清理 irc 的输入
所以我正在考虑编写一个 irc 机器人/机器人扩展，让用户通过启动游戏来玩某些基于文本的游戏，
发送他们输入的某些行的部分（如果不在机器人通道中，则与游戏信号匹配的正则表达式。rbot 游戏名进入森林发送“进入森林”到游戏中的标准，
而游戏外的标准由机器人缓存并通过管道传送到通道（例如。 “让我们为 鸭子被打败了” 读入机器人内部的行缓存，然后 机器人将其作为
游戏名称发送到适当的通道：让我们为
游戏名称感到高兴：鸭子被打败了” ）
但我有点担心 irc 上的人可能会做的棘手事情，剥离所有不可打印的字符是否足够安全？如果程序退出（假设他们输入游戏的退出命令），当您尝试写入该程序的文件描述符 std in（错误）时会发生什么？还有其他潜在的问题吗？ 注意我将在 linux 或 *bsd 上运行它，所以我不需要担心 Windows 特定的事情。
So I was thinking of writing a irc bot/bot extension that lets users play certain text based games by starting the game,
sending parts of certain lines they enter(regexp match for game signal if not in bots channel ex. rbot gamename enter the forest . sends "enter the forest) to std in of game,
while standard out of game is cached by bot and the piped to the channel (ex.
"let us rejoice for
the duck has been defeated"
gets read into a line cache inside the bot and then
the bot sends it to the appropriate channel as
gamename: let us rejoice for
gamename: the duck has been defeated"
)
But I'm sort of worried about the tricky things people on irc might do, would stripping all non printable characters be enough safety? If a program quits (say they enter the quit command for the game) what happens when you try writing to the file descriptor for that programs std in(error)? Any other potential problems?
Note I'm going to run this on linux or *bsd so I don't need to worry about windows specific things.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可能需要考虑的一些基础知识：
每当向网络公开服务时，都可能存在许多安全问题，您最好阅读有关一般安全编程主题的内容，快速谷歌搜索就会出现此操作方法< /a> 例如。
偏执是值得的。如果不遵循正确的安全编程实践，您最多只能希望没有人诚实地尝试破坏它。
Some basics you might want to consider:
There are any number of possible security issues whenever exposing services to the network, you would do well to read about general secure programming topics, a quick google search turns up this how-to for example.
It pays to be paranoid. Without following proper secure programming practices, the most you can hope for is that nobody gives an honest try at breaking it.
转义引号和管道可以让你免受大多数东西的影响
escaping quotes and pipe will keep you safe from most stuff
用户输入来自何处并不重要，重要的是如何使用它。
影响 IRC 的一种攻击是CRLF 注入 。如果您通过 IRC 回显用户输入，则会出现此情况。攻击者可以尝试注入回车符 (\r) 换行符 (\n)。这种类型的注入会影响许多协议，包括 HTTP 和 SMTP。对于 IRC，攻击者将能够强制您的机器人向 IRCD 发送命令（例如 /join 或 /kick 或 /ban :)。确保查看 ASCII 表 并过滤掉所有 0x0A (\n) 和 0x0D (\r) 。在大多数情况下，新行就足够了，因此请确保对两者进行过滤。
请务必阅读OWASP A1：注入。特别是当您在 SQL 查询中使用用户输入或在命令行上调用进程时。
It doesn't matter where the user input is coming from, it matters how its used.
The one attack that affects IRC is CRLF injection. This will come up for you if you echo back user input over IRC. An attacker could try and inject a carrage return (\r) line feed (\n). This type of injection affects many protocols including HTTP and SMTP. In the case of IRC the attacker would be able to force your bot to send a command to the IRCD (like /join or /kick or /ban :). Make sure to look at an ASCII table and filter out all 0x0A (\n) and 0x0D (\r). In most cases the new line is enough, so make sure you filter for both.
Make sure you read over OWASP A1: Injection. Especially if you are using user input in a sql query or invoking a process on the commandline.