From de6d6906f81628b25150c486fc681caefe2c9bed Mon Sep 17 00:00:00 2001
From: Pavel Djundik <xPaw@users.noreply.github.com>
Date: Tue, 21 Jan 2020 15:39:08 +0200
Subject: [PATCH 1/2] Disallow some invalid characters in nicknames and
 usernames

@, !, : and whitespace are disallowed due to being part of the protocol/hostmask
---
 client/components/NetworkForm.vue | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/client/components/NetworkForm.vue b/client/components/NetworkForm.vue
index f048be4f..32b60b09 100644
--- a/client/components/NetworkForm.vue
+++ b/client/components/NetworkForm.vue
@@ -90,6 +90,7 @@
 					id="connect:nick"
 					class="input nick"
 					name="nick"
+					pattern="[^\s:!@]+"
 					:value="defaults.nick"
 					maxlength="100"
 					required
@@ -104,8 +105,9 @@
 						ref="usernameInput"
 						class="input username"
 						name="username"
+						pattern="[^\s:!@]+"
 						:value="defaults.username"
-						maxlength="512"
+						maxlength="100"
 					/>
 				</div>
 			</template>
@@ -118,7 +120,7 @@
 						class="input"
 						:type="slotProps.isVisible ? 'text' : 'password'"
 						name="password"
-						maxlength="512"
+						maxlength="300"
 					/>
 				</RevealPassword>
 			</div>
@@ -129,7 +131,7 @@
 					class="input"
 					name="realname"
 					:value="defaults.realname"
-					maxlength="512"
+					maxlength="300"
 				/>
 			</div>
 			<template v-if="defaults.uuid">

From 1a7135c5e08f2962e246fdd143f62723040d9e3f Mon Sep 17 00:00:00 2001
From: Pavel Djundik <xPaw@users.noreply.github.com>
Date: Tue, 21 Jan 2020 15:42:29 +0200
Subject: [PATCH 2/2] Clean up strings on server

---
 src/models/network.js | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/src/models/network.js b/src/models/network.js
index 1df26436..5d860090 100644
--- a/src/models/network.js
+++ b/src/models/network.js
@@ -62,26 +62,24 @@ function Network(attr) {
 }
 
 Network.prototype.validate = function(client) {
-	// If entered nick is over 100 characters, limit it so we don't try to compile a big regex
-	if (this.nick && this.nick.length > 100) {
-		this.nick = this.nick.substring(0, 100);
-	}
+	// Remove !, :, @ and whitespace characters from nicknames and usernames
+	const cleanNick = (str) => str.replace(/[\x00\s:!@]/g, "_").substring(0, 100);
 
-	this.setNick(String(this.nick || Helper.getDefaultNick()).replace(/\s/g, "_"));
+	// Remove new lines and limit length
+	const cleanString = (str) => str.replace(/[\x00\r\n]/g, "").substring(0, 300);
+
+	this.setNick(cleanNick(String(this.nick || Helper.getDefaultNick())));
 
 	if (!this.username) {
+		// If username is empty, make one from the provided nick
 		this.username = this.nick.replace(/[^a-zA-Z0-9]/g, "");
-	} else {
-		// Remove any whitespace from usernames as that is not valid
-		this.username = this.username.replace(/\s/g, "_").substring(0, 100);
 	}
 
-	if (!this.realname) {
-		this.realname = "The Lounge User";
-	} else {
-		// Remove newlines from realnames
-		this.realname = this.realname.replace(/[\r\n]/g, "_").substring(0, 128);
-	}
+	this.username = cleanNick(this.username) || "thelounge";
+	this.realname = cleanString(this.realname) || "The Lounge User";
+	this.password = cleanString(this.password);
+	this.host = cleanString(this.host);
+	this.name = cleanString(this.name);
 
 	if (!this.port) {
 		this.port = this.tls ? 6697 : 6667;