WIP: security: harden untrusted-input handling (issue #148) #176

Draft

jabber.developer2 wants to merge 1 commits from fix/untrusted-input-148 into master

Author	SHA1	Message	Date
jabber.developer2	250703a0bf	security: harden untrusted-input handling (issue #148 ) All checks were successful CI Code / Check spelling (pull_request) Successful in 14s Details CI Code / Check coding style (pull_request) Successful in 26s Details CI Code / Code Coverage (pull_request) Successful in 3m29s Details CI Code / Linux (debian) (pull_request) Successful in 5m13s Details CI Code / Linux (ubuntu) (pull_request) Successful in 5m16s Details CI Code / Linux (arch) (pull_request) Successful in 7m34s Details T02: guard the receive-path handlers that dereferenced jid_create() without a NULL check — MUC join errors, subscribed/unsubscribed presence and, with silence.non-roster enabled, every incoming message. A stanza with a missing or malformed 'from' crashed the client (REQ-INP-01) T11: restrict /url open and /url save to http, https and aesgcm, so a received file:, javascript: or data: URL is refused (REQ-INP-06); spawn terminal-notifier through g_spawn_async with an argv instead of building a shell command for system() (REQ-INP-07); apply the XEP-0359 disco gate to MAM result ids, as live stanza-ids already do (REQ-INP-05); replace control and bidi-reordering characters in incoming message bodies with U+FFFD before they reach the terminal, the logs and the database, keeping LRM/RLM for legitimate RTL text (REQ-INP-08); cover JID part-length boundaries and invalid UTF-8 (REQ-INP-02) T10: replace strcpy/strcat/alloca and sprintf with g_strdup_printf and g_snprintf (REQ-MEM-03); allocate the OMEMO key buffers with g_malloc so a failed allocation cannot reach the following memcpy (REQ-MEM-04); remove the variable-length arrays and enforce -Werror=vla. Two of them were sized from remote input: the disco#info feature count and a chat message word length. The flag also caught a one-past-the-end write and a leak in the plugin autocompleter bindings (REQ-MEM-09)	2026-08-01 13:39:19 +03:00

Author

SHA1

Message

Date

jabber.developer2

250703a0bf

security: harden untrusted-input handling (issue #148 )

CI Code / Check spelling (pull_request) Successful in 14s

Details

CI Code / Check coding style (pull_request) Successful in 26s

Details

CI Code / Code Coverage (pull_request) Successful in 3m29s

Details

CI Code / Linux (debian) (pull_request) Successful in 5m13s

Details

CI Code / Linux (ubuntu) (pull_request) Successful in 5m16s

Details

CI Code / Linux (arch) (pull_request) Successful in 7m34s

Details

T02: guard the receive-path handlers that dereferenced jid_create()
without a NULL check — MUC join errors, subscribed/unsubscribed
presence and, with silence.non-roster enabled, every incoming message.
A stanza with a missing or malformed 'from' crashed the client
(REQ-INP-01)

T11: restrict /url open and /url save to http, https and aesgcm, so a
received file:, javascript: or data: URL is refused (REQ-INP-06); spawn
terminal-notifier through g_spawn_async with an argv instead of
building a shell command for system() (REQ-INP-07); apply the XEP-0359
disco gate to MAM result ids, as live stanza-ids already do
(REQ-INP-05); replace control and bidi-reordering characters in
incoming message bodies with U+FFFD before they reach the terminal, the
logs and the database, keeping LRM/RLM for legitimate RTL text
(REQ-INP-08); cover JID part-length boundaries and invalid UTF-8
(REQ-INP-02)

T10: replace strcpy/strcat/alloca and sprintf with g_strdup_printf and
g_snprintf (REQ-MEM-03); allocate the OMEMO key buffers with g_malloc
so a failed allocation cannot reach the following memcpy (REQ-MEM-04);
remove the variable-length arrays and enforce -Werror=vla. Two of them
were sized from remote input: the disco#info feature count and a chat
message word length. The flag also caught a one-past-the-end write and
a leak in the plugin autocompleter bindings (REQ-MEM-09)

2026-08-01 13:39:19 +03:00

WIP: security: harden untrusted-input handling (issue #148) #176

1 Commits