fluffle/goirc — pull request #31 by StalkR (2013-03-06 22:02:10+00:00)
Title: Soft protection against IRC command injection

Hi,

Command injection on IRC is when a string being sent to the IRC server (nick, privmsg, topic, etc.) contains a "\r" or "\n" followed by another command.
This can happen on an IRC client if a user-controlled, not sanitized input is passed to the IRC library.
Example: a bot reading URLs, getting page, parsing

and displaying it on IRC using Privmsg.
A malicious user could forge a web page with <title>test\rNICK owned

to send Privmsg with "test" followed by the arbitrary IRC command "NICK owned" so the bot changes nick.

It would be nice if the library protects against IRC command injection by default. Two solutions: either fail hard (do not send anything) or fail soft (by stripping bad characters \r or \n). I prefer soft in this case and added it in every command except Raw() where we don't want to restrict anything.

Going further, we could add more checks for instance require channel/nicks to have no space, but not more otherwise we fall into IRC servers implementation differences and it's not the place. This change doesn't do that but let me know if you would be interested.

Cheers,
StalkR