c-stevens / laika-weblogs Goto Github PK

Python docs for hashlib imply vulnerabilities in comparing hashes with the == operator, and instead recommend using a compare_digest() method. In doc context, it is referring to HMAC messages, so it may not apply here but is worth investigating further.

As per the limitations listed in the readme, the final phase of the Message Authentication Protocol is not cryptographically tied to the valid proof agreed upon by client and server.

The protocol can be further enhanced and secured by adding a MAC/HMAC scheme to this stage of the protocol

Currently nickname mapping to channels occurs once the bot notifies the weblogs observer that a user has spoke in a certain channel. This mapping is maintained in order to generate QUIT messages for each channel they've been spotted in.

However, an edge case exists where a user is spotted JOINing a channel (or set of channels) but does not say anything in any of them before QUIT/PARTing. In this case, no QUIT messages are generated because the nick is unmapped until they send a message to a channel.

This can be resolved by adding mapping logic under the logServerData() method, much like is found in the following logic:

This will not resolve cases where the bot comes online after a user has already joined a channel. There is still no initial mapping at that stage.