From e87c9fd9ca030f3363052c03c76b4d1ca793d541 Mon Sep 17 00:00:00 2001 From: reverse Date: Sun, 16 Aug 2026 17:50:25 +0000 Subject: [PATCH] s2s: reject malformed or duplicate UIDs on introduction --- src/link.rs | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/link.rs b/src/link.rs index 0c2dba4..9f288e8 100644 --- a/src/link.rs +++ b/src/link.rs @@ -931,6 +931,16 @@ impl Server { } let sid = msg.source.clone().unwrap_or_default(); let uuid = msg.params[0].clone(); + // reject a malformed or duplicate UID instead of corrupting the routing + // tables: the uuid is 9 chars carrying the announcing server's 3-char SID, + // and must not already be present. + if sid.len() != 3 + || uuid.len() != 9 + || !uuid.starts_with(&sid) + || self.remote_users.contains_key(&uuid) + { + return; + } let nick = msg.params[2].clone(); let host = msg.params[4].clone(); // displayed host let ident = msg.params[6].clone(); // displayed ident