rejectedsoftware / vibenews

Combined web forum and NNTP server implementation for stand-alone newsgroups
GNU Affero General Public License v3.0
44 stars 3 forks source link

Spaces in passwords break logging into NNTP #48

Open Anaerin opened 2 years ago

Anaerin commented 2 years ago

On the web interface, you can register a valid password with a space in it. Doing so means you can't login to nntp, with the following error being generated server-side (and the client hanging):

[main(ijLL) WRN] NNTP request exception: object.Exception@source/vibenews/nntp/server.d(197): Expected USER/PASS <value>
[main(ijLL) WRN] ----------------
[main(ijLL) WRN] /etc/../usr/include/dmd/phobos/std/exception.d:512 _D3std9exception__T7bailOutHTC9ExceptionZQwFNaNfAyamMAxaZNn [0x5585137c3218]
[main(ijLL) WRN] /etc/../usr/include/dmd/phobos/std/exception.d:433 pure @safe bool std.exception.enforce!().enforce!(bool).enforce(bool, lazy const(char)[], immutable(char)[], ulong) [0x5585137c31a4]
[main(ijLL) WRN] source/vibenews/nntp/server.d:195 void vibenews.nntp.server.NNTPServerRequest.enforce(bool, vibenews.nntp.status.NNTPStatus, immutable(char)[]) [0x5585138b6614]
[main(ijLL) WRN] source/vibenews/nntp/server.d:186 void vibenews.nntp.server.NNTPServerRequest.enforceNParams(ulong, immutable(char)[]) [0x5585138b64e4]
[main(ijLL) WRN] source/vibenews/news.d:224 void vibenews.news.NewsInterface.authinfo(vibenews.nntp.server.NNTPServerRequest, vibenews.nntp.server.NNTPServerResponse) [0x5585138b1a24]
[main(ijLL) WRN] source/vibenews/news.d:72 void vibenews.news.NewsInterface.handleCommand(vibenews.nntp.server.NNTPServerRequest, vibenews.nntp.server.NNTPServerResponse) [0x5585138b0a50]
[main(ijLL) WRN] source/vibenews/nntp/server.d:27 @trusted void vibenews.nntp.server.listenNNTP(vibenews.nntp.server.NNTPServerSettings, void delegate(vibenews.nntp.server.NNTPServerRequest, vibenews.nntp.server.NNTPServerResponse)).handleNNTPConnection(vibe.core.net.TCPConnection) [0x5585138b5514]
[main(ijLL) WRN] source/vibenews/nntp/server.d:133 nothrow @safe void vibenews.nntp.server.listenNNTP(vibenews.nntp.server.NNTPServerSettings, void delegate(vibenews.nntp.server.NNTPServerRequest, vibenews.nntp.server.NNTPServerResponse)).handleNNTPConnectionNothrow(vibe.core.net.TCPConnection) [0x5585138b6238]
[main(ijLL) WRN] /root/.dub/packages/vibe-core-1.22.4/vibe-core/source/vibe/core/task.d:724 nothrow void vibe.core.task.TaskFuncInfo.set!(void delegate(vibe.core.net.TCPConnection) nothrow @safe, vibe.core.net.TCPConnection).set(ref void delegate(vibe.core.net.TCPConnection) nothrow @safe, ref vibe.core.net.TCPConnection).callDelegate(ref vibe.core.task.TaskFuncInfo) [0x558513bde520]
[main(ijLL) WRN] /root/.dub/packages/vibe-core-1.22.4/vibe-core/source/vibe/core/task.d:753 void vibe.core.task.TaskFuncInfo.call() [0x558513baad60]
[main(ijLL) WRN] /root/.dub/packages/vibe-core-1.22.4/vibe-core/source/vibe/core/task.d:406 nothrow void vibe.core.task.TaskFiber.run() [0x558513ba9d2c]
[main(ijLL) WRN] ??:? void core.thread.context.Callable.opCall() [0x558513c43ca0]
[main(ijLL) WRN] ??:? fiber_entryPoint [0x558513ca7214]

It looks like authinfo (https://github.com/rejectedsoftware/vibenews/blob/ad9cd96454b2bc9a61ee8ba4c081cb665b156e7f/source/vibenews/news.d#L235) is being a little naive in it's parsing of the arguments, unfortunately.

Changing the password to remove spaces fixes the problem.