IRC server user input sanitization
reddit / irc

----------------------------------------------------------------------
JamieOnUbuntu · 2018-03-22 22:26

Hi,

I have an IRC bot that I wrote in PHP running in my channel on
Freenode.

It connects to the server with `fsockopen()` and reads the raw data
stream with `fgets()`.

I am trying to alleviate some security concerns regarding binary
exploitation/multi-byte exploitation.

Freenode uses ircd-seven. Does anybody here have any
knowledge/documentation that outlines how it handles user input
sanitization? For example, is there anything preventing malformed
characters from getting into the chat stream, or anything to prevent
raw binary data reaching my bot, etc?

IRC is a very raw protocol so it seems difficult to protect against
this sort of thing in some cases. My bot is of course doing the usual
PHP input validation stuff, such as using a character whitelist,
stripping control characters, etc. However the theoretical attack I am
concerned about is some form of exploitation again PHP itself related
to sending raw binary data to the bot. I know that this would most
likely require a vulnerability in PHP for the attack to be possible,
but I am trying to establish whether the IRC server itself can provide
any protection against this.

Thanks,
Jamie

----------------------------------------------------------------------
HumansAreRobots · 2018-03-22 22:33

I can't specifically answer any questions about ircd-seven, but the
source is available on github: https://github.com/freenode/ircd-seven

----------------------------------------------------------------------
JamieOnUbuntu · 2018-03-22 22:38

Thanks for your reply. I've had a look around the repo before,
although I think possibly the best way for me to answer my own
question is to actually read the source code. Unless a contributor to
the project happens to see this? :)

----------------------------------------------------------------------
HumansAreRobots · 2018-03-22 22:39

That's what I'm thinking. Good luck. :)

----------------------------------------------------------------------
svn · 2018-03-23 00:15

Just read the IRC RFC. From memory I think all characters except
`\r`/`\n` and `\0` are perfectly legal to send and will be relayed to
you.

----------------------------------------------------------------------
MrZimothy · 2018-03-23 20:57

You need to treat irc proto as binary and mostly manage memory by
size, not content.  When you factor in colors, high ascii, and unicode
stuff, its the only way really.  Probably fread() into a buffer and
then parse/tokenize the buffer.

http://php.net/manual/en/function.fread.php

----------------------------------------------------------------------
JamieOnUbuntu · 2018-03-24 00:39

Thanks for the clarification, I think this is the route I am going to
take. Thanks!