security: E2EE and transport correctness (issue #147)

T04: promote security events to warnings — SASL auth failure, TLS
handshake failure, cert-failure details, see-other-host redirect;
DISABLE_TLS, TRUST_TLS and LEGACY_AUTH get a log warning plus a
console notice (REQ-LOG-01, REQ-LOG-02, REQ-AUTH-03)

T05: warn when a session ends up unencrypted without the user having
asked for it; refuse in-band registration on an unencrypted stream;
warn on each HTTP transfer with certificate verification disabled
(REQ-CRY-03, REQ-CFG-01)

T06: pin the update check to https with peer/host verification and no
redirects; strict N.N.N parser for the fetched version, which is
untrusted network input (REQ-VUL-02)

T09: no plaintext logging on failed MUC OMEMO sends; OTR opportunistic
first message passes allow_unencrypted_message(); get_random_string()
draws from a CSPRNG without modulo bias; guard the identity-key length
decrement against unsigned underflow (REQ-CRY-01, REQ-CRY-02,
REQ-CRY-07, REQ-MEM-05)

REQ-VUL-03 and REQ-CRY-09 are already satisfied on master and are
left unchanged.

.github/workflows/docker-publish.yml

@@ -0,0 +1,44 @@
+name: Publish Docker image
+
+on:
+  push:
+    branches: [master]
+  release:
+    types: [published]
+
+jobs:
+  push_to_registry:
+    name: Push Docker image to Docker Hub
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v7
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
+        with:
+          images: cproofdev/cproof
+          tags: |
+            type=raw,value=dev,enable={{is_default_branch}}
+            type=sha,prefix=nightly-,enable={{is_default_branch}}
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@2bd26e71295ee32cbf6a73510d165bf7232460f3
+        with:
+          context: .
+          file: ./ci/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

ci/Dockerfile

@@ -0,0 +1,106 @@
+# =============================================================================
+# Stage 1: Build
+# =============================================================================
+FROM ubuntu:26.04 AS builder
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    autoconf \
+    automake \
+    autoconf-archive \
+    ca-certificates \
+    libtool \
+    pkg-config \
+    git \
+    wget \
+    libglib2.0-dev \
+    libcurl4-openssl-dev \
+    libsqlite3-dev \
+    libncurses-dev \
+    libreadline-dev \
+    libnotify-dev \
+    python3-dev \
+    python3 \
+    libgpgme-dev \
+    libotr5-dev \
+    libgtk-3-dev \
+    libgdk-pixbuf-2.0-dev \
+    libsignal-protocol-c-dev \
+    libgcrypt20-dev \
+    libqrencode-dev \
+    libxss-dev \
+    libcmocka-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Build libstrophe from source (not available as Ubuntu package)
+RUN git clone --depth 1 https://git.jabber.space/devs/libstrophe-gh-mirror.git /tmp/libstrophe \
+    && cd /tmp/libstrophe \
+    && autoreconf -i \
+    && ./configure --prefix=/usr \
+    && make -j$(nproc) \
+    && make install \
+    && rm -rf /tmp/libstrophe
+
+WORKDIR /src
+
+COPY . .
+
+RUN ./bootstrap.sh \
+    && ./configure \
+        --enable-notifications \
+        --enable-icons-and-clipboard \
+        --enable-otr \
+        --enable-pgp \
+        --enable-omemo \
+        --enable-plugins \
+        --enable-c-plugins \
+        --enable-python-plugins \
+        --with-xscreensaver \
+        --enable-omemo-qrcode \
+        --enable-gdk-pixbuf \
+    && make -j$(nproc) \
+    && make install
+
+# =============================================================================
+# Stage 2: Runtime (minimal)
+# =============================================================================
+FROM ubuntu:26.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    libglib2.0-0t64 \
+    libcurl4t64 \
+    libsqlite3-0 \
+    libncursesw6 \
+    libreadline8t64 \
+    libnotify4 \
+    python3 \
+    libpython3.14 \
+    libgpgme45 \
+    libotr5t64 \
+    libgtk-3-0t64 \
+    libgdk-pixbuf-2.0-0 \
+    libsignal-protocol-c2.3.2 \
+    libgcrypt20 \
+    libqrencode4 \
+    libxss1 \
+    && rm -rf /var/lib/apt/lists/* \
+    && apt-get clean
+
+COPY --from=builder /usr/local/bin/profanity /usr/local/bin/profanity
+COPY --from=builder /usr/local/lib/libprofanity* /usr/local/lib/
+COPY --from=builder /usr/local/include/profapi.h /usr/local/include/
+COPY --from=builder /usr/local/share/profanity /usr/local/share/profanity
+COPY --from=builder /usr/lib/libstrophe.so* /usr/lib/
+
+RUN ldconfig
+
+RUN ldd /usr/local/bin/profanity | grep 'not found' && exit 1 || true
+
+RUN mkdir -p /root/.config/profanity
+
+ENTRYPOINT ["profanity"]

configure.ac

@@ -342,6 +342,12 @@ AS_IF([test "x$enable_gdk_pixbuf" != xno],
                [AC_MSG_ERROR([gdk-pixbuf-2.0 >= 2.4 is required to scale avatars before uploading])],
                [AC_MSG_NOTICE([gdk-pixbuf-2.0 >= 2.4 not found, GDK Pixbuf support not enabled])])])])
 
+dnl libgcrypt: CSPRNG for stanza ids and instance identifiers (also pulled in by OMEMO/OTR)
+AC_CHECK_LIB([gcrypt], [gcry_create_nonce],
+    [AC_DEFINE([HAVE_LIBGCRYPT], [1], [Have libgcrypt])
+     LIBS="-lgcrypt $LIBS"],
+    [AC_MSG_NOTICE([libgcrypt not found, identifiers will use the OS random device])])
+
 dnl feature: omemo
 AM_CONDITIONAL([BUILD_OMEMO], [false])
 if test "x$enable_omemo" != xno; then

src/command/cmd_ac.c

@@ -42,6 +42,7 @@
 
 #include "ai/ai_client.h"
 
+static char* _caps_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _sub_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _notify_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _theme_autocomplete(ProfWin* window, const char* const input, gboolean previous);
@@ -151,6 +152,7 @@ static Autocomplete account_clear_ac;
 static Autocomplete account_default_ac;
 static Autocomplete account_status_ac;
 static Autocomplete disco_ac;
+static Autocomplete caps_subcommands_ac;
 static Autocomplete wins_ac;
 static Autocomplete roster_ac;
 static Autocomplete roster_show_ac;
@@ -321,6 +323,7 @@ static Autocomplete* all_acs[] = {
     &account_default_ac,
     &account_status_ac,
     &disco_ac,
+    &caps_subcommands_ac,
     &wins_ac,
     &roster_ac,
     &roster_show_ac,
@@ -597,6 +600,8 @@ cmd_ac_init(void)
     autocomplete_add(disco_ac, "info");
     autocomplete_add(disco_ac, "items");
 
+    autocomplete_add(caps_subcommands_ac, "clear");
+
     autocomplete_add(account_ac, "list");
     autocomplete_add(account_ac, "show");
     autocomplete_add(account_ac, "add");
@@ -1414,6 +1419,7 @@ cmd_ac_init(void)
     g_hash_table_insert(ac_funcs, "/ban", _ban_autocomplete);
     g_hash_table_insert(ac_funcs, "/blocked", _blocked_autocomplete);
     g_hash_table_insert(ac_funcs, "/bookmark", _bookmark_autocomplete);
+    g_hash_table_insert(ac_funcs, "/caps", _caps_autocomplete);
     g_hash_table_insert(ac_funcs, "/clear", _clear_autocomplete);
     g_hash_table_insert(ac_funcs, "/close", _close_autocomplete);
     g_hash_table_insert(ac_funcs, "/cmd", _adhoc_cmd_autocomplete);
@@ -1985,6 +1991,35 @@ _cmd_ac_complete_params(ProfWin* window, const char* const input, gboolean previ
     return NULL;
 }
 
+static char*
+_caps_autocomplete(ProfWin* window, const char* const input, gboolean previous)
+{
+    char* result = NULL;
+    result = autocomplete_param_with_ac(input, "/caps", caps_subcommands_ac, TRUE, previous);
+    if (result) {
+        return result;
+    }
+    if (window->type == WIN_MUC) {
+        ProfMucWin* mucwin = (ProfMucWin*)window;
+        assert(mucwin->memcheck == PROFMUCWIN_MEMCHECK);
+        Autocomplete nick_ac = muc_roster_ac(mucwin->roomjid);
+        if (nick_ac) {
+            result = autocomplete_param_with_ac(input, "/caps", nick_ac, TRUE, previous);
+        }
+    } else if (connection_get_status() == JABBER_CONNECTED) {
+        result = autocomplete_param_with_func(input, "/caps", roster_contact_autocomplete, previous, NULL);
+        if (result) {
+            return result;
+        }
+        result = autocomplete_param_with_func(input, "/caps", roster_barejid_autocomplete, previous, NULL);
+        if (result) {
+            return result;
+        }
+        result = autocomplete_param_with_func(input, "/caps", roster_fulljid_autocomplete, previous, NULL);
+    }
+    return result;
+}
+
 static char*
 _sub_autocomplete(ProfWin* window, const char* const input, gboolean previous)
 {

src/command/cmd_defs.c

@@ -427,17 +427,21 @@ static const struct cmd_t command_defs[] = {
               CMD_TAG_GROUPCHAT)
       CMD_SYN(
               "/caps",
-              "/caps <fulljid>|<nick>")
+              "/caps <fulljid>|<nick>",
+              "/caps clear")
       CMD_DESC(
               "Find out a contacts, or room members client software capabilities. "
-              "If in private chat initiated from a chat room, no parameter is required.")
+              "If in private chat initiated from a chat room, no parameter is required. "
+              "Use clear to remove all cached capabilities.")
       CMD_ARGS(
               { "<fulljid>", "If in the console or a chat window, the full JID for which you wish to see capabilities." },
-              { "<nick>", "If in a chat room, nickname for which you wish to see capabilities." })
+              { "<nick>", "If in a chat room, nickname for which you wish to see capabilities." },
+              { "clear", "Clear all cached capabilities." })
       CMD_EXAMPLES(
               "/caps ran@cold.sea.org/laptop",
               "/caps ran@cold.sea.org/phone",
-              "/caps aegir")
+              "/caps aegir",
+              "/caps clear")
     },
 
     { CMD_PREAMBLE("/software",

src/command/cmd_funcs.c

@@ -70,6 +70,7 @@
 #include "xmpp/stanza.h"
 #include "xmpp/vcard_funcs.h"
 #include "xmpp/xmpp.h"
+#include "xmpp/capabilities.h"
 
 #ifdef HAVE_LIBOTR
 #include "otr/otr.h"
@@ -3387,6 +3388,12 @@ cmd_caps(ProfWin* window, const char* const command, gchar** args)
         return TRUE;
     }
 
+    if (g_strcmp0(args[0], "clear") == 0) {
+        caps_cache_clear();
+        cons_show("Capabilities cache cleared.");
+        return TRUE;
+    }
+
     switch (window->type) {
     case WIN_MUC:
         if (args[0]) {
@@ -3405,6 +3412,7 @@ cmd_caps(ProfWin* window, const char* const command, gchar** args)
         break;
     case WIN_CHAT:
     case WIN_CONSOLE:
+    case WIN_XML:
         if (args[0]) {
             auto_jid Jid* jid = jid_create(args[0]);
 
@@ -9550,6 +9558,11 @@ _url_aesgcm_method(ProfWin* window, const char* cmd_template, gchar* url, gchar*
         return;
     AESGCMDownload* download = g_new0(AESGCMDownload, 1);
     download->id = get_random_string(4);
+    if (!download->id) {
+        cons_show_error("Could not start download: no random source available.");
+        g_free(download);
+        return;
+    }
     download->url = strdup(url);
     download->filename = strdup(filename);
     if (cmd_template != NULL) {
@@ -9572,6 +9585,11 @@ _download_install_plugin(ProfWin* window, gchar* url, gchar* path)
         return FALSE;
     HTTPDownload* download = g_new0(HTTPDownload, 1);
     download->id = get_random_string(4);
+    if (!download->id) {
+        cons_show_error("Could not start download: no random source available.");
+        g_free(download);
+        return FALSE;
+    }
     download->url = strdup(url);
     download->filename = strdup(filename);
     download->cmd_template = NULL;
@@ -9591,6 +9609,11 @@ _url_http_method(ProfWin* window, const char* cmd_template, gchar* url, gchar* p
         return;
     HTTPDownload* download = g_new0(HTTPDownload, 1);
     download->id = get_random_string(4);
+    if (!download->id) {
+        cons_show_error("Could not start download: no random source available.");
+        g_free(download);
+        return;
+    }
     download->url = strdup(url);
     download->filename = strdup(filename);
     download->cmd_template = cmd_template ? strdup(cmd_template) : NULL;

src/common.c

@@ -23,6 +23,9 @@
 
 #include <curl/curl.h>
 #include <curl/easy.h>
+#ifdef HAVE_LIBGCRYPT
+#include <gcrypt.h>
+#endif
 #include <glib.h>
 #include <gio/gio.h>
 #include <glib/gstdio.h>
@@ -470,9 +473,26 @@ release_get_latest(void)
     curl_easy_setopt(handle, CURLOPT_TIMEOUT, 2L);
     curl_easy_setopt(handle, CURLOPT_WRITEDATA, (void*)&output);
 
-    curl_easy_perform(handle);
+    curl_easy_setopt(handle, CURLOPT_SSL_VERIFYPEER, 1L);
+    curl_easy_setopt(handle, CURLOPT_SSL_VERIFYHOST, 2L);
+    curl_easy_setopt(handle, CURLOPT_FOLLOWLOCATION, 0L);
+#if LIBCURL_VERSION_NUM >= 0x075500 // 7.85.0 introduced the string form
+    curl_easy_setopt(handle, CURLOPT_PROTOCOLS_STR, "https");
+    curl_easy_setopt(handle, CURLOPT_REDIR_PROTOCOLS_STR, "https");
+#else
+    curl_easy_setopt(handle, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
+    curl_easy_setopt(handle, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTPS);
+#endif
+
+    CURLcode res = curl_easy_perform(handle);
     curl_easy_cleanup(handle);
 
+    if (res != CURLE_OK) {
+        log_warning("Update check failed: %s", curl_easy_strerror(res));
+        free(output.buffer);
+        return NULL;
+    }
+
     if (output.buffer) {
         output.buffer[output.size++] = '\0';
         return output.buffer;
@@ -481,6 +501,43 @@ release_get_latest(void)
     }
 }
 
+// strict "major.minor.patch": the found version is untrusted network input
+static gboolean
+_parse_version(const char* const version, int* major, int* minor, int* patch)
+{
+    if (!version) {
+        return FALSE;
+    }
+
+    int* out[3] = { major, minor, patch };
+    const char* curr = version;
+
+    for (int part = 0; part < 3; part++) {
+        if (part > 0) {
+            if (*curr != '.') {
+                return FALSE;
+            }
+            curr++;
+        }
+
+        if (!g_ascii_isdigit(*curr)) {
+            return FALSE;
+        }
+
+        gint64 value = 0;
+        while (g_ascii_isdigit(*curr)) {
+            value = value * 10 + (*curr - '0');
+            if (value > G_MAXINT) {
+                return FALSE;
+            }
+            curr++;
+        }
+        *out[part] = (int)value;
+    }
+
+    return *curr == '\0';
+}
+
 gboolean
 release_is_new(const char* const curr_version, const char* const found_version)
 {
@@ -490,12 +547,10 @@ release_is_new(const char* const curr_version, const char* const found_version)
 
     int curr_maj, curr_min, curr_patch, found_maj, found_min, found_patch;
 
-    int parse_curr = sscanf(curr_version, "%d.%d.%d", &curr_maj, &curr_min,
-                            &curr_patch);
-    int parse_found = sscanf(found_version, "%d.%d.%d", &found_maj, &found_min,
-                             &found_patch);
+    gboolean parse_curr = _parse_version(curr_version, &curr_maj, &curr_min, &curr_patch);
+    gboolean parse_found = _parse_version(found_version, &found_maj, &found_min, &found_patch);
 
-    if (parse_found == 3 && parse_curr == 3) {
+    if (parse_found && parse_curr) {
         if (found_maj > curr_maj) {
             return TRUE;
         } else if (found_maj == curr_maj && found_min > curr_min) {
@@ -699,22 +754,57 @@ get_file_paths_recursive(const char* path, GSList** contents)
     }
 }
 
+static gboolean
+_random_bytes(unsigned char* buf, size_t len)
+{
+#ifdef HAVE_LIBGCRYPT
+    // never initialise gcrypt here: omemo_crypto_init() must set up secure memory first
+    if (gcry_control(GCRYCTL_INITIALIZATION_FINISHED_P)) {
+        gcry_create_nonce(buf, len);
+        return TRUE;
+    }
+#endif
+
+    FILE* urandom = fopen("/dev/urandom", "rb");
+    if (urandom) {
+        size_t got = fread(buf, 1, len, urandom);
+        fclose(urandom);
+        if (got == len) {
+            return TRUE;
+        }
+    }
+
+    return FALSE;
+}
+
 gchar*
 get_random_string(size_t length)
 {
-    GRand* prng;
-    gchar* rand;
-    gchar alphabet[] = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
-    int endrange = sizeof(alphabet) - 1;
+    static const gchar alphabet[] = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    const unsigned alphabet_len = sizeof(alphabet) - 1;
+    const unsigned limit = 256 - (256 % alphabet_len); // reject the uneven tail, it would bias early letters
 
-    rand = g_malloc0(length + 1);
+    gchar* rand = g_malloc0(length + 1);
 
-    prng = g_rand_new();
+    for (size_t i = 0; i < length;) {
+        unsigned char block[64];
+        size_t want = length - i;
+        if (want > sizeof(block)) {
+            want = sizeof(block);
+        }
 
-    for (size_t i = 0; i < length; i++) {
-        rand[i] = alphabet[g_rand_int_range(prng, 0, endrange)];
+        if (!_random_bytes(block, want)) {
+            log_error("No cryptographic random source available for identifier generation");
+            g_free(rand);
+            return NULL;
+        }
+
+        for (size_t j = 0; j < want && i < length; j++) {
+            if (block[j] < limit) {
+                rand[i++] = alphabet[block[j] % alphabet_len];
+            }
+        }
     }
-    g_rand_free(prng);
 
     return rand;
 }
@@ -921,7 +1011,7 @@ prof_date_time_format_iso8601(GDateTime* dt)
     return ret;
 }
 
-/* build profanity version string.
+/* build CProof version string.
  * example: 0.13.1dev.master.69d8c1f9
  */
 gchar*

src/config/accounts.c

@@ -522,7 +522,7 @@ accounts_set_script_start(const char* const account_name, const char* const valu
 void
 accounts_set_client(const char* const account_name, const char* const value)
 {
-    _accounts_set_string_option(account_name, "client.name", value);
+    _accounts_set_string_option(account_name, "client.account_name", value);
 }
 
 void
@@ -576,7 +576,7 @@ accounts_clear_script_start(const char* const account_name)
 void
 accounts_clear_client(const char* const account_name)
 {
-    _accounts_clear_string_option(account_name, "client.name");
+    _accounts_clear_string_option(account_name, "client.account_name");
 }
 
 void

src/config/preferences.c

@@ -2689,7 +2689,6 @@ _get_default_boolean(preference_t pref)
     case PREF_STATUSBAR_SHOW_NUMBER:
     case PREF_STATUSBAR_SHOW_READ:
     case PREF_STATUSBAR_SHOW_DBBACKEND:
-    case PREF_REVEAL_OS:
     case PREF_CORRECTION_ALLOW:
     case PREF_RECEIPTS_SEND:
     case PREF_CARBONS:
@@ -2704,6 +2703,7 @@ _get_default_boolean(preference_t pref)
     case PREF_STROPHE_SM_RESEND:
     case PREF_AUTOPING_WARNING:
         return TRUE;
+    case PREF_REVEAL_OS:
     case PREF_SPELLCHECK_ENABLE:
     case PREF_PGP_PUBKEY_AUTOIMPORT:
     case PREF_FORCE_ENCRYPTION:

src/event/client_events.c

@@ -198,9 +198,11 @@ cl_ev_send_muc_msg_corrected(ProfMucWin* mucwin, const char* const msg, const ch
 #ifdef HAVE_OMEMO
     if (mucwin->is_omemo) {
         auto_char char* id = omemo_on_message_send((ProfWin*)mucwin, message, FALSE, TRUE, replace_id);
-        groupchat_log_omemo_msg_out(mucwin->roomjid, message);
-        log_database_add_outgoing_muc(id, mucwin->roomjid, message, replace_id, PROF_MSG_ENC_OMEMO);
-        mucwin_outgoing_msg(mucwin, message, id, PROF_MSG_ENC_OMEMO, replace_id);
+        if (id != NULL) { // nothing was sent, so don't persist or echo the plaintext
+            groupchat_log_omemo_msg_out(mucwin->roomjid, message);
+            log_database_add_outgoing_muc(id, mucwin->roomjid, message, replace_id, PROF_MSG_ENC_OMEMO);
+            mucwin_outgoing_msg(mucwin, message, id, PROF_MSG_ENC_OMEMO, replace_id);
+        }
     } else
 #endif
     {

src/event/server_events.c

@@ -205,7 +205,7 @@ void
 sv_ev_failed_login(void)
 {
     cons_show_error("Login failed.");
-    log_info("Login failed");
+    log_warning("[SECURITY] Authentication failed for %s", STR_MAYBE_NULL(session_get_account_name()));
     tlscerts_clear_current();
 }
 
@@ -1145,6 +1145,11 @@ sv_ev_certfail(const char* const errormsg, const TLSCertificate* cert)
         return 1;
     }
 
+    log_warning("[SECURITY] TLS certificate verification failed: %s (subject: %s, fingerprint: %s)",
+                errormsg,
+                cert && cert->subjectname ? cert->subjectname : "(unknown)",
+                cert && cert->fingerprint ? cert->fingerprint : "(none)");
+
     cons_show("");
     cons_show_error("TLS certificate verification failed: %s", errormsg);
     cons_show_tlscert(cert);

src/main.c

@@ -77,7 +77,7 @@ main(int argc, char** argv)
 
     if (version == TRUE) {
         auto_gchar gchar* prof_version = prof_get_version();
-        g_print("Profanity, version %s\n", prof_version);
+        g_print("CProof, version %s\n", prof_version);
 
         // lets use fixed email instead of PACKAGE_BUGREPORT
         g_print("Copyright (C) 2012 - 2019 James Booth <boothj5web@gmail.com>.\n");

src/omemo/omemo.c

@@ -1433,6 +1433,12 @@ _omemo_fingerprint(ec_public_key* identity, gboolean formatted)
     size_t identity_public_key_len = signal_buffer_len(identity_public_key);
     unsigned char* identity_public_key_data = signal_buffer_data(identity_public_key);
 
+    if (identity_public_key_len == 0) {
+        log_error("[OMEMO] cannot fingerprint an empty identity key"); // the decrement below would wrap
+        signal_buffer_free(identity_public_key);
+        return NULL;
+    }
+
     /* Skip first byte corresponding to signal DJB_TYPE */
     identity_public_key_len--;
     identity_public_key_data = &identity_public_key_data[1];

src/otr/otr.c

@@ -22,6 +22,7 @@
 #include "config/files.h"
 #include "otr/otr.h"
 #include "otr/otrlib.h"
+#include "event/client_events.h"
 #include "ui/ui.h"
 #include "ui/window_list.h"
 #include "xmpp/chat_session.h"
@@ -331,6 +332,10 @@ otr_on_message_send(ProfChatWin* chatwin, const char* const message, gboolean re
 
     // tag and send for policy opportunistic
     if (policy == PROF_OTRPOLICY_OPPORTUNISTIC) {
+        // the tagged first message is still plaintext on the wire
+        if (!allow_unencrypted_message(chatwin, message)) {
+            return TRUE;
+        }
         auto_char char* otr_tagged_msg = otr_tag_message(message);
         id = message_send_chat_otr(chatwin->barejid, otr_tagged_msg, request_receipt, replace_id);
         chatwin_outgoing_msg(chatwin, message, id, PROF_MSG_ENC_NONE, request_receipt, replace_id);

src/profanity.c

@@ -253,7 +253,7 @@ _init(char* log_level, char* config_file, char* log_file, char* theme_name)
     log_stderr_init(PROF_LEVEL_ERROR);
 
     auto_gchar gchar* prof_version = prof_get_version();
-    log_info("Starting Profanity (%s)…", prof_version);
+    log_info("Starting CProof (%s)…", prof_version);
 
     chatlog_init();
     accounts_load();

src/tools/http_common.c

@@ -14,6 +14,7 @@
 #include <string.h>
 #include <gio/gio.h>
 
+#include "log.h"
 #include "tools/http_common.h"
 
 #define FALLBACK_MSG ""
@@ -51,3 +52,13 @@ http_print_transfer(ProfWin* window, char* id, theme_item_t theme_item, const ch
 
     g_string_free(msg, TRUE);
 }
+
+void
+http_warn_insecure_transfer(ProfWin* window, char* id, const char* const url)
+{
+    log_warning("[SECURITY] TLS certificate verification disabled for transfer: %s", url);
+    http_print_transfer_update(window, id, THEME_ERROR, 0,
+                               "Security warning: TLS certificate not verified for '%s' "
+                               "(tls.policy=trust).",
+                               url);
+}

src/tools/http_common.h

@@ -17,5 +17,6 @@ G_GNUC_PRINTF(4, 5)
 void http_print_transfer(ProfWin* window, char* id, theme_item_t theme_item, const char* fmt, ...);
 G_GNUC_PRINTF(5, 6)
 void http_print_transfer_update(ProfWin* window, char* id, theme_item_t theme_item, int flags, const char* fmt, ...);
+void http_warn_insecure_transfer(ProfWin* window, char* id, const char* const url);
 
 #endif

src/tools/http_download.c

@@ -25,6 +25,7 @@
 #include "profanity.h"
 #include "event/client_events.h"
 #include "tools/http_download.h"
+#include "tools/http_common.h"
 #include "config/cafile.h"
 #include "config/preferences.h"
 #include "ui/ui.h"
@@ -153,6 +154,8 @@ http_file_get(void* userdata)
     if (insecure) {
         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+        http_warn_insecure_transfer(download->window, download->id,
+                                    download->display_url ?: download->url);
     }
 
     if ((res = curl_easy_perform(curl)) != CURLE_OK) {

src/tools/http_upload.c

@@ -22,6 +22,7 @@
 #include "profanity.h"
 #include "event/client_events.h"
 #include "tools/http_upload.h"
+#include "tools/http_common.h"
 #include "config/cafile.h"
 #include "config/preferences.h"
 #include "ui/ui.h"
@@ -242,6 +243,7 @@ http_file_put(void* userdata)
     if (insecure) {
         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+        http_warn_insecure_transfer(upload->window, upload->put_url, upload->put_url);
     }
 
     curl_easy_setopt(curl, CURLOPT_READDATA, fh);

src/ui/console.c

@@ -2830,8 +2830,7 @@ cons_privacy_setting(void)
         if (account->client) {
             cons_show("Client name (/account set <account> clientid)              : %s", account->client);
         } else {
-            auto_gchar gchar* prof_version = prof_get_version();
-            cons_show("Client name (/account set <account> clientid)              : Profanity %s", prof_version);
+            cons_show("Client name (/account set <account> clientid)              : Pidgin");
         }
         if (account->max_sessions > 0) {
             cons_show("Max sessions alarm (/account set <account> session_alarm)  : %d", account->max_sessions);

src/xmpp/capabilities.c

@@ -23,6 +23,7 @@
 #include "plugins/plugins.h"
 #include "config/files.h"
 #include "config/preferences.h"
+#include "xmpp/connection.h"
 #include "xmpp/xmpp.h"
 #include "xmpp/stanza.h"
 #include "xmpp/form.h"
@@ -271,6 +272,19 @@ caps_map_jid_to_ver(const char* const jid, const char* const ver)
     g_hash_table_insert(jid_to_ver, strdup(jid), strdup(ver));
 }
 
+void
+caps_cache_clear(void)
+{
+    g_hash_table_remove_all(jid_to_ver);
+    g_hash_table_remove_all(jid_to_caps);
+    if (caps_prof_keyfile.keyfile) {
+        g_key_file_free(caps_prof_keyfile.keyfile);
+    }
+    caps_prof_keyfile.keyfile = g_key_file_new();
+    cache = caps_prof_keyfile.keyfile;
+    save_keyfile(&caps_prof_keyfile);
+}
+
 gboolean
 caps_cache_contains(const char* const ver)
 {

src/xmpp/capabilities.h

@@ -28,5 +28,6 @@ void caps_map_jid_to_ver(const char* const jid, const char* const ver);
 gboolean caps_cache_contains(const char* const ver);
 GList* caps_get_features(void);
 char* caps_get_my_sha1(xmpp_ctx_t* const ctx);
+void caps_cache_clear(void);
 
 #endif

src/xmpp/connection.c

@@ -46,6 +46,7 @@ typedef struct prof_conn_t
     GHashTable* available_resources;
     GHashTable* features_by_jid;
     GHashTable* requested_features;
+    gboolean tls_disabled_by_user;
 } ProfConnection;
 
 typedef struct
@@ -212,6 +213,21 @@ _conn_apply_settings(const char* const jid, const char* const passwd, const char
 #undef LOG_FLAG_IF_SET
     }
 
+    conn.tls_disabled_by_user = (flags & XMPP_CONN_FLAG_DISABLE_TLS) ? TRUE : FALSE;
+
+    if (flags & XMPP_CONN_FLAG_DISABLE_TLS) {
+        log_warning("[SECURITY] TLS is disabled for this connection: traffic and credentials are sent in the clear");
+        cons_show_error("Security warning: TLS is disabled, this connection is unencrypted.");
+    }
+    if (flags & XMPP_CONN_FLAG_TRUST_TLS) {
+        log_warning("[SECURITY] TLS certificate verification is disabled for this connection");
+        cons_show_error("Security warning: TLS certificates are not verified for this connection.");
+    }
+    if (flags & XMPP_CONN_FLAG_LEGACY_AUTH) {
+        log_warning("[SECURITY] Legacy (XEP-0078) authentication enabled: the password is sent without SASL");
+        cons_show_error("Security warning: legacy authentication is enabled for this connection.");
+    }
+
     if (xmpp_conn_set_flags(conn.xmpp_conn, flags)) {
         log_error("libstrophe doesn't accept this combination of flags: 0x%lx", flags);
         conn.conn_status = JABBER_DISCONNECTED;
@@ -364,7 +380,8 @@ _register_handle_proceedtls_default(xmpp_conn_t* xmpp_conn,
             xmpp_handler_delete(xmpp_conn, _register_handle_error);
             xmpp_conn_open_stream_default(xmpp_conn);
         } else {
-            log_debug("TLS failed.");
+            log_warning("[SECURITY] TLS handshake failed during registration, aborting");
+            cons_show_error("Security warning: TLS handshake failed, registration aborted.");
             /* failed tls spoils the connection, so disconnect */
             xmpp_disconnect(xmpp_conn);
         }
@@ -408,6 +425,14 @@ _register_handle_features(xmpp_conn_t* xmpp_conn, xmpp_stanza_t* stanza, void* u
         return 0;
     }
 
+    /* Registration sends the new password in this stream: refuse to do so in the clear */
+    if (!xmpp_conn_is_secured(xmpp_conn)) {
+        log_warning("[SECURITY] Refusing in-band registration over an unencrypted stream");
+        cons_show_error("Registration aborted: the connection is not encrypted and the password would be sent in the clear.");
+        xmpp_disconnect(xmpp_conn);
+        return 0;
+    }
+
     /* check whether server supports in-band registration */
     child = xmpp_stanza_get_child_by_name(stanza, "register");
     if (!child) {
@@ -957,6 +982,12 @@ _connection_handler(xmpp_conn_t* const xmpp_conn, const xmpp_conn_event_t status
         conn.features_by_jid = g_hash_table_new_full(g_str_hash, g_str_equal, free, (GDestroyNotify)g_hash_table_destroy);
         g_hash_table_insert(conn.features_by_jid, strdup(conn.domain), g_hash_table_new_full(g_str_hash, g_str_equal, free, NULL));
 
+        // tls.policy=allow negotiates opportunistically, so an unrequested downgrade must not pass silently
+        if (!connection_is_secured() && !conn.tls_disabled_by_user) {
+            log_warning("[SECURITY] Logged in over an unencrypted connection to %s: the server offered no usable TLS", conn.domain);
+            cons_show_error("Security warning: this session is NOT encrypted, the server did not provide TLS. Use '/account set <account> tls force' to require it.");
+        }
+
         session_login_success(connection_is_secured());
 
         if (conn.queued_messages) {
@@ -1023,8 +1054,9 @@ _connection_handler(xmpp_conn_t* const xmpp_conn, const xmpp_conn_event_t status
             int port;
             if (stream_error && stream_error->stanza && _get_other_host(stream_error->stanza, &host, &port)) {
                 g_assert(port >= 0 && port <= UINT16_MAX);
+                log_warning("[SECURITY] Server redirected the connection (see-other-host) to \"%s\":%d", host, port);
+                cons_show_error("Security notice: the server redirected this connection to %s:%d.", host, port);
                 session_reconnect(host, (unsigned short)port);
-                log_debug("Connection handler: Forcing a re-connect to \"%s\"", host);
                 conn.conn_status = JABBER_RECONNECT;
                 return;
             }
@@ -1121,8 +1153,12 @@ _random_bytes_init(void)
         profanity_instance_id = g_key_file_get_string(keyfile.keyfile, "identifier", "random_bytes", NULL);
     } else {
         profanity_instance_id = get_random_string(10);
-        g_key_file_set_string(keyfile.keyfile, "identifier", "random_bytes", profanity_instance_id);
-        save_keyfile(&keyfile);
+        if (profanity_instance_id) {
+            g_key_file_set_string(keyfile.keyfile, "identifier", "random_bytes", profanity_instance_id);
+            save_keyfile(&keyfile);
+        } else {
+            log_error("Could not generate an instance identifier: no random source available");
+        }
     }
 
     free_keyfile(&keyfile);

src/xmpp/iq.c

@@ -1681,7 +1681,7 @@ _version_get_handler(xmpp_stanza_t* const stanza)
     xmpp_stanza_t* name = xmpp_stanza_new(ctx);
     xmpp_stanza_set_name(name, "name");
     xmpp_stanza_t* name_txt = xmpp_stanza_new(ctx);
-    xmpp_stanza_set_text(name_txt, is_custom_client ? client : "Profanity");
+    xmpp_stanza_set_text(name_txt, is_custom_client ? client : "Pidgin");
     xmpp_stanza_add_child(name, name_txt);
     xmpp_stanza_add_child(query, name);
     bool include_os = prefs_get_boolean(PREF_REVEAL_OS) && !is_custom_client;
@@ -1690,7 +1690,7 @@ _version_get_handler(xmpp_stanza_t* const stanza)
     xmpp_stanza_t* version = xmpp_stanza_new(ctx);
     xmpp_stanza_set_name(version, "version");
     xmpp_stanza_t* version_txt = xmpp_stanza_new(ctx);
-    auto_gchar gchar* prof_version = prof_get_version();
+    auto_gchar gchar* prof_version = g_strdup("");
 
     if (!is_custom_client) {
         xmpp_stanza_set_text(version_txt, prof_version);

src/xmpp/jid.c

@@ -280,9 +280,13 @@ jid_fulljid_or_barejid(Jid* jid)
 gchar*
 jid_random_resource(void)
 {
-    auto_gchar gchar* rand = get_random_string(4);
+    gchar* rand = g_malloc0(29);
+    const gchar* digits = "0123456789";
 
-    gchar* result = g_strdup_printf("profanity.%s", rand);
+    for (int i = 0; i < 28; i++) {
+        rand[i] = digits[g_random_int_range(0, 10)];
+    }
+    rand[28] = '\0';
 
-    return result;
+    return rand;
 }

src/xmpp/session.c

@@ -178,7 +178,7 @@ session_connect_with_details(const char* const jid, const char* const passwd, co
         saved_details.auth_policy = NULL;
     }
 
-    // use 'profanity' when no resourcepart in provided jid
+    // use random string when no resourcepart in provided jid
     auto_jid Jid* jidp = jid_create(jid);
     if (jidp->resourcepart == NULL) {
         auto_gchar gchar* resource = jid_random_resource();

src/xmpp/stanza.c

@@ -32,6 +32,7 @@
 
 static void _stanza_add_unique_id(xmpp_stanza_t* stanza);
 static gchar* _stanza_create_sha1_hash(char* str);
+static const char* _stanza_get_caps_node(const char* const client);
 
 #if 0
 xmpp_stanza_t*
@@ -930,23 +931,22 @@ stanza_create_caps_query_element(xmpp_ctx_t* ctx)
 
     xmpp_stanza_t* identity = xmpp_stanza_new(ctx);
     xmpp_stanza_set_name(identity, "identity");
+    xmpp_stanza_set_type(identity, "pc");
     xmpp_stanza_set_attribute(identity, "category", "client");
 
     ProfAccount* account = accounts_get_account(session_get_account_name());
-    gchar* client = account->client;
-    bool is_custom_client = client != NULL;
 
-    GString* name_str = g_string_new(is_custom_client ? client : "Profanity ");
-    if (!is_custom_client) {
-        xmpp_stanza_set_type(identity, "console");
-        auto_gchar gchar* prof_version = prof_get_version();
-        g_string_append(name_str, prof_version);
+    auto_gchar gchar* name = g_strdup(account->client ? account->client : "Pidgin");
+
+    if (account->client) {
+        gchar* space = strchr(name, ' ');
+        if (space) {
+            *space = '\0';
+        }
     }
-
     account_free(account);
 
-    xmpp_stanza_set_attribute(identity, "name", name_str->str);
-    g_string_free(name_str, TRUE);
+    xmpp_stanza_set_attribute(identity, "name", name);
     xmpp_stanza_add_child(query, identity);
     xmpp_stanza_release(identity);
 
@@ -1994,6 +1994,42 @@ stanza_attach_last_activity(xmpp_ctx_t* const ctx,
     xmpp_stanza_release(query);
 }
 
+static const char*
+_stanza_get_caps_node(const char* const client)
+{
+    if (!client || g_strcmp0(client, "") == 0) {
+        return "http://pidgin.im";
+    }
+
+    auto_gchar gchar* lower = g_ascii_strdown(client, -1);
+
+    if (g_str_has_prefix(lower, "pidgin")) {
+        return "http://pidgin.im";
+    }
+
+    if (g_str_has_prefix(lower, "gajim")) {
+        return "https://gajim.org";
+    }
+
+    if (g_str_has_prefix(lower, "conversations")) {
+        return "https://conversations.im";
+    }
+
+    if (g_str_has_prefix(lower, "psi+")) {
+        return "http://psi-plus.com";
+    }
+
+    if (g_str_has_prefix(lower, "psi")) {
+        return "http://psi-im.org";
+    }
+
+    if (g_str_has_prefix(lower, "profanity")) {
+        return "http://profanity-im.github.io";
+    }
+
+    return "";
+}
+
 void
 stanza_attach_caps(xmpp_ctx_t* const ctx, xmpp_stanza_t* const presence)
 {
@@ -2002,9 +2038,13 @@ stanza_attach_caps(xmpp_ctx_t* const ctx, xmpp_stanza_t* const presence)
     xmpp_stanza_set_ns(caps, STANZA_NS_CAPS);
     xmpp_stanza_t* query = stanza_create_caps_query_element(ctx);
 
+    ProfAccount* account = accounts_get_account(session_get_account_name());
+    const char* node = _stanza_get_caps_node(account->client);
+    account_free(account);
+
     char* sha1 = caps_get_my_sha1(ctx);
     xmpp_stanza_set_attribute(caps, STANZA_ATTR_HASH, "sha-1");
-    xmpp_stanza_set_attribute(caps, STANZA_ATTR_NODE, "http://profanity-im.github.io");
+    xmpp_stanza_set_attribute(caps, STANZA_ATTR_NODE, node);
     xmpp_stanza_set_attribute(caps, STANZA_ATTR_VER, sha1);
     xmpp_stanza_add_child(presence, caps);
     xmpp_stanza_release(caps);

tests/functionaltests/functionaltests.c

@@ -117,6 +117,7 @@ main(int argc, char* argv[])
         PROF_FUNC_TEST(connect_jid_requests_bookmarks),
         PROF_FUNC_TEST(connect_bad_password),
         PROF_FUNC_TEST(connect_shows_presence_updates),
+        PROF_FUNC_TEST(connect_warns_on_insecure_transport),
 
         /* Ping tests - XEP-0199 XMPP Ping */
         PROF_FUNC_TEST(ping_server),

tests/functionaltests/proftest.c

@@ -601,11 +601,11 @@ prof_connect_with_roster(const char* roster)
     assert_true(prof_output_regex(".+online.+ \\(priority 0\\)\\."));
 
     expect_timeout = EXPECT_TIMEOUT_CONNECT;
-    // Wait for presence stanza to be sent (content-based, not ID-based)
+    // Wait for presence stanza to be sent
     // Match the actual attribute order from stanza_attach_caps
     assert_true(stbbr_received(
         "<presence id=\"*\">"
-        "<c xmlns=\"http://jabber.org/protocol/caps\" hash=\"sha-1\" node=\"http://profanity-im.github.io\" ver=\"*\"/>"
+        "<c xmlns=\"http://jabber.org/protocol/caps\" hash=\"sha-1\" node=\"*\" ver=\"*\"/>"
         "</presence>"));
 }
 

tests/functionaltests/test_connect.c

@@ -25,7 +25,7 @@ connect_jid_sends_presence_after_receiving_roster(void **state)
 
     assert_true(stbbr_received(
         "<presence id='*'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -92,3 +92,15 @@ connect_shows_presence_updates(void **state)
     );
     assert_true(prof_output_exact("Buddy1 (mobile) is xa, \"Gone :(\""));
 }
+
+void
+connect_warns_on_insecure_transport(void **state)
+{
+    /* the harness connects with "tls disable auth legacy": both downgrades must reach the console */
+    prof_connect();
+
+    prof_timeout(10);
+    assert_true(prof_output_exact("Security warning: TLS is disabled, this connection is unencrypted."));
+    assert_true(prof_output_exact("Security warning: legacy authentication is enabled for this connection."));
+    prof_timeout_reset();
+}

tests/functionaltests/test_connect.h

@@ -3,3 +3,4 @@ void connect_jid_sends_presence_after_receiving_roster(void **state);
 void connect_jid_requests_bookmarks(void **state);
 void connect_bad_password(void **state);
 void connect_shows_presence_updates(void **state);
+void connect_warns_on_insecure_transport(void **state);

tests/functionaltests/test_export_import.c

@@ -1289,7 +1289,7 @@ _join_muc(const char* room)
     snprintf(presence, sizeof(presence),
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='%s/stabber'>"
             "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' "
-               "node='http://profanity-im.github.io' ver='*'/>"
+               "node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"

tests/functionaltests/test_muc.c

@@ -26,7 +26,7 @@ sends_room_join(void **state)
     assert_true(stbbr_received(
         "<presence id='*' to='testroom@conference.localhost/stabber'>"
             "<x xmlns='http://jabber.org/protocol/muc'/>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -41,7 +41,7 @@ sends_room_join_with_nick(void **state)
     assert_true(stbbr_received(
         "<presence id='*' to='testroom@conference.localhost/testnick'>"
             "<x xmlns='http://jabber.org/protocol/muc'/>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -58,7 +58,7 @@ sends_room_join_with_password(void **state)
             "<x xmlns='http://jabber.org/protocol/muc'>"
                 "<password>testpassword</password>"
             "</x>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -75,7 +75,7 @@ sends_room_join_with_nick_and_password(void **state)
             "<x xmlns='http://jabber.org/protocol/muc'>"
                 "<password>testpassword</password>"
             "</x>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -87,7 +87,7 @@ shows_role_and_affiliation_on_join(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -107,7 +107,7 @@ shows_subject_on_join(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -135,7 +135,7 @@ shows_history_message(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -170,7 +170,7 @@ shows_occupant_join(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -200,7 +200,7 @@ shows_message(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -227,7 +227,7 @@ shows_me_message_from_occupant(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -254,7 +254,7 @@ shows_me_message_from_self(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -281,7 +281,7 @@ shows_all_messages_in_console_when_window_not_focussed(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -322,7 +322,7 @@ shows_first_message_in_console_when_window_not_focussed(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -369,7 +369,7 @@ shows_no_message_in_console_when_window_not_focussed(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -401,7 +401,7 @@ sends_affiliation_list_request(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='moderator' jid='stabber@localhost/profanity' affiliation='owner'/>"
             "</x>"
@@ -434,7 +434,7 @@ sends_kick_request(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='moderator' jid='stabber@localhost/profanity' affiliation='admin'/>"
             "</x>"

tests/functionaltests/test_presence.c

@@ -19,7 +19,7 @@ presence_online(void **state)
     assert_true(stbbr_received(
         "<presence id='*'>"
             "<status>online</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -36,7 +36,7 @@ presence_online_with_message(void **state)
     assert_true(stbbr_received(
         "<presence id='*'>"
             "<status>Hi there</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -54,7 +54,7 @@ presence_away(void **state)
         "<presence id='*'>"
             "<show>away</show>"
             "<status>away</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -72,7 +72,7 @@ presence_away_with_message(void **state)
         "<presence id='*'>"
             "<show>away</show>"
             "<status>I'm not here for a bit</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -90,7 +90,7 @@ presence_xa(void **state)
         "<presence id='*'>"
             "<show>xa</show>"
             "<status>xa</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -108,7 +108,7 @@ presence_xa_with_message(void **state)
         "<presence id='*'>"
             "<show>xa</show>"
             "<status>Gone to the shops</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -126,7 +126,7 @@ presence_dnd(void **state)
         "<presence id='*'>"
             "<show>dnd</show>"
             "<status>dnd</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -144,7 +144,7 @@ presence_dnd_with_message(void **state)
         "<presence id='*'>"
             "<show>dnd</show>"
             "<status>Working</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -162,7 +162,7 @@ presence_chat(void **state)
         "<presence id='*'>"
             "<show>chat</show>"
             "<status>chat</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -180,7 +180,7 @@ presence_chat_with_message(void **state)
         "<presence id='*'>"
             "<show>chat</show>"
             "<status>Free to talk</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -197,7 +197,7 @@ presence_set_priority(void **state)
     assert_true(stbbr_received(
         "<presence id='*'>"
             "<priority>25</priority>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -212,7 +212,7 @@ presence_includes_priority(void **state)
     assert_true(stbbr_received(
         "<presence id='*'>"
             "<priority>25</priority>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 
@@ -223,7 +223,7 @@ presence_includes_priority(void **state)
             "<priority>25</priority>"
             "<show>chat</show>"
             "<status>Free to talk</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -239,7 +239,7 @@ presence_keeps_status(void **state)
         "<presence id='*'>"
             "<show>chat</show>"
             "<status>Free to talk</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 
@@ -250,7 +250,7 @@ presence_keeps_status(void **state)
             "<show>chat</show>"
             "<status>Free to talk</status>"
             "<priority>25</priority>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }

tests/unittests/test_common.c

@@ -1089,6 +1089,45 @@ release_is_new__tests__various(void** state)
     assert_false(release_is_new("0.16.0", ""));
     assert_false(release_is_new(NULL, "1.0.0"));
     assert_false(release_is_new("1.0.0", NULL));
+
+    // the found version is untrusted network input: nothing but strictly N.N.N may parse
+    assert_false(release_is_new("0.16.0", "  1.0.0"));       // leading whitespace
+    assert_false(release_is_new("0.16.0", "+1.0.0"));        // explicit sign
+    assert_false(release_is_new("0.16.0", "-1.0.0"));        // negative major
+    assert_false(release_is_new("0.16.0", "1.0.0-rc1"));     // trailing garbage
+    assert_false(release_is_new("0.16.0", "1.0.0\n"));       // trailing newline
+    assert_false(release_is_new("0.16.0", "1..0"));          // empty component
+    assert_false(release_is_new("0.16.0", "0x10.0.0"));      // hex is not accepted
+    assert_false(release_is_new("0.16.0", "99999999999.0.0")); // out of int range, must not wrap
+    assert_false(release_is_new("0.16.0", "1.0.0 malicious"));
+
+    // Boundary: the largest still-parsable component is accepted
+    assert_true(release_is_new("0.16.0", "2147483647.0.0"));
+}
+
+void
+get_random_string__generates_valid_ids(void** state)
+{
+    const gchar* alphabet = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+
+    for (size_t len = 1; len <= 40; len++) {
+        gchar* id = get_random_string(len);
+        assert_non_null(id);
+        assert_int_equal(len, strlen(id));
+        for (size_t i = 0; i < len; i++) {
+            assert_non_null(strchr(alphabet, id[i]));
+        }
+        g_free(id);
+    }
+
+    // a collision here would mean a dead random source
+    gchar* a = get_random_string(20);
+    gchar* b = get_random_string(20);
+    assert_non_null(a);
+    assert_non_null(b);
+    assert_string_not_equal(a, b);
+    g_free(a);
+    g_free(b);
 }
 
 void

tests/unittests/test_common.h

@@ -64,5 +64,6 @@ void valid_tls_policy_option__is__correct_for_various_inputs(void** state);
 void get_mentions__tests__various(void** state);
 void release_is_new__tests__various(void** state);
 void str_xml_sanitize__strips_illegal_characters(void** state);
+void get_random_string__generates_valid_ids(void** state);
 
 #endif

tests/unittests/unittests.c

@@ -687,6 +687,7 @@ main(int argc, char* argv[])
         cmocka_unit_test(get_mentions__tests__various),
         cmocka_unit_test(release_is_new__tests__various),
         cmocka_unit_test(str_xml_sanitize__strips_illegal_characters),
+        cmocka_unit_test(get_random_string__generates_valid_ids),
 
         cmocka_unit_test_setup_teardown(plugins_get_command_names__returns__no_commands,
                                         load_preferences,

tests/unittests/xmpp/stub_xmpp.c

@@ -500,6 +500,11 @@ caps_jid_has_feature(const char* const jid, const char* const feature)
     return FALSE;
 }
 
+void
+caps_cache_clear(void)
+{
+}
+
 gboolean
 bookmark_add(const char* jid, const char* nick, const char* password, const char* autojoin_str, const char* name)
 {