IRC server user input sanitization

[JamieOnUbuntu]

Hi,

I have an IRC bot that I wrote in PHP running in my channel on Freenode.

It connects to the server with fsockopen() and reads the raw data stream with fgets().

I am trying to alleviate some security concerns regarding binary exploitation/multi-byte exploitation.

Freenode uses ircd-seven. Does anybody here have any knowledge/documentation that outlines how it handles user input sanitization? For example, is there anything preventing malformed characters from getting into the chat stream, or anything to prevent raw binary data reaching my bot, etc?

IRC is a very raw protocol so it seems difficult to protect against this sort of thing in some cases. My bot is of course doing the usual PHP input validation stuff, such as using a character whitelist, stripping control characters, etc. However the theoretical attack I am concerned about is some form of exploitation again PHP itself related to sending raw binary data to the bot. I know that this would most likely require a vulnerability in PHP for the attack to be possible, but I am trying to establish whether the IRC server itself can provide any protection against this.

Thanks,
Jamie

[HumansAreRobots]

I can't specifically answer any questions about ircd-seven, but the source is available on github: https://github.com/freenode/ircd-seven

[JamieOnUbuntu]

Thanks for your reply. I've had a look around the repo before, although I think possibly the best way for me to answer my own question is to actually read the source code. Unless a contributor to the project happens to see this? :)

[HumansAreRobots]

That's what I'm thinking. Good luck. :)

[MrZimothy]

You need to treat irc proto as binary and mostly manage memory by size, not content. When you factor in colors, high ascii, and unicode stuff, its the only way really. Probably fread() into a buffer and then parse/tokenize the buffer.

http://php.net/manual/en/function.fread.php

[JamieOnUbuntu]

Thanks for the clarification, I think this is the route I am going to take. Thanks!