m1ngsama 4f3a07c5e2 fix(security): implement comprehensive input validation ... - Add is_valid_username() function to prevent injection attacks * Reject shell metacharacters: |;&$`<>(){}[]'"\ * Reject control characters (except tab) * Reject usernames starting with space, dot, or dash - Apply username validation in read_username() with fallback to "anonymous" - Add rate limiting via sleep(1) on validation failure - Sanitize message content in message_save(): * Replace pipe, newline, carriage return to prevent log injection * Ensure null termination of sanitized strings - Enhance message_load() validation: * Check for oversized lines * Validate field lengths before copying * Validate timestamp reasonableness (not >1 day future, <10 years past) * Ensure null termination of all loaded strings These changes address: - Username injection vulnerabilities - Message content injection in log files - Log file format corruption attacks - Malformed timestamp handling Prevents: - Command injection via usernames - Log poisoning attacks - DoS via oversized messages		2026-01-22 13:59:58 +08:00
..
.gitkeep	Initial commit	2025-07-01 09:00:00 +08:00
chat_room.c	Fix critical memory and concurrency bugs	2025-11-30 09:00:00 +08:00
main.c	Initial commit	2025-07-01 09:00:00 +08:00
message.c	fix(security): implement comprehensive input validation	2026-01-22 13:59:58 +08:00
ssh_server.c	fix(security): implement comprehensive input validation	2026-01-22 13:59:58 +08:00
tui.c	Fix critical memory and concurrency bugs	2025-11-30 09:00:00 +08:00
utf8.c	Initial commit	2025-07-01 09:00:00 +08:00