The HTTP API relays a PRIVMSG or NOTICE body that is not an array of strings #245

New Issue

2026-11-02T06:26:00+01:00

clawbot commented

2026-11-02 06:26:00 +01:00

Over the HTTP API, HandleSendCommand in internal/handlers/api.go keeps a PRIVMSG or NOTICE body and meta as raw JSON. It checks the body only by decoding it into a list of strings, and JSON null decodes into an empty string without an error, so a body such as ["hi", null] passes. handleChannelMsg and handleDirectMsg then relay the raw body and meta to every recipient unchanged. Peers can get a body holding null and a meta that is not an object, though README.md and schema/message.json say body is an array of strings and meta an object. Found by the review of #242; read from the code on 2b1a49e.

Fix (recommended, no owner decision needed): a PRIVMSG or NOTICE whose body is not an array of strings, or whose meta is present and not a JSON object, is refused with HTTP 400 and invalid request body, the answer a request that is not JSON already gets, and nothing is relayed. Change nothing else.

Definition of done

A PRIVMSG or NOTICE over the HTTP API whose body holds anything but strings (null, a number, an object) gets HTTP 400, and no recipient gets a message.
The same for a meta that is present and is not an object.
A valid message is relayed as before.
Tests in internal/handlers for items 1 to 3.
README.md, where it describes the HTTP API's errors for these commands, says what the code now does.
One reviewed PR against next.

Model: opus-5-5

Over the HTTP API, `HandleSendCommand` in `internal/handlers/api.go` keeps a `PRIVMSG` or `NOTICE` body and meta as raw JSON. It checks the body only by decoding it into a list of strings, and JSON `null` decodes into an empty string without an error, so a body such as `["hi", null]` passes. `handleChannelMsg` and `handleDirectMsg` then relay the raw `body` and `meta` to every recipient unchanged. Peers can get a `body` holding `null` and a `meta` that is not an object, though `README.md` and `schema/message.json` say `body` is an array of strings and `meta` an object. Found by the review of https://git.eeqj.de/sneak/neoirc/pulls/242; read from the code on `2b1a49e`. Fix (recommended, no owner decision needed): a `PRIVMSG` or `NOTICE` whose `body` is not an array of strings, or whose `meta` is present and not a JSON object, is refused with HTTP 400 and `invalid request body`, the answer a request that is not JSON already gets, and nothing is relayed. Change nothing else. ## Definition of done 1. A `PRIVMSG` or `NOTICE` over the HTTP API whose `body` holds anything but strings (`null`, a number, an object) gets HTTP 400, and no recipient gets a message. 2. The same for a `meta` that is present and is not an object. 3. A valid message is relayed as before. 4. Tests in `internal/handlers` for items 1 to 3. 5. `README.md`, where it describes the HTTP API's errors for these commands, says what the code now does. 6. One reviewed PR against `next`. Model: opus-5-5

~~clawbot referenced this issue 2026-11-02 06:32:30 +01:00~~

1.0: what stands between next and a release candidate #140

clawbot referenced this issue from a commit

2026-11-02 06:34:24 +01:00

Refuse a PRIVMSG or NOTICE whose body or meta has the wrong type (closes #245)

clawbot referenced a pull request that will close this issue

2026-11-02 06:45:54 +01:00

Refuse a PRIVMSG or NOTICE whose body or meta has the wrong type (closes #245) #247

clawbot commented

2026-11-02 06:46:07 +01:00

#247 refuses such a PRIVMSG or NOTICE with HTTP 400 invalid request body before anything is relayed, and README.md says so.

Model: opus-5-5

https://git.eeqj.de/sneak/neoirc/pulls/247 refuses such a `PRIVMSG` or `NOTICE` with HTTP 400 `invalid request body` before anything is relayed, and `README.md` says so. Model: opus-5-5

clawbot referenced this issue

2026-11-02 06:59:07 +01:00

Refuse a PRIVMSG or NOTICE whose body or meta has the wrong type (closes #245) #247

clawbot referenced this issue from a commit

2026-11-02 07:14:20 +01:00

Refuse a PRIVMSG or NOTICE whose body or meta has the wrong type (closes #245)

clawbot referenced this issue from a commit

2026-11-02 07:18:50 +01:00

Refuse a PRIVMSG or NOTICE whose body or meta has the wrong type (closes #245)

clawbot closed this issue

2026-11-02 07:39:19 +01:00

clawbot referenced this issue from a commit