patch for #858

git-svn-id: https://svn.kvirc.de/svn/trunk/kvirc@4693 17fca916-40b9-46aa-a4ea-0a15b648b75c

3 files changed, 33 insertions, 26 deletions

diff --git a/src/kvirc/sparser/kvi_sp_ctcp.cpp b/src/kvirc/sparser/kvi_sp_ctcp.cpp
index d0c95754f..05ec93125 100644
--- a/src/kvirc/sparser/kvi_sp_ctcp.cpp
+++ b/src/kvirc/sparser/kvi_sp_ctcp.cpp
@@ -626,7 +626,7 @@ const char * KviServerParser::decodeCtcpEscape(const char * msg_ptr,QByteArray &
 }
 
 
-const char * KviServerParser::extractCtcpParameter(const char * msg_ptr,KviStr &buffer,bool bSpaceBreaks)
+const char * KviServerParser::extractCtcpParameter(const char * msg_ptr,KviStr &buffer,bool bSpaceBreaks, bool bSafeOnly)
 {
 	//
 	// This one extracts the "next" ctcp parameter in msg_ptr
@@ -658,17 +658,20 @@ const char * KviServerParser::extractCtcpParameter(const char * msg_ptr,KviStr &
 		{
 			case '\\':
 				// backslash : escape sequence
-				if(msg_ptr != begin)buffer.append(begin,msg_ptr - begin);
-				msg_ptr++;
-				if(*msg_ptr)
-				{
-					// decode the escape
-					msg_ptr = decodeCtcpEscape(msg_ptr,buffer);
-					begin = msg_ptr;
+				if(bSafeOnly)msg_ptr++;
+				else {
+					if(msg_ptr != begin)buffer.append(begin,msg_ptr - begin);
+					msg_ptr++;
+					if(*msg_ptr)
+					{
+						// decode the escape
+						msg_ptr = decodeCtcpEscape(msg_ptr,buffer);
+						begin = msg_ptr;
+					}
+					// else it is a senseless trailing backslash.
+					// Just ignore and let the function
+					// return spontaneously.
 				}
-				// else it is a senseless trailing backslash.
-				// Just ignore and let the function
-				// return spontaneously.
 			break;
 			case ' ':
 				// space : separate tokens if not in string
@@ -683,7 +686,7 @@ const char * KviServerParser::extractCtcpParameter(const char * msg_ptr,KviStr &
 				}
 			break;
 			case '"':
-				if(bInString)
+				if(bInString && !bSafeOnly)
 				{
 					// A string terminator. We don't return
 					// immediately since if !bSpaceBreaks
@@ -711,7 +714,7 @@ const char * KviServerParser::extractCtcpParameter(const char * msg_ptr,KviStr &
 	return msg_ptr;
 }
 
-const char * KviServerParser::extractCtcpParameter(const char * p_msg_ptr,QString &resultBuffer,bool bSpaceBreaks)
+const char * KviServerParser::extractCtcpParameter(const char * p_msg_ptr,QString &resultBuffer,bool bSpaceBreaks, bool bSafeOnly)
 {
 	//
 	// This one extracts the "next" ctcp parameter in p_msg_ptr
@@ -743,15 +746,18 @@ const char * KviServerParser::extractCtcpParameter(const char * p_msg_ptr,QStrin
 		{
 			case '\\':
 				// backslash : escape sequence
-				msg_ptr++;
-				if(*msg_ptr)
-				{
-					// decode the escape
-					msg_ptr = decodeCtcpEscape(msg_ptr,buffer);
+				if(bSafeOnly)msg_ptr++;
+				else {
+					msg_ptr++;
+					if(*msg_ptr)
+					{
+						// decode the escape
+						msg_ptr = decodeCtcpEscape(msg_ptr,buffer);
+					}
+					// else it is a senseless trailing backslash.
+					// Just ignore and let the function
+					// return spontaneously.
 				}
-				// else it is a senseless trailing backslash.
-				// Just ignore and let the function
-				// return spontaneously.
 			break;
 			case ' ':
 				// space : separate tokens if not in string
@@ -769,7 +775,7 @@ const char * KviServerParser::extractCtcpParameter(const char * p_msg_ptr,QStrin
 				}
 			break;
 			case '"':
-				if(bInString)
+				if(bInString && !bSafeOnly)
 				{
 					// A string terminator. We don't return
 					// immediately since if !bSpaceBreaks
@@ -1707,7 +1713,7 @@ void KviServerParser::parseCtcpRequestDcc(KviCtcpMessage *msg)
 {
 	KviDccRequest p;
 	KviStr aux    = msg->pData;
-	msg->pData    = extractCtcpParameter(msg->pData,p.szType);
+	msg->pData    = extractCtcpParameter(msg->pData,p.szType, true, true);
 	msg->pData    = extractCtcpParameter(msg->pData,p.szParam1);
 	msg->pData    = extractCtcpParameter(msg->pData,p.szParam2);
 	msg->pData    = extractCtcpParameter(msg->pData,p.szParam3);
diff --git a/src/kvirc/sparser/kvi_sparser.h b/src/kvirc/sparser/kvi_sparser.h
index 9bb928760..90ad15c34 100644
--- a/src/kvirc/sparser/kvi_sparser.h
+++ b/src/kvirc/sparser/kvi_sparser.h
@@ -260,8 +260,8 @@ public:
 	static void encodeCtcpParameter(const char * param,QString &buffer,bool bSpaceBreaks = true);
 	static const char * decodeCtcpEscape(const char * msg_ptr,KviStr &buffer);
 	static const char * decodeCtcpEscape(const char * msg_ptr,QByteArray &buffer);
-	static const char * extractCtcpParameter(const char * msg_ptr,KviStr &buffer,bool bSpaceBreaks = true);
-	static const char * extractCtcpParameter(const char * msg_ptr,QString &buffer,bool bSpaceBreaks = true);
+	static const char * extractCtcpParameter(const char * msg_ptr,KviStr &buffer,bool bSpaceBreaks = true, bool bSafeOnly=false);
+	static const char * extractCtcpParameter(const char * msg_ptr,QString &buffer,bool bSpaceBreaks = true, bool bSafeOnly=false);
 };
 
 #ifndef _KVI_SPARSER_CPP_
diff --git a/src/modules/dcc/requests.cpp b/src/modules/dcc/requests.cpp
index f758d36ec..e4aad108d 100644
--- a/src/modules/dcc/requests.cpp
+++ b/src/modules/dcc/requests.cpp
@@ -86,7 +86,8 @@ static void dcc_module_request_error(KviDccRequest * dcc,const QString& errText)
 	if(KVI_OPTION_BOOL(KviOption_boolNotifyFailedDccHandshakes))
 	{
 		QString szError = QString("Sorry, your DCC %1 request can't be satisfied: %2").arg(dcc->szType.ptr(), errText);
-		dcc_module_reply_errmsg(dcc,szError);
+		//since szError contains an user-suppplied string, we simplify it to avoid any kind of injection (bug #858)
+		dcc_module_reply_errmsg(dcc,szError.simplified());
 	}
 }