind_check.m4, configure-debug - Updated Makefile.am test paths for subdirectory structure - Added test_cmd_ac, test_forced_encryption to test sources Functional tests: - Use cproof version; upstream requires stbbr_for_xmlns from updated stabber - Not yet available in devs/stabber fork Closes #64 Merge author: jabber.developer2 Commits authors: Michael Vetter <jubalh@iodoru.org> & Steffen Jaeckel <s@jaeckel.eu>	2026-05-26 17:48:14 +00:00
jabber.developer2	1aaa382d5e	fix(verify): per-contact context in output, demote duplicate stanza-id to debug	2026-05-06 17:02:27 +03:00
Jabber Developer	3f36c303c2	feat(history): flat-file backend with bidirectional SQLite migration ... A flat-file alternative to the SQLite chatlog backend with runtime switching, full migration tooling, integrity verification, and a synthetic load harness. SQLite remains the default; both backends share one dispatch layer (db_backend_t vtable) so callers don't change. Storage layout - Per-contact append-only `flatlog/<account>/<contact>/history.log` under XDG_DATA_HOME, one line per message - Single-line file header with embedded format-version marker (FLATFILE_FORMAT_VERSION); reader warns on missing or mismatched marker, writer and checker stay in sync via preprocessor stringification - Deterministic key=value metadata (`id`, `aid`, `corrects`, `to`, `to_res`, `read`) plus escaped body \u2014 `\|`, `\]`, `\\`, `\n`, `\r` literals prevent log injection - Sparse byte-offset index (FF_INDEX_STEP=500) per contact for O(log n) time-range lookups; rebuilt on inode / size / mtime change, extended in-place when the file just grew - Per-contact GHashTable caches for archive_id presence and stanza_id \u2192 from_jid mapping (O(1) MAM dedup, O(1) LMC sender validation) Hardening - Path-traversal protection: JID directory name normalisation (`@` \u2192 `_at_`, slashes and `..` rejected at construction); every per-contact path is anchored under the account's flatlog/ directory and validated before open - Symlink-attack protection: every fopen / open uses O_NOFOLLOW; on ELOOP the operation aborts with an error rather than following - Filesystem permissions: log files created with mode 0600, directories with mode 0700; both enforced at creation, verified on each open and reported on drift by `/history verify` - Atomic crash-safe export: write to a temp file via mkstemp (mode 0600, random suffix, no name collisions between concurrent exports), fsync, then rename \u2014 partial state never replaces the live file - Concurrency: advisory flock(LOCK_EX) held for the duration of every write, including append from live messages and full rewrite from export, so two profanity processes can't interleave bytes on the same log - DoS / abuse guards: * FF_MAX_LINE_LEN = 10 MB \u2014 lines longer than this are rejected at read with a warning; the parser will not allocate unbounded memory for a single record * FF_MAX_LMC_DEPTH = 100 \u2014 `corrects:` chain walk stops at this depth and emits a warning, preventing a malicious correction cycle from spinning the apply pass * FF_VERSION_SCAN_MAX = 16 \u2014 header version probe never reads past 16 leading comment lines, even on garbage input * Empty / inverted byte-range early-return in page-up read path so a malformed time filter cannot cause an unbounded scan * Zero-entry index guard so a file whose every line failed to parse cannot cause a NULL deref on later page-up - LMC sender validation: an incoming correction whose sender does not match the original message's sender is rejected at write time and surfaced via cons_show_error; a cycle in the apply pass is broken via a visited-set - jid_create_from_bare_and_resource treats NULL, empty string, and the literal "(null)" as no resource and returns a bare jid; similar normalisation for barejid eliminates the legacy "user@host/(null)" artefact that leaked into stored fulljids whenever g_strdup_printf("%s", NULL) ran inside create_fulljid Commands - `/history switch sqlite|flatfile` \u2014 runtime backend swap, closes the old backend and opens the new one without reconnecting - `/history export [<jid>]` \u2014 SQLite -> flat-file, merging with any existing flatlog (dedup keyed on a SHA-256 hash mixing stanza_id, timestamp, from_jid, body \u2014 robust against id reuse by older clients) - `/history import [<jid>]` \u2014 flat-file -> SQLite, same merge semantics, runs inside a single SQLite transaction with rollback on per-contact failure - `/history verify [<jid>]` \u2014 integrity check; emits a structured list of issues (ERROR / WARNING / INFO) per file: * file-level: missing log, wrong permissions (\u2260 0600), UTF-8 BOM present, CRLF line endings, empty file * line-level: invalid UTF-8 (with byte offset), embedded control characters, unparsable lines, timestamps out of order, duplicate `id:` and `aid:` (tracked separately so a stanza/archive id collision isn't double-reported) * cross-line: broken `corrects:` references whose target id is not present in the file - `/history backend` \u2014 show currently active backend - Active backend indicator `[sqlite]` / `[flatfile]` in the status bar next to the JID - Roster-JID autocomplete for verify / export / import - export and import open a SQLite handle on demand when the flatfile backend is currently active, so migration works regardless of which backend is live Tests - Unit: database_export (parser round-trip, escape/unescape, dedup key stability, JID normalisation), database_stress (14 cases exercising rapid writes, large messages, deep LMC chains, MAM dedup, concurrent contacts) - Functional: history persistence across reconnects, export / import round-trip with content equality, MUC migration, timestamp normalisation across timezones - Bench harness P1\u2013P5 (synthetic load: bulk insert, time-range read, page-up scroll, MAM ingest, mixed workload) and failure modes F1\u2013F17 (page-up cursor and forward-iteration symmetry, oversized lines, MAM dedup, LMC depth and cycles, BOM/CRLF, missing log, empty file, mtime+inode flip, broken corrects, etc.) - All bench tests integrate with the existing make targets and emit CSV rows for baseline comparison Author: jabber.developer2 <jabber.developer2@jabber.space> Reviewed-by: jabber.developer <jabber.developer@jabber.space>	2026-05-05 19:26:07 +00:00