From 33a639ecf0c3336e600d68562a2a5791ccf90b87 Mon Sep 17 00:00:00 2001
From: Simon Ser <contact@emersion.fr>
Date: Wed, 1 Dec 2021 15:56:43 +0100
Subject: [PATCH] Validate address in user.checkNetwork

---
 user.go | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/user.go b/user.go
index f94cd56..4e43f31 100644
--- a/user.go
+++ b/user.go
@@ -782,11 +782,44 @@ func (u *user) removeNetwork(network *network) {
 }
 
 func (u *user) checkNetwork(record *Network) error {
+	url, err := record.URL()
+	if err != nil {
+		return err
+	}
+	if url.User != nil {
+		return fmt.Errorf("%v:// URL must not have username and password information", url.Scheme)
+	}
+	if url.RawQuery != "" {
+		return fmt.Errorf("%v:// URL must not have query values", url.Scheme)
+	}
+	if url.Fragment != "" {
+		return fmt.Errorf("%v:// URL must not have a fragment", url.Scheme)
+	}
+	switch url.Scheme {
+	case "ircs", "irc+insecure":
+		if url.Host == "" {
+			return fmt.Errorf("%v:// URL must have a host", url.Scheme)
+		}
+		if url.Path != "" {
+			return fmt.Errorf("%v:// URL must not have a path", url.Scheme)
+		}
+	case "irc+unix", "unix":
+		if url.Host != "" {
+			return fmt.Errorf("%v:// URL must not have a host", url.Scheme)
+		}
+		if url.Path == "" {
+			return fmt.Errorf("%v:// URL must have a path", url.Scheme)
+		}
+	default:
+		return fmt.Errorf("unknown URL scheme %q", url.Scheme)
+	}
+
 	for _, net := range u.networks {
 		if net.GetName() == record.GetName() && net.ID != record.ID {
 			return fmt.Errorf("a network with the name %q already exists", record.GetName())
 		}
 	}
+
 	return nil
 }