CVE-2023-38690 (TypeScript, published 2023-08-04T17:15Z)
Description: value: matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/matrix-org/matrix-appservice-irc
Files changed:
.eslintrc
changelog.d/1753.bugfix
package.json
spec/e2e/pooling.spec.ts
spec/e2e/powerlevels.spec.ts
spec/integ/provisioning.spec.ts
spec/unit/pool-service/IrcClientRedisState.ts
src/irc/BridgedClient.ts
yarn.lock
Commit message: Add a test to ensure that the irc client state doesn't bloat on VERSION (#1753)

* Add a test to ensure that the irc client state doesn't bloat on VERSION

* Sensible linting

* Update matrix-org-irc

Vulnerable code:
    "es6": true,
    "jasmine": true
    "lint": "eslint -c .eslintrc --max-warnings 0 'spec/**/*.js' 'src/**/*.ts' && eslint -c ./widget/.eslintrc.js 'widget/src/**/*.{ts,tsx}'",
    "matrix-org-irc": "^2.0.1",
    "typescript": "^5.0.4",
        await plEvent;
            env.ircMock._whenClient(config._server, config._botnick, "say", (self: any, message: any) => {
                (client, channel, text) => {
                (client, channel, text) => {
    private assertConnected(): Client {
matrix-org-irc@^2.0.1:
  version "2.0.1"
  resolved "https://registry.yarnpkg.com/matrix-org-irc/-/matrix-org-irc-2.0.1.tgz#80cc1ce3abb3e8f240bbc3b4acf1a0fe0f1057e7"
  integrity sha512-Qnzx1r5QjTtm63oGUY/XyE3t+1xH43CaC8r3QifkKmBihrYyhHq4bpMsnxNYb558sc2j52pixJ5CUsQ8zMediQ==

Fixed code:
    "es6": true
      "env": {
        "node": true,
        "es6": true,
        "jasmine": true
      },
    },
    {
      "extends": ["plugin:jest/recommended"],
      "files": [
        "spec/e2e/*.spec.ts"
      ],
      "rules": {
        "jest/expect-expect": "off" // E2E tests don't always assert
      }
Ensure we don't bloat irc supported state.
    "lint": "eslint -c .eslintrc --max-warnings 0 'spec/**/*.js' 'spec/**/*.ts' 'src/**/*.ts' && eslint -c ./widget/.eslintrc.js 'widget/src/**/*.{ts,tsx}'",
    "matrix-org-irc": "^2.1.0",
    "typescript": "^5.0.4",
    "eslint-plugin-jest": "^27.2.3",

    it('should store the IRC client state once', async () => {
        const channel = `#${TestIrcServer.generateUniqueNick("test")}`;
        const { homeserver, ircBridge } = testEnv;
        const { client, userId } = homeserver.users[0];
        const adminRoomId = await testEnv.createAdminRoomHelper(client);

        // Ensure we join IRC.
        const cRoomId = await testEnv.joinChannelHelper(client, adminRoomId, channel);
        await client.sendText(cRoomId, "Hello bob!");


        const bridgedClient = await ircBridge.getBridgedClient(ircBridge.getServers()[0], userId);
        await bridgedClient.waitForConnected();
        const ircClient = await bridgedClient.assertConnected();

        // This is the original state of supported. We clone the object to be safe.
        const expectedState = JSON.parse(JSON.stringify(ircClient.supported));

        // Request VERSION to re-request state.
        await bridgedClient.sendCommands('VERSION');
        await new Promise<void>(resolve => setTimeout(resolve, 2000));
        const newState = { ...ircClient.supported };

        expect(expectedState).toEqual(newState);
    });

        expect(await plEvent).toBeDefined();
/* eslint-disable @typescript-eslint/no-explicit-any */
            env.ircMock._whenClient(config._server, config._botnick, "say", (self: any) => {
                (client, channel) => {
                (client, channel) => {
// eslint-disable-next-line @typescript-eslint/no-explicit-any
    public assertConnected(): Client {
"@typescript-eslint/scope-manager@5.62.0":
  version "5.62.0"
  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-5.62.0.tgz#d9457ccc6a0b8d6b37d0eb252a23022478c5460c"
  integrity sha512-VXuvVvZeQCQb5Zgf4HAxc04q5j+WrNAtNh9OwCsCgpKqESMTu3tF/jhZ3xG6T4NZwWl65Bg8KuS2uEvhSfLl0w==
  dependencies:
    "@typescript-eslint/types" "5.62.0"
    "@typescript-eslint/visitor-keys" "5.62.0"

"@typescript-eslint/types@5.62.0":
  version "5.62.0"
  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-5.62.0.tgz#258607e60effa309f067608931c3df6fed41fd2f"
  integrity sha512-87NVngcbVXUahrRTqIK27gD2t5Cu1yuCXxbLcFtCzZGlfyVWWh8mLHkoxzjsB6DDNnvdL+fW8MiwPEJyGJQDgQ==

"@typescript-eslint/typescript-estree@5.62.0":
  version "5.62.0"
  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-5.62.0.tgz#7d17794b77fabcac615d6a48fb143330d962eb9b"
  integrity sha512-CmcQ6uY7b9y694lKdRB8FEel7JbU/40iSAPomu++SjLMntB+2Leay2LO6i8VnJk58MtE9/nQSFIH6jpyRWyYzA==
  dependencies:
    "@typescript-eslint/types" "5.62.0"
    "@typescript-eslint/visitor-keys" "5.62.0"
    debug "^4.3.4"
    globby "^11.1.0"
    is-glob "^4.0.3"
    semver "^7.3.7"
    tsutils "^3.21.0"

"@typescript-eslint/utils@^5.10.0":
  version "5.62.0"
  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-5.62.0.tgz#141e809c71636e4a75daa39faed2fb5f4b10df86"
  integrity sha512-n8oxjeb5aIbPFEtmQxQYOLI0i9n5ySBEY/ZEHHZqKQSFnxio1rv6dthascc9dLuwrL0RC5mPCxB7vnAVGAYWAQ==
  dependencies:
    "@eslint-community/eslint-utils" "^4.2.0"
    "@types/json-schema" "^7.0.9"
    "@types/semver" "^7.3.12"
    "@typescript-eslint/scope-manager" "5.62.0"
    "@typescript-eslint/types" "5.62.0"
    "@typescript-eslint/typescript-estree" "5.62.0"
    eslint-scope "^5.1.1"
    semver "^7.3.7"

"@typescript-eslint/visitor-keys@5.62.0":
  version "5.62.0"
  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-5.62.0.tgz#2174011917ce582875954ffe2f6912d5931e353e"
  integrity sha512-07ny+LHRzQXepkGg6w0mFY41fVUNBrL2Roj/++7V1txKugfjm/Ci/qSND03r2RhlJhJYMcTn9AhhSSqQp0Ysyw==
  dependencies:
    "@typescript-eslint/types" "5.62.0"
    eslint-visitor-keys "^3.3.0"

eslint-plugin-jest@^27.2.3:
  version "27.2.3"
  resolved "https://registry.yarnpkg.com/eslint-plugin-jest/-/eslint-plugin-jest-27.2.3.tgz#6f8a4bb2ca82c0c5d481d1b3be256ab001f5a3ec"
  integrity sha512-sRLlSCpICzWuje66Gl9zvdF6mwD5X86I4u55hJyFBsxYOsBCmT5+kSUjf+fkFWVMMgpzNEupjW8WzUqi83hJAQ==
  dependencies:
    "@typescript-eslint/utils" "^5.10.0"

matrix-org-irc@^2.1.0:
  version "2.1.0"
  resolved "https://registry.yarnpkg.com/matrix-org-irc/-/matrix-org-irc-2.1.0.tgz#513d284d081a01ef752a29cd410c11fce0c5d2c5"
  integrity sha512-MV9Q8Mt8RTKf72U0D5zNbBL9P4JQJzU63HTeomguq6a+Zb5QZJvnBHfrdLJXtJyTsWGCtSbJ6rcSFJVrFmKUxA==