Security Advisories (1)
CVE-2010-3438 (2019-11-12)

libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as \"some text\\rQUIT\" to the 'privmsg' handler, which would cause the client to disconnect from the server.

NAME

POE::Component::IRC::Qnet - a fully event-driven IRC client module for Quakenet.

SYNOPSIS

use strict;
use warnings;
use POE qw(Component::IRC::Qnet);

my $nickname = 'Flibble' . $$;
my $ircname = 'Flibble the Sailor Bot';
my $port = 6667;
my $qauth = 'FlibbleBOT';
my $qpass = 'fubar';

my @channels = ( '#Blah', '#Foo', '#Bar' );

# We create a new PoCo-IRC object and component.
my $irc = POE::Component::IRC::Qnet->spawn( 
      nick => $nickname,
      port => $port,
      ircname => $ircname,
) or die "Oh noooo! $!";

POE::Session->create(
      package_states => [
              'main' => [ qw(_default _start irc_001 irc_public) ],
      ],
      heap => { irc => $irc },
);

$poe_kernel->run();
exit 0;

sub _start {
  my ($kernel,$heap) = @_[KERNEL,HEAP];

  # We get the session ID of the component from the object
  # and register and connect to the specified server.
  my $irc_session = $heap->{irc}->session_id();
  $kernel->post( $irc_session => register => 'all' );
  $kernel->post( $irc_session => connect => { } );
  undef;
}

sub irc_001 {
  my ($kernel,$sender) = @_[KERNEL,SENDER];

  # Get the component's object at any time by accessing the heap of
  # the SENDER
  my $poco_object = $sender->get_heap();
  print "Connected to ", $poco_object->server_name(), "\n";

  # Lets authenticate with Quakenet's Q bot
  $kernel->post( $sender => qbot_auth => $qauth => $qpass );

  # In any irc_* events SENDER will be the PoCo-IRC session
  $kernel->post( $sender => join => $_ ) for @channels;
  undef;
}

sub irc_public {
  my ($kernel,$sender,$who,$where,$what) = @_[KERNEL,SENDER,ARG0,ARG1,ARG2];
  my $nick = ( split /!/, $who )[0];
  my $channel = $where->[0];

  if ( my ($rot13) = $what =~ /^rot13 (.+)/ ) {
      $rot13 =~ tr[a-zA-Z][n-za-mN-ZA-M];
      $kernel->post( $sender => privmsg => $channel => "$nick: $rot13" );
  }
  undef;
}

# We registered for all events, this will produce some debug info.
sub _default {
  my ($event, $args) = @_[ARG0 .. $#_];
  my @output = ( "$event: " );

  foreach my $arg ( @$args ) {
      if ( ref($arg) eq 'ARRAY' ) {
              push( @output, "[" . join(" ,", @$arg ) . "]" );
      } else {
              push ( @output, "'$arg'" );
      }
  }
  print STDOUT join ' ', @output, "\n";
  return 0;
}

DESCRIPTION

POE::Component::IRC::Qnet is an extension to POE::Component::IRC specifically for use on Quakenet http://www.quakenet.org/. See the documentation for POE::Component::IRC for general usage. This document covers the extensions.

The module provides a number of additional commands for communicating with the Quakenet service bots, Q and L.

METHODS

service_bots

The component will query Q and L using their default names on Quakenet. If you wish to override these settings, use this method to configure them.

$self->service_bots( QBOT => 'W@blah.network.net', LBOT => 'Z@blah.network.net' );

In most cases you shouldn't need to mess with these >;o)

INPUT

The Quakenet service bots accept input as PRIVMSG. This module provides a wrapper around the POE::Component::IRC "privmsg" command.

qbot_*

Send commands to the Q bot. Pass additional command parameters as arguments to the event.

$kernel->post ( 'my client' => qbot_auth => $q_user => $q_pass );

lbot_*

Send commands to the L bot. Pass additional command parameters as arguments to the event.

$kernel->post ( 'my client' => lbot_chanlev => $channel );

OUTPUT

All output from the Quakenet service bots is sent as NOTICEs. Use 'irc_notice' to trap these.

irc_whois

Has all the same hash keys in ARG1 as POE::Component::IRC, with the addition of 'account', which contains the name of their Q auth account, if they have authed, or undef if they haven't.

BUGS

A few have turned up in the past and they are sure to again. Please use http://rt.cpan.org/ to report any. Alternatively, email the current maintainer.

AUTHOR

Chris 'BinGOs' Williams <chris@bingosnet.co.uk>

Based on the original POE::Component::IRC by:

Dennis Taylor, <dennis@funkplanet.com>

SEE ALSO

POE::Component::IRC

http://www.quakenet.org/