Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: normalize JIDs before comparison #49

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix: normalize JIDs before comparison #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 36 additions & 7 deletions src/carbons.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,35 +40,64 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
/**
* From section 11, security considerations:
* 'Any forwarded copies received by a Carbons-enabled client MUST be from that user's bare JID'
* See https://datatracker.ietf.org/doc/html/rfc7622 for details on JID comparison.
*
* If there was an attempt to fake a message, this function will return 0 and delete all children.
* Otherwise it just returns 1.
*/
static int carbons_filter_invalid(PurpleAccount * acc_p, xmlnode * outer_msg_stanza_p) {
char ** split = (void *) 0;
gchar ** split = (void *) 0;
gchar * normalized_username = (void *) 0;
gchar * folded_username = (void *) 0;
gchar * normalized_from = (void *) 0;
gchar * folded_from = (void *) 0;
xmlnode * curr_node_p = (void *) 0;
xmlnode * temp_node_p = (void *) 0;
const char * from = (void *) 0;

int ret_val = 0;

split = g_strsplit(purple_account_get_username(acc_p), "/", 2);
normalized_username = g_utf8_normalize(split[0], -1, G_NORMALIZE_ALL);
if (!normalized_username) {
purple_debug_error(CARBONS_LOG_CATEGORY, "Own account's username is not valid UTF-8: '%s'\n", split[0]);
ret_val = 0;
goto cleanup;
}
folded_username = g_utf8_casefold(normalized_username, -1);

if (g_strcmp0(split[0], xmlnode_get_attrib(outer_msg_stanza_p, "from"))) {
purple_debug_warning(CARBONS_LOG_CATEGORY, "Invalid sender: %s (should be: %s)\n", xmlnode_get_attrib(outer_msg_stanza_p, "from"), split[0]);
from = xmlnode_get_attrib(outer_msg_stanza_p, "from");
normalized_from = g_utf8_normalize(from, -1, G_NORMALIZE_ALL);
if (!normalized_from) {
purple_debug_error(CARBONS_LOG_CATEGORY, "'from' is not valid UTF-8: '%s'\n", from);
ret_val = 0;
goto cleanup;
}
folded_from = g_utf8_casefold(normalized_from, -1);

if (g_strcmp0(folded_username, folded_from)) {
purple_debug_warning(CARBONS_LOG_CATEGORY, "Invalid sender: %s (should be: %s)\n", folded_from, folded_username);
ret_val = 0;
goto cleanup;
}

ret_val = 1;

cleanup:
if (!ret_val) {
curr_node_p = outer_msg_stanza_p->child;
while(curr_node_p) {
temp_node_p = curr_node_p->next;
xmlnode_free(curr_node_p);
curr_node_p = temp_node_p;
}

ret_val = 0;
} else {
ret_val = 1;
}

g_strfreev(split);
g_free(normalized_username);
g_free(folded_username);
g_free(normalized_from);
g_free(folded_from);

return ret_val;
}
Expand Down
36 changes: 36 additions & 0 deletions test/test_carbons.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -433,6 +433,41 @@ static void test_carbons_xml_received_cb_received_success(void ** state) {
assert_ptr_not_equal(xmlnode_get_child(received_carbons_node_p, "body"), NULL);
}

/**
* Since JIDs need to be normalized and case-mapped before comparison, 'Romeo' can also send a valid carbons message to 'romeo'.
*/
static void test_carbons_xml_received_cb_received_casemapped_success(void ** state) {
(void) state;

const char * received_carbon_copy =
"<message xmlns='jabber:client' "
"from='[email protected]' "
"to='[email protected]/home' "
"type='chat'>"
"<received xmlns='urn:xmpp:carbons:2'>"
"<forwarded xmlns='urn:xmpp:forward:0'>"
"<message xmlns='jabber:client' "
"from='[email protected]/balcony' "
"to='[email protected]/garden' "
"type='chat'>"
"<body>What man art thou that, thus bescreen'd in night, so stumblest on my counsel?</body>"
"<thread>0e3141cd80894871a68e6fe6b1ec56fa</thread>"
"</message>"
"</forwarded>"
"</received>"
"</message>";
xmlnode * received_carbons_node_p = xmlnode_from_str(received_carbon_copy, -1);

will_return(__wrap_purple_connection_get_account, NULL);
will_return(__wrap_purple_account_get_username, "[email protected]");

carbons_xml_received_cb(NULL, &received_carbons_node_p);

assert_string_equal(xmlnode_get_attrib(received_carbons_node_p, "from"), "[email protected]/balcony");
assert_string_equal(xmlnode_get_attrib(received_carbons_node_p, "to"), "[email protected]/garden");
assert_ptr_not_equal(xmlnode_get_child(received_carbons_node_p, "body"), NULL);
}

/**
* Stop processing on malformed carbon-copy of received message: no 'forwarded' node.
*/
Expand Down Expand Up @@ -881,6 +916,7 @@ int main(void) {
cmocka_unit_test(test_carbons_xml_received_cb_invalid_sender_received),
cmocka_unit_test(test_carbons_xml_received_cb_invalid_sender_sent),
cmocka_unit_test(test_carbons_xml_received_cb_received_success),
cmocka_unit_test(test_carbons_xml_received_cb_received_casemapped_success),
cmocka_unit_test(test_carbons_xml_received_cb_received_no_forwarded),
cmocka_unit_test(test_carbons_xml_received_cb_received_no_message),
cmocka_unit_test(test_carbons_xml_received_cb_sent_success),
Expand Down