From 5b33786a4694f2fc8babc965b1fe0211c8537797 Mon Sep 17 00:00:00 2001
From: reverse <mike.chevronnet@gmail.com>
Date: Wed, 19 Aug 2026 01:03:27 +0000
Subject: [PATCH] =?UTF-8?q?rpc:=20refuse=20an=20all-wildcard=20x-line=20vi?=
 =?UTF-8?q?a=20ban.add=20=E2=80=94=20the=20mask=20went=20unvalidated,=20so?=
 =?UTF-8?q?=20an=20authenticated=20RPC=20call=20with=20"mask":""=20or=20"*?=
 =?UTF-8?q?@*"=20installed=20a=20K/G/Z-line=20matching=20the=20entire=20ne?=
 =?UTF-8?q?twork;=20require=20at=20least=20one=20literal=20host/ip/nick=20?=
 =?UTF-8?q?char?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/modules/rpc/ban.rs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/modules/rpc/ban.rs b/src/modules/rpc/ban.rs
index 4e43224..85ef31b 100644
--- a/src/modules/rpc/ban.rs
+++ b/src/modules/rpc/ban.rs
@@ -54,6 +54,13 @@ pub fn handle(s: &mut Server, action: &str, params: &str) -> Result<String, RpcE
             let mask = json::get_str(params, "mask")
                 .or_else(|| json::get_str(params, "name"))
                 .ok_or_else(|| RpcError::invalid_params("missing 'mask'"))?;
+            // Refuse an all-wildcard ban (`*`, `*@*`, `*!*@*`, empty): it must carry a
+            // literal host/ip/nick component, or it bans the whole network.
+            if !mask.chars().any(|c| c.is_ascii_alphanumeric()) {
+                return Err(RpcError::invalid_params(
+                    "mask must contain a literal host/ip/nick component (refusing an all-wildcard ban)",
+                ));
+            }
             let duration = json::get_num::<u64>(params, "duration")
                 .or_else(|| {
                     json::get_str(params, "duration_string").and_then(|d| parse_duration(&d))