search

meebey / SmartIrc4net

IRC C# Library
http://www.meebey.net/projects/smartirc4net/
Other
126 stars 52 forks source link

Can't send message with a variable? #21

Closed rghmodz closed 10 years ago

rghmodz commented 10 years ago

This is the code I use WebClient c = new WebClient(); string data = ""; data = c.DownloadString("website"); irc.SendMessage(SendType.Message, "#channel", "Message: " + data);

When it sends the message it just says Message: If I have it read a float then it can send it in the message but if I have it send data from a string it doesn't work.

rghmodz commented 10 years ago

Okay so the text on website can stop it from working. It will work with certain things but if I change 1 letter it stops working.

rghmodz commented 10 years ago

I got it. The web response had some space before text so it made it not send.

DeathByNukes commented 10 years ago

Internally IRC uses newlines to separate different commands and SendMessage doesn't filter them out. You should manually filter out all newlines from external data before sending it. Otherwise the website can exploit that security hole to make your program send any IRC command they want. Newlines at the start of the data may have been why the message was blank. IMO there should be a "safe mode" that causes SmartIrc4net to check for things like this, and it should be turned on by default.

meebey commented 10 years ago

@DeathByNukes your comment is very insightful and correct. SmartIrc4net should probably validate the message payload and possibly remove invalid data.