fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

harden: connclass clone-cap at register, ws control-frame limits, uuid recycle-skip, json-escape extjwt/filehost claims, metadata value/key caps, cloak numeric-dotted leak, relaymsg remote-nick, rpc set_oper block validation, isupport 13-token split, multi-hop privmsg routing, connectdelay=0

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-15 16:27:11 +00:00
parent e935ee7002
commit 35af95fd0f
11 changed files with 129 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/modules/metadata.rs
View file

@ -144,10 +144,22 @@ impl Command for MetadataCmd {
return CmdResult::Fail;
};
let value = params.get(3).cloned(); // no value => delete the key
let maxval = s.conf_num("metadata_maxvalue", 512usize);
let maxkeys = s.conf_num("metadata_maxkeys", 32usize);
{
let st = s.ext.get_or_insert_with::<MetaStore>(MetaStore::default);
match &value {
Some(v) => {
// bound value length and per-target key count so a client
// can't grow the store without limit
let cur = st.0.get(&key);
let overlong = v.len() > maxval;
let too_many = cur.map(|m| m.len() >= maxkeys && !m.contains_key(&mkey))
.unwrap_or(false);
if overlong || too_many {
s.fail(uid, "METADATA", "KEY_INVALID", "value too long or too many keys");
return CmdResult::Fail;
}
st.0.entry(key.clone())
.or_default()
.insert(mkey.clone(), v.clone());