nimb

Your security advisory has been quite helpful and I could reproduce the issue involving CR. It is particularly enlightening to know that the null byte could also cause the same issue because some IRC servers may interpret the null byte too as a line ending. It is late here but I have pushed a quick fix to plug this loophole: <https://github.com/susam/nimb/commit/1c02137>. Review comments, feedback, pull requests, patches, etc. are very welcome! Thank you for this comment thread which has been constructive as well as productive.

You need to split on (or sanitize) null bytes here: https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b... and sanitize NUL/CR/LF from the prefix (well, display_name) here: https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b... Otherwise you may have a command injection vulnerability similar to what matrix-appservice-irc used to have: https://pktz.fr/matrix/security/2022-appservice-irc-command-... (though with carriage returns instead of null bytes)

I wrote my own IRC + Matrix client to bridge the channels I operate. I've made the source code available under the terms of the MIT license here: https://github.com/susam/nimb If you find any issues, bugs, etc. in this tool, please let me know. Although this tool works well for my modest requirements, someone else may find issues while using this tool that I have not encountered yet. In such a case, bug reports, pull requests, patches, etc. are very welcome!

I have had my own share of problems with both portalled rooms as well as plumbed rooms on Matrix. Dropped messages, dropped connections, etc. were some of the problems. Sometimes the re-connection times can be several hours long. Despite these problems, the portalled rooms have been a convenient way to quickly set up a relatively persistent connection to the IRC network via the Matrix bridge. That convenience is now going to be lost unless the IRC channel operators opt-in to create an account on Matrix, then set up a plumbed room on Matrix, and then advertise the plumbed rooms sufficiently well. Of course, many regular IRC users set up an IRC bouncer (I use ZNC myself) to keep a persistent connection to the IRC network, so this move would not affect them. But the portalled rooms served as a good alternative to setting up IRC bouncers your