irssi-0001 Scan Notes

Target: irssi (IRC client, C) Scan date: 2026-03-31 MOADs checked: 0001, 0002, 0003, 0004, 0005

MOAD-0001 (CWE-407) — CLEAN

No O(N^2) hot-path defect found.

nicklist.c: nick lookup uses GHashTable — O(1) per lookup.
ignore.c: ignore_check_flags() iterates ignores list (O(I)) per message. For known nicks, nickmatch_cache short-circuits to O(1). For unknown nicks, strarray_find is called inside outer loop — O(I * C) where C is channels-per-ignore-rule. Both I and C are user-configured and typically tiny (single digits). Not filed; not server-driven unbounded growth.
hilight-text.c: hilight_match() iterates hilight list O(H) per message. nickmatch_cache handles the nick case. No inner list scan.
flood.c: flood_newmsg() uses GHashTable keyed by nick. Inner flood_find iterates flood->items but these are flood time-buckets per nick — bounded by flood_timecheck window. Not O(N^2).
servers-redirect.c: redirect_find() calls g_slist_find inside a loop over server->redirects. Both lists are IRC command queues, bounded at a few entries. Not a real hot-path O(N^2).

MOAD-0002 (Intertangle) — OBSERVATION (no ticket)

irssi has global GSList *servers, GSList *ignores, GSList *channels, GSList *logs etc. in src/core/. These are classic single-threaded IRC client globals. irssi is intentionally single-threaded (GLib event loop) so there is no concurrency hazard, just architectural coupling. Not actionable as a patch without redesigning the entire client.

MOAD-0003 (Leaked Context) — N/A

irssi is a single-user, single-process, single-threaded terminal client. No thread-local storage, no request-scoped identity. Not applicable.

MOAD-0004 (CWE-312) — DEFECT FOUND → irssi-0001

rawlog_output() in src/core/rawlog.c logs every outbound IRC command verbatim. This includes:

PASS <plaintext_server_password> — sent on every connection
AUTHENTICATE <base64(user\0user\0pass)> — SASL PLAIN credentials

Both flow through irc_send_cmd_now() → irc_server_send_data() → rawlog_output() (confirmed at src/irc/core/irc-servers.c:747).

The rawlog ring buffer (200 lines) is always active in memory and accessible to Perl plugins via $server->{rawlog}. When the user enables /rawlog open <file>, credentials are written to disk in plaintext.

Fix: apply credential denylist in rawlog_redact_credentials() before rawlog_add(). See patch file.

MOAD-0005 (Thundering Herd) — CLEAN

irssi uses a single-threaded GLib event loop. No concurrent cache access, no get+null+compute+put race possible. CLEAN.

2.6 KiB Raw Blame History