GNU bug report logs - #37344
rcirc: nil gets interpreted as a nickname

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 37344 in the body.
You can then email your comments to 37344 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Naïm Favier <n.emacs <at> monade.li>
To: bug-gnu-emacs <at> gnu.org
Subject: rcirc: nil gets interpreted as a nickname
Date: Sun, 8 Sep 2019 20:58:59 +0200

Severity: normal

Ever since I changed my nickname to "nil" on Freenode, I've been
getting occasional private messages from unknown users consisting of a
single empty CTCP ACTION. After a bit of investigating, it turned out
they all used rcirc. The situation was clear at that point: somewhere
in rcirc's source code, a nil value is being implicitly converted to a
string and used as the target of a PRIVMSG command.

The bug seems to be reproducible by issuing "/me" (without arguments)
inside a server buffer: the "nil" user on that server gets sent an
empty ACTION.

Suggested fix: in rcirc-send-privmsg, fail if target is nil. It might
be useful to check other places where the "%s" format is used, to
discover similar bugs.

Message #8 received at 37344 <at> debbugs.gnu.org (full text, mbox):

From: Leo Liu <sdl.web <at> gmail.com>
To: Naïm Favier <n.emacs <at> monade.li>
Cc: 37344 <at> debbugs.gnu.org
Subject: Re: bug#37344: rcirc: nil gets interpreted as a nickname
Date: Mon, 09 Sep 2019 09:24:26 +0800

On 2019-09-08 20:58 +0200, Naïm Favier wrote:
> Severity: normal
>
> Ever since I changed my nickname to "nil" on Freenode, I've been
> getting occasional private messages from unknown users consisting of a
> single empty CTCP ACTION. After a bit of investigating, it turned out
> they all used rcirc. The situation was clear at that point: somewhere
> in rcirc's source code, a nil value is being implicitly converted to a
> string and used as the target of a PRIVMSG command.
>
> The bug seems to be reproducible by issuing "/me" (without arguments)
> inside a server buffer: the "nil" user on that server gets sent an
> empty ACTION.
>
> Suggested fix: in rcirc-send-privmsg, fail if target is nil. It might
> be useful to check other places where the "%s" format is used, to
> discover similar bugs.

Thanks. Does the following patch fix the issue?

diff --git a/lisp/net/rcirc.el b/lisp/net/rcirc.el
index de524d9e..d95db26c 100644
--- a/lisp/net/rcirc.el
+++ b/lisp/net/rcirc.el
@@ -825,6 +825,7 @@ Function is called with PROCESS, COMMAND, SENDER, ARGS and LINE.")
     (process-send-string process string)))
 
 (defun rcirc-send-privmsg (process target string)
+  (cl-check-type target string)
   (rcirc-send-string process (format "PRIVMSG %s :%s" target string)))
 
 (defun rcirc-send-ctcp (process target request &optional args)
@@ -2337,8 +2338,8 @@ With a prefix arg, prompt for new topic."
   (let ((timestamp (format-time-string "%s")))
     (rcirc-send-ctcp process target "PING" timestamp)))
 
-(defun rcirc-cmd-me (args &optional process target)
-  (rcirc-send-ctcp process target "ACTION" args))
+(defun rcirc-cmd-me (args process target)
+  (when target (rcirc-send-ctcp process target "ACTION" args)))
 
 (defun rcirc-add-or-remove (set &rest elements)
   (dolist (elt elements)

Message #11 received at 37344 <at> debbugs.gnu.org (full text, mbox):

From: Naïm Favier <n.emacs <at> monade.li>
To: Leo Liu <sdl.web <at> gmail.com>
Cc: 37344 <at> debbugs.gnu.org
Subject: Re: bug#37344: rcirc: nil gets interpreted as a nickname
Date: Mon, 9 Sep 2019 11:56:55 +0200

Yes, it does.

On Mon, 9 Sep 2019 at 03:24, Leo Liu <sdl.web <at> gmail.com> wrote:
>
> On 2019-09-08 20:58 +0200, Naïm Favier wrote:
> > Severity: normal
> >
> > Ever since I changed my nickname to "nil" on Freenode, I've been
> > getting occasional private messages from unknown users consisting of a
> > single empty CTCP ACTION. After a bit of investigating, it turned out
> > they all used rcirc. The situation was clear at that point: somewhere
> > in rcirc's source code, a nil value is being implicitly converted to a
> > string and used as the target of a PRIVMSG command.
> >
> > The bug seems to be reproducible by issuing "/me" (without arguments)
> > inside a server buffer: the "nil" user on that server gets sent an
> > empty ACTION.
> >
> > Suggested fix: in rcirc-send-privmsg, fail if target is nil. It might
> > be useful to check other places where the "%s" format is used, to
> > discover similar bugs.
>
> Thanks. Does the following patch fix the issue?
>
> diff --git a/lisp/net/rcirc.el b/lisp/net/rcirc.el
> index de524d9e..d95db26c 100644
> --- a/lisp/net/rcirc.el
> +++ b/lisp/net/rcirc.el
> @@ -825,6 +825,7 @@ Function is called with PROCESS, COMMAND, SENDER, ARGS and LINE.")
>      (process-send-string process string)))
>
>  (defun rcirc-send-privmsg (process target string)
> +  (cl-check-type target string)
>    (rcirc-send-string process (format "PRIVMSG %s :%s" target string)))
>
>  (defun rcirc-send-ctcp (process target request &optional args)
> @@ -2337,8 +2338,8 @@ With a prefix arg, prompt for new topic."
>    (let ((timestamp (format-time-string "%s")))
>      (rcirc-send-ctcp process target "PING" timestamp)))
>
> -(defun rcirc-cmd-me (args &optional process target)
> -  (rcirc-send-ctcp process target "ACTION" args))
> +(defun rcirc-cmd-me (args process target)
> +  (when target (rcirc-send-ctcp process target "ACTION" args)))
>
>  (defun rcirc-add-or-remove (set &rest elements)
>    (dolist (elt elements)

Message #16 received at 37344 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Leo Liu <sdl.web <at> gmail.com>
Cc: Naïm Favier <n.emacs <at> monade.li>, 37344 <at> debbugs.gnu.org
Subject: Re: bug#37344: rcirc: nil gets interpreted as a nickname
Date: Fri, 20 Sep 2019 20:33:18 +0200

Leo Liu <sdl.web <at> gmail.com> writes:

> Thanks. Does the following patch fix the issue?

It was confirmed that it does, so I guess you should just apply the
patch, but:


[...]

> -(defun rcirc-cmd-me (args &optional process target)
> -  (rcirc-send-ctcp process target "ACTION" args))
> +(defun rcirc-cmd-me (args process target)
> +  (when target (rcirc-send-ctcp process target "ACTION" args)))

Perhaps you should keep the &optional there to avoid changing the call
signature?  Somebody else may have code that calls the function with
that calling convention.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Message #19 received at 37344 <at> debbugs.gnu.org (full text, mbox):

From: Leo Liu <sdl.web <at> gmail.com>
To: Lars Ingebrigtsen <larsi <at> gnus.org>
Cc: Naïm Favier <n.emacs <at> monade.li>, 37344 <at> debbugs.gnu.org
Subject: Re: bug#37344: rcirc: nil gets interpreted as a nickname
Date: Sat, 21 Sep 2019 13:21:04 +0800

On 2019-09-20 20:33 +0200, Lars Ingebrigtsen wrote:
>> Thanks. Does the following patch fix the issue?
>
> It was confirmed that it does, so I guess you should just apply the
> patch, but:

Will do.

>> -(defun rcirc-cmd-me (args &optional process target)
>> -  (rcirc-send-ctcp process target "ACTION" args))
>> +(defun rcirc-cmd-me (args process target)
>> +  (when target (rcirc-send-ctcp process target "ACTION" args)))
>
> Perhaps you should keep the &optional there to avoid changing the call
> signature?  Somebody else may have code that calls the function with
> that calling convention.

The signature is wrong from the start. Directly call them without
providing these optional (mandatory-in-disguise) arguments throws an
error, unlike commands defined by defun-rcirc-command which correctly
handle &optional arguments. I'll commit the patch as is if no
objections. Thanks for raising the issue.

Leo

Message #22 received at 37344 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Leo Liu <sdl.web <at> gmail.com>
Cc: Naïm Favier <n.emacs <at> monade.li>, 37344 <at> debbugs.gnu.org
Subject: Re: bug#37344: rcirc: nil gets interpreted as a nickname
Date: Mon, 07 Oct 2019 06:55:17 +0200

Leo Liu <sdl.web <at> gmail.com> writes:

> The signature is wrong from the start. Directly call them without
> providing these optional (mandatory-in-disguise) arguments throws an
> error, unlike commands defined by defun-rcirc-command which correctly
> handle &optional arguments. I'll commit the patch as is if no
> objections. Thanks for raising the issue.

I have no objections; please go ahead.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Message #27 received at 37344-done <at> debbugs.gnu.org (full text, mbox):

From: Leo Liu <sdl.web <at> gmail.com>
To: Lars Ingebrigtsen <larsi <at> gnus.org>
Cc: Naïm Favier <n.emacs <at> monade.li>,
 37344-done <at> debbugs.gnu.org
Subject: Re: bug#37344: rcirc: nil gets interpreted as a nickname
Date: Mon, 07 Oct 2019 19:01:29 +0800

Version: 26.4

On 2019-10-07 06:55 +0200, Lars Ingebrigtsen wrote:
> I have no objections; please go ahead.

I have committed the change to emacs-26. Thanks.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.