From 53a7adb8aa292f032c44886f220c3e8ed5f93378 Mon Sep 17 00:00:00 2001 From: Eric Wong Date: Tue, 4 Jun 2019 08:20:40 +0000 Subject: nntp: ensure we only handle ASCII whitespace RFC3977 does not have provisions for whitespace beyond ASCII TAB, SP, CR and LF. I doubt there's any NNTP clients broken enough to be sending non-ASCII whitespace delimiters. We're probably excessively liberal regarding TAB acceptance, even; but it's probably too late to change at this point... --- lib/PublicInbox/NNTP.pm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/PublicInbox/NNTP.pm b/lib/PublicInbox/NNTP.pm index 57300e89..be80560f 100644 --- a/lib/PublicInbox/NNTP.pm +++ b/lib/PublicInbox/NNTP.pm @@ -121,7 +121,7 @@ sub args_ok ($$) { # returns 1 if we can continue, 0 if not due to buffered writes or disconnect sub process_line ($$) { my ($self, $l) = @_; - my ($req, @args) = split(/\s+/, $l); + my ($req, @args) = split(/[ \t]/, $l); return 1 unless defined($req); # skip blank line $req = lc($req); $req = eval { @@ -959,7 +959,7 @@ sub event_read { $self->{rbuf} .= $$buf; } my $r = 1; - while ($r > 0 && $self->{rbuf} =~ s/\A\s*([^\r\n]*)\r?\n//) { + while ($r > 0 && $self->{rbuf} =~ s/\A[ \t\r\n]*([^\r\n]*)\r?\n//) { my $line = $1; return $self->close if $line =~ /[[:cntrl:]]/s; my $t0 = now(); -- cgit v1.2.3-24-ge0c7