serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/src/protocol/bytes.ts

@@ -0,0 +1,65 @@
+/**
+ * UTF-8 byte accounting for IRC wire budgets.
+ *
+ * IRC line limits are byte budgets (RFC 1459 §2.3: 512 bytes including the
+ * trailing CR-LF; IRCv3 WebSocket framing: 510 content bytes). JavaScript
+ * strings expose UTF-16 code units via `.length`, so a 511-character frame
+ * of `é` measures 511 units but occupies 1022 bytes on the wire. Every
+ * line-budget seam in this package measures through {@link byteLength} so
+ * the cap means bytes.
+ */
+
+/** Shared `TextEncoder` (module-level singleton, reused — never per call). */
+const TEXT_ENCODER = new TextEncoder();
+
+/**
+ * Maximum size, in UTF-8 bytes, of a TCP byte-stream transport's retained
+ * partial-line buffer (the `transportBuffer` carried between chunks).
+ *
+ * The IRC line limit itself is 512 bytes (RFC 1459 §2.3), enforced by the
+ * parser AFTER line splitting — but that cap cannot fire on a peer that
+ * streams megabytes with no line terminator, which would grow the framing
+ * buffer unboundedly before any line exists to measure. This transport-level
+ * cap bounds that memory: well above a single legal line, with room for
+ * multi-line batching, small enough to make per-peer buffer abuse a
+ * non-amplifying nuisance. Shared by every raw TCP transport edge
+ * (irc-server's `TcpByteStreamTransport`, local-cli's `LineScanner`, the
+ * AWS NLB stream handler, and the Cloudflare TCP container origin) so all
+ * four enforce one identical budget.
+ */
+export const MAX_BUFFER_BYTES = 8 * 1024;
+
+/**
+ * Returns the UTF-8 byte length of `s` — the size the wire transport
+ * actually sends and the quantity every IRC line budget is defined in.
+ *
+ * Cost note: this runs on the data-plane hot path for every inbound and
+ * outbound line. The module-level singleton `TextEncoder` above avoids
+ * per-call allocation, which is the dominant cost. Documented follow-up
+ * (profiling-gated, NOT implemented): an ASCII fast path
+ * (`s.length === byteLength(s)` style elision) to skip the encode for
+ * all-ASCII lines, which is the common case.
+ */
+export function byteLength(s: string): number {
+  return TEXT_ENCODER.encode(s).length;
+}
+
+/**
+ * Right-truncates `s` to at most `budget` UTF-8 bytes, never splitting a
+ * surrogate pair: code points are appended while they fit, so an astral
+ * character near the boundary is dropped whole and the result may land a
+ * few bytes under `budget`. For all-ASCII input the result is identical to
+ * `s.slice(0, budget)`. Only called on the (rare) over-budget path.
+ */
+export function truncateToByteBudget(s: string, budget: number): string {
+  if (budget <= 0) return '';
+  let used = 0;
+  let out = '';
+  for (const ch of s) {
+    const size = byteLength(ch);
+    if (used + size > budget) break;
+    used += size;
+    out += ch;
+  }
+  return out;
+}

package/packages/irc-core/src/protocol/channel-name.ts

@@ -0,0 +1,37 @@
+/**
+ * Channel-name grammar and validation — the single source of truth shared
+ * by every command reducer that validates or routes on a channel target
+ * (JOIN, PART, TOPIC, NAMES, MODE, KICK, INVITE, WHO, LIST, ChanServ, and
+ * PRIVMSG/NOTICE target routing).
+ *
+ * Grammar: the first character must be a channel prefix (`#` or `&`); the
+ * rest may be any character except:
+ *   - NUL and the C0 control range `\x00-\x1f` — RFC 1459 §1.3.3 forbids
+ *     NUL, CR, and LF in channel names; a control byte embedded in a name
+ *     is concatenated raw into outbound broadcasts and 353 numerics,
+ *     truncating display in C-based clients and confusing naive parsers,
+ *   - whitespace (`\s`),
+ *   - comma (the multi-target list separator),
+ *   - colon (the trailing-parameter marker).
+ *
+ * The length cap is measured in UTF-8 bytes — the unit the wire budget is
+ * defined in — and includes the `#`/`&` prefix, matching how the name
+ * occupies the line. RFC 2811 §1.3 suggests limiting channel names to 50
+ * bytes; the operative cap is `serverConfig.channelLen` (advertised as
+ * `CHANNELLEN=`, default 50).
+ */
+
+import { byteLength } from './bytes.js';
+
+/** Channel-name grammar; see module docs for the rejected classes. */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: intentional — this regex exists to reject NUL and C0 control chars (RFC 1459 §1.3.3) in channel names.
+export const CHANNEL_NAME_RE = /^[#&][^\s,\x00-\x1f:]+$/u;
+
+/**
+ * Returns true iff `name` matches the channel-name grammar and its UTF-8
+ * byte length (prefix included) is at most `maxLenBytes`.
+ */
+export function isValidChannelName(name: string, maxLenBytes: number): boolean {
+  if (name.length === 0 || byteLength(name) > maxLenBytes) return false;
+  return CHANNEL_NAME_RE.test(name);
+}

package/packages/irc-core/src/protocol/index.ts

@@ -1,5 +1,15 @@
 export type { IrcMessage, IrcSource } from './messages.js';
-export { MAX_INPUT_BYTES, IrcParseError, parse, unescapeTagValue } from './parser.js';
+export { MAX_BUFFER_BYTES, byteLength, truncateToByteBudget } from './bytes.js';
+export { CHANNEL_NAME_RE, isValidChannelName } from './channel-name.js';
+export {
+  MAX_INPUT_BYTES,
+  MAX_TAG_BYTES,
+  MAX_TAGS,
+  IrcParseError,
+  parse,
+  parseTags,
+  unescapeTagValue,
+} from './parser.js';
 export { escapeTagValue, serialize, serializeFrame } from './serializer.js';
 export {
   MAX_LINE_BYTES,
@@ -7,6 +17,7 @@ export {
   enforceLineLimit,
   filterClientTags,
   formatServerTime,
+  sanitizeLineText,
 } from './outbound.js';
 export { wrapBatch, type BatchFrame } from './batch.js';
 export {

package/packages/irc-core/src/protocol/outbound.ts

@@ -17,6 +17,7 @@
 
 import type { RawLine } from '../effects.js';
 import { MAX_WS_MESSAGE_BYTES, type WsFrameMode } from '../ws-framing.js';
+import { byteLength, truncateToByteBudget } from './bytes.js';
 
 /**
  * RFC 1459 §2.3: maximum IRC line length in bytes, including the trailing
@@ -65,9 +66,35 @@ export function applyServerTime(line: RawLine, caps: ReadonlySet<string>, now: n
   return { text: `@time=${stamp} ${line.text}` };
 }
 
+/**
+ * Strips every carriage return from `line.text`.
+ *
+ * Defense-in-depth for paths that construct an outbound line from stored
+ * state (TOPIC text, realname in 311) which may predate inbound bare-CR
+ * rejection: {@link RawLine} text must never carry CR, because the
+ * transport layer appends its own CRLF framing per line, so an embedded CR
+ * would corrupt framing on RFC-compliant clients.
+ *
+ * CR is REMOVED rather than replaced with a space so stripping only ever
+ * shrinks the line — every downstream byte budget still holds. LF is left
+ * untouched (the hardening is deliberately CR-only).
+ *
+ * The input {@link RawLine} is never mutated; the original object is
+ * returned unchanged when the text contains no CR.
+ */
+export function sanitizeLineText(line: RawLine): RawLine {
+  if (!line.text.includes('\r')) return line;
+  return { text: line.text.replace(/\r/gu, '') };
+}
+
 /**
  * Enforces the IRC line-length budget on `line.text`.
  *
+ * CR sanitization ({@link sanitizeLineText}) runs FIRST, so the budget is
+ * measured on the sanitized text: a line that fits after CR removal is not
+ * truncated, and a line that still exceeds the budget is truncated from
+ * already-sanitized text.
+ *
  * For recipients that negotiated `message-tags`, the tag section (the
  * leading `@... ` prefix) is part of the wire budget and is preserved
  * intact; truncation happens at the end of the trailing parameter only.
@@ -83,36 +110,42 @@ export function applyServerTime(line: RawLine, caps: ReadonlySet<string>, now: n
  *
  * The returned {@link RawLine} is the original object when no truncation
  * was needed, otherwise a fresh object with the truncated text.
+ *
+ * The budget is measured in UTF-8 bytes (the wire encoding), not UTF-16
+ * code units: a line of multi-byte characters that fits the unit count can
+ * still exceed the byte ceiling, and truncation re-encodes to the byte
+ * budget so the emitted text always fits it.
  */
 export function enforceLineLimit(
   line: RawLine,
   caps: ReadonlySet<string>,
   mode?: WsFrameMode,
 ): RawLine {
+  const sanitized = sanitizeLineText(line);
   const budget = isSpecMode(mode) ? MAX_WS_MESSAGE_BYTES : MAX_LINE_BYTES - TRAILING_CRLF_LEN;
-  if (line.text.length <= budget) return line;
+  if (byteLength(sanitized.text) <= budget) return sanitized;
 
-  const hasTags = caps.has('message-tags') && line.text.startsWith('@');
+  const hasTags = caps.has('message-tags') && sanitized.text.startsWith('@');
   if (!hasTags) {
-    return { text: line.text.slice(0, budget) };
+    return { text: truncateToByteBudget(sanitized.text, budget) };
   }
 
   // Preserve the tag section verbatim; truncate only the post-tag body.
-  const spaceIdx = line.text.indexOf(' ');
+  const spaceIdx = sanitized.text.indexOf(' ');
   if (spaceIdx === -1) {
     // Malformed: a `@`-prefixed line with no space. Truncate from the right.
-    return { text: line.text.slice(0, budget) };
+    return { text: truncateToByteBudget(sanitized.text, budget) };
   }
-  const tagSection = line.text.slice(0, spaceIdx + 1); // include trailing space
-  const body = line.text.slice(spaceIdx + 1);
-  const bodyBudget = budget - tagSection.length;
+  const tagSection = sanitized.text.slice(0, spaceIdx + 1); // include trailing space
+  const body = sanitized.text.slice(spaceIdx + 1);
+  const bodyBudget = budget - byteLength(tagSection);
   if (bodyBudget < 0) {
     // Pathological: the tag section alone exceeds the budget. Drop the body
     // entirely and truncate the tag section itself so the wire contract
     // (≤ budget bytes) still holds.
-    return { text: line.text.slice(0, budget) };
+    return { text: truncateToByteBudget(sanitized.text, budget) };
   }
-  return { text: `${tagSection}${body.slice(0, bodyBudget)}` };
+  return { text: `${tagSection}${truncateToByteBudget(body, bodyBudget)}` };
 }
 
 /**

package/packages/irc-core/src/protocol/parser.ts

@@ -1,3 +1,4 @@
+import { byteLength } from './bytes.js';
 import type { IrcMessage, IrcSource } from './messages.js';
 
 /**
@@ -29,6 +30,27 @@ export class IrcParseError extends Error {
  */
 export const MAX_INPUT_BYTES = 512;
 
+/**
+ * IRCv3 Message Tags spec: recommended maximum number of tags on a single
+ * message. Every tag is unescaped and (when `message-tags` is negotiated)
+ * re-serialized onto downstream lines, so tag count is an amplification
+ * lever; a client packing dozens of short tags per line is rejected as a
+ * protocol violation rather than parsed.
+ */
+export const MAX_TAGS = 15;
+
+/**
+ * IRCv3 Message Tags spec: recommended maximum size, in UTF-8 bytes, of a
+ * message's tag section — the tag data between the leading `@` and the
+ * space that terminates the section (both excluded from the measurement).
+ * Measured in bytes (not UTF-16 code units) via {@link byteLength} so
+ * multi-byte tag content cannot double the effective budget. Defense in
+ * depth: the RFC 1459 {@link MAX_INPUT_BYTES} line cap already bounds any
+ * section that reaches {@link parse}; this guard holds the spec budget for
+ * callers of {@link parseTags} independent of the line cap.
+ */
+export const MAX_TAG_BYTES = 8192;
+
 const TAG_ESCAPES: Readonly<Record<string, string>> = {
   ':': ';',
   s: ' ',
@@ -58,15 +80,46 @@ export function unescapeTagValue(value: string): string {
   return out;
 }
 
-function parseTags(section: string): Record<string, string> {
-  const tags: Record<string, string> = {};
+/**
+ * Parses the tag section between the leading `@` and its terminating space
+ * into a null-prototype tag map. Exported for direct validation at this
+ * seam: the byte budget is unreachable through {@link parse} (the 512-byte
+ * line cap fires first), so the tag-section guards are unit-tested here.
+ */
+export function parseTags(section: string, line: string): Record<string, string> {
+  // Null prototype: tag keys are attacker-controlled, so a plain object
+  // literal would route magic keys (`__proto__`, `constructor`, `toString`,
+  // `hasOwnProperty`, …) through `Object.prototype` accessors instead of
+  // creating own properties — `__proto__=x` would be silently dropped by
+  // the setter, and the others would shadow inherited methods.
+  const tags: Record<string, string> = Object.create(null);
+  const sectionBytes = byteLength(section);
+  if (sectionBytes > MAX_TAG_BYTES) {
+    throw new IrcParseError(
+      `tag section exceeds ${MAX_TAG_BYTES}-byte budget (${sectionBytes} bytes)`,
+      line,
+    );
+  }
+  let tagCount = 0;
   for (const entry of section.split(';')) {
     if (entry === '') continue;
+    tagCount++;
+    if (tagCount > MAX_TAGS) {
+      throw new IrcParseError(`too many tags (${tagCount} > ${MAX_TAGS})`, line);
+    }
     const eq = entry.indexOf('=');
     if (eq === -1) {
       tags[entry] = '';
     } else {
-      tags[entry.slice(0, eq)] = unescapeTagValue(entry.slice(eq + 1));
+      const value = unescapeTagValue(entry.slice(eq + 1));
+      // IRCv3 Message Tags: CR, LF and NUL MUST NOT appear in tag values —
+      // not even via their `\r` / `\n` escape sequences. The line-level
+      // bare-CR guard cannot see these: the wire bytes are backslash + 'r',
+      // not CR, so the check fires on the UNESCAPED value.
+      if (/[\r\n\0]/u.test(value)) {
+        throw new IrcParseError('tag value contains forbidden CR/LF/NUL', line);
+      }
+      tags[entry.slice(0, eq)] = value;
     }
   }
   return tags;
@@ -105,7 +158,9 @@ const COMMAND_RE = /^(?:[A-Za-z]+|[0-9]{3})$/;
  *
  * Lenient where real-world clients are: tolerates missing CR/LF and collapses
  * accidental runs of spaces between tokens. Strict where the grammar is: a
- * command token is required and must be all-letters or exactly three digits.
+ * command token is required and must be all-letters or exactly three digits,
+ * and a bare CR (any CR left after the trailing terminator strip) is a
+ * protocol violation.
  */
 export function parse(line: string): IrcMessage {
   // Strip any trailing CR/LF (frame tolerance for ws text frames or TCP lines).
@@ -114,13 +169,27 @@ export function parse(line: string): IrcMessage {
     throw new IrcParseError('empty message', line);
   }
 
+  // After the trailing terminator strip, any remaining CR is bare by
+  // definition: a mid-line CR-LF would have split the frame at the
+  // transport layer, so a surviving CR means frame control characters are
+  // being smuggled inside message content (middle/trailing params, tag
+  // sections, source prefixes). Reject — such content would otherwise be
+  // stored and echoed verbatim into outbound lines, corrupting framing on
+  // RFC-compliant clients.
+  if (stripped.includes('\r')) {
+    throw new IrcParseError('bare CR in message', line);
+  }
+
   // RFC 1459 §2.3 hard cap: reject any single message whose post-CRLF body
-  // exceeds {@link MAX_INPUT_BYTES} bytes. Prevents memory and processing
-  // abuse from over-long inputs and matches the symmetric cap enforced on
-  // outbound lines by `outbound.ts`.
-  if (stripped.length > MAX_INPUT_BYTES) {
+  // exceeds {@link MAX_INPUT_BYTES} bytes. Measured in UTF-8 bytes (the wire
+  // encoding), not UTF-16 code units, so multi-byte content cannot double
+  // the effective cap. Prevents memory and processing abuse from over-long
+  // inputs and matches the symmetric cap enforced on outbound lines by
+  // `outbound.ts`.
+  const inputBytes = byteLength(stripped);
+  if (inputBytes > MAX_INPUT_BYTES) {
     throw new IrcParseError(
-      `message exceeds ${MAX_INPUT_BYTES}-byte input cap (${stripped.length} bytes)`,
+      `message exceeds ${MAX_INPUT_BYTES}-byte input cap (${inputBytes} bytes)`,
       line,
     );
   }
@@ -133,7 +202,7 @@ export function parse(line: string): IrcMessage {
     if (space === -1) {
       throw new IrcParseError('tag section with no message body', line);
     }
-    tags = parseTags(rest.slice(1, space));
+    tags = parseTags(rest.slice(1, space), line);
     rest = rest.slice(space + 1).trimStart();
   }
 

package/packages/irc-core/src/state/connection.ts

@@ -93,6 +93,19 @@ export interface ConnectionState {
    * and consumed once the final short chunk (or `+`) arrives.
    */
   saslBuffer?: string;
+  /**
+   * Epoch-ms timestamps of failed SASL attempts on this connection (one
+   * entry per `904 ERR_SASLFAIL`), pruned to the configured sliding window
+   * on every recording. Once the array reaches the configured
+   * `sasl.maxFailures` ceiling within the window, the SASL reducer
+   * disconnects the connection (online brute-force hardening).
+   *
+   * Pre-registration scratch: SASL only runs before registration
+   * completes, and adapters do not persist pre-registration scratch fields
+   * (`saslMech`/`saslBuffer` are likewise absent from the persisted
+   * shape), so a reconnect starts with a clean tracker by construction.
+   */
+  saslFailures?: number[];
   registration: RegistrationState;
   /**
    * True once the client has sent `CAP LS` or `CAP REQ` and not yet sent