nntpd: restrict allowed newsgroup names

[public-inbox.git] / lib / PublicInbox / NNTPD.pm

diff --git a/lib/PublicInbox/NNTPD.pm b/lib/PublicInbox/NNTPD.pm
index 0f79f8f9a9daad240d2260ffcf6c286df28b33a5..b8ec84ed6b0e24490c71cad2fa15787578a467dc 100644 (file)
--- a/lib/PublicInbox/NNTPD.pm
+++ b/lib/PublicInbox/NNTPD.pm
@@ -1,4 +1,4 @@
-# Copyright (C) 2016-2019 all contributors <meta@public-inbox.org>
+# Copyright (C) 2016-2020 all contributors <meta@public-inbox.org>
 # License: AGPL-3.0+ <https://www.gnu.org/licenses/agpl-3.0.txt>
 
 # represents an NNTPD (currently a singleton),
@@ -7,7 +7,7 @@ package PublicInbox::NNTPD;
 use strict;
 use warnings;
 use Sys::Hostname;
-require PublicInbox::Config;
+use PublicInbox::Config;
 
 sub new {
        my ($class) = @_;
@@ -41,10 +41,20 @@ sub refresh_groups () {
                if (ref $ngname) {
                        warn 'multiple newsgroups not supported: '.
                                join(', ', @$ngname). "\n";
+               # Newsgroup name needs to be compatible with RFC 3977
+               # wildmat-exact and RFC 3501 (IMAP) ATOM-CHAR.
+               # Leave out a few chars likely to cause problems or conflicts:
+               # '|', '<', '>', ';', '#', '$', '&',
+               } elsif ($ngname =~ m![^A-Za-z0-9/_\.\-\~\@\+\=:]!) {
+                       warn "newsgroup name invalid: `$ngname'\n";
                } elsif ($ng->nntp_usable) {
                        # Only valid if msgmap and search works
                        $new->{$ngname} = $ng;
                        push @list, $ng;
+
+                       # preload to avoid fragmentation:
+                       $ng->description;
+                       $ng->base_url;
                }
        });
        @list = sort { $a->{newsgroup} cmp $b->{newsgroup} } @list;