relay/api: fix memory leak in resources "handshake", "input" and "completion"

core: update ChangeLog (#2326 )
xfer: fix out-of-bounds write in xfer_dcc_resume_hash (#2326 )
2026-06-18 00:54:47 +02:00 · 2026-06-17 21:54:15 +02:00 · 2026-06-17 21:31:03 +02:00 · 2026-06-17 21:29:45 +02:00 · 2026-06-15 21:55:54 +02:00 · 2026-06-15 08:22:03 +02:00
100 changed files with 1485 additions and 434 deletions
@@ -118,7 +118,7 @@ jobs:
    strategy:
      matrix:
        os:
-          - ubuntu-24.04
+          - ubuntu-26.04

    runs-on: ${{ matrix.os }}

@@ -131,7 +131,7 @@ jobs:
        sudo apt-get update -qq
        sudo apt-get --yes --no-install-recommends install ${{ env.CHECK_DEPS_UBUNTU }}
        pipx install msgcheck ruff
-        cargo install --version 0.0.10 poexam
+        cargo install --version 0.0.11 poexam

    - name: Check gettext files (msgcheck)
      run: msgcheck po/*.po
@@ -153,7 +153,7 @@ jobs:
    strategy:
      matrix:
        os:
-          - ubuntu-24.04
+          - ubuntu-26.04
        config:
          - name: "gcc"
            cc: "gcc"
@@ -194,6 +194,8 @@ jobs:

    name: "install (${{ matrix.os }}, ${{ matrix.config.name }})"
    runs-on: ${{ matrix.os }}
+    env:
+      PHP_INI_SCAN_DIR: /tmp/php-noscan  # embed PHP loads no add-on extensions (see #2009)

    steps:

@@ -203,8 +205,7 @@ jobs:
      run: |
        sudo apt-get update -qq
        sudo apt-get --yes --no-install-recommends install ${{ env.WEECHAT_DEPS_UBUNTU }}
-        # uninstall php imagick as is causes a crash when loading php plugin (see #2009)
-        sudo apt-get --yes purge php8.3-imagick
+        mkdir -p /tmp/php-noscan
        pipx install schemathesis

    - name: Build and run tests
@@ -258,7 +259,7 @@ jobs:
    strategy:
      matrix:
        os:
-          - ubuntu-24.04
+          - ubuntu-26.04
        config:
          - name: "gcc"
            cc: "gcc"
@@ -304,7 +305,7 @@ jobs:
    strategy:
      matrix:
        os:
-          - ubuntu-24.04
+          - ubuntu-26.04
        config:
          - name: "gcc"
            cc: "gcc"
@@ -355,7 +356,7 @@ jobs:
    strategy:
      matrix:
        os:
-          - ubuntu-24.04
+          - ubuntu-26.04
        config:
          # - name: "gcc"
          # cc: "gcc"
@@ -450,7 +451,7 @@ jobs:
    strategy:
      matrix:
        os:
-          - ubuntu-24.04
+          - ubuntu-26.04

    runs-on: ${{ matrix.os }}

@@ -487,7 +488,7 @@ jobs:
    strategy:
      matrix:
        os:
-          - ubuntu-24.04
+          - ubuntu-26.04

    runs-on: ${{ matrix.os }}

@@ -505,8 +506,6 @@ jobs:
      run: |
        sudo apt-get update -qq
        sudo apt-get --yes --no-install-recommends install ${{ env.WEECHAT_DEPS_UBUNTU }}
-        # uninstall php imagick as is causes a crash when loading php plugin (see #2009)
-        sudo apt-get --yes purge php8.3-imagick

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
@@ -7,9 +7,11 @@ select = [
    "checks",
 ]
 ignore = [
+    "acronyms",
    "brackets",
    "double-quotes",
    "double-words",
+    "functions",
    "html-tags",
    "paths",
    "unchanged",
@@ -12,19 +12,47 @@ SPDX-License-Identifier: GPL-3.0-or-later

 - core: add condition on connected relay api clients in default value of option weechat.look.hotlist_add_conditions
 - core: add `/mute` in default command for key `Alt`+`=` (toggle filters)
+- api: change type of parameter "pos_option_name" to "const char **" in function config_search_with_string
+- relay/api: add field "last_read_line_id" in GET /api/buffers

 ### Added

+- relay/api: add resource `GET /api/scripts`
 - relay: add option relay.network.unix_socket_permissions ([#2317](https://github.com/weechat/weechat/issues/2317))
+- script: add info "script_languages"

 ### Fixed

 - core: fix option weechat.look.color_real_white not applied when color is "white" on 16+ colors terminals ([#1742](https://github.com/weechat/weechat/issues/1742))
+- core: fix buffer overflow in connection to SOCKS5 proxy ([#2325](https://github.com/weechat/weechat/issues/2325))
+- api: fix infinite loop in function string_replace when the search string is empty
 - irc: fix tag in message with list of names when joining a channel
 - fset: remove error displayed in core buffer when clicking with the mouse below the last option displayed
- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3))
- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
+- irc: limit size of data received from the server to prevent memory exhaustion
+- irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message ([#2322](https://github.com/weechat/weechat/issues/2322))
+- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3), [CVE-2026-53524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53524))
+- relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion
+- relay: limit size of partial message received while reading an HTTP request to prevent memory exhaustion
+- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))
+- relay: fix out-of-bounds read in dump of data ([#2324](https://github.com/weechat/weechat/issues/2324))
+- relay/api: fix memory leak in resources "handshake", "input" and "completion"
+- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))
+- xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory ([#2321](https://github.com/weechat/weechat/issues/2321))
+- xfer: fix out-of-bounds read when receiving empty line in DCC chat ([#2323](https://github.com/weechat/weechat/issues/2323))
+- xfer: fix out-of-bounds write in xfer file transfer resume ([#2326](https://github.com/weechat/weechat/issues/2326))
+
+## Version 4.9.2 (2026-06-07)
+
+### Fixed
+
+- api: fix infinite loop in function string_replace when the search string is empty
+- irc: limit size of data received from the server to prevent memory exhaustion
+- irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message ([#2322](https://github.com/weechat/weechat/issues/2322))
+- relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion
+- relay: limit size of partial message received while reading an HTTP request to prevent memory exhaustion
+- relay: fix out-of-bounds read in dump of data ([#2324](https://github.com/weechat/weechat/issues/2324))
+- xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory ([#2321](https://github.com/weechat/weechat/issues/2321))
+- xfer: fix out-of-bounds read when receiving empty line in DCC chat ([#2323](https://github.com/weechat/weechat/issues/2323))

 ## Version 4.9.1 (2026-05-31)

@@ -32,9 +60,9 @@ SPDX-License-Identifier: GPL-3.0-or-later

 - core: fix option weechat.look.color_real_white not applied when color is "white" on 16+ colors terminals ([#1742](https://github.com/weechat/weechat/issues/1742))
 - irc: fix tag in message with list of names when joining a channel
- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3))
- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
+- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3), [CVE-2026-53524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53524))
+- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))
+- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))

 ## Version 4.9.0 (2026-03-29)

@@ -19,8 +19,7 @@ First, some basic things:

 ### Security reports

-Please **DO NOT** file a GitHub issue for security related problems, but send an
-email to [security@weechat.org](mailto:security@weechat.org) instead.
+Please **DO NOT** file a GitHub issue for security related problems; see [SECURITY.md](SECURITY.md) instead.

 ### Required info

@@ -27,11 +27,11 @@ Homepage: [https://weechat.org/](https://weechat.org/)
 ## Features

 - **Modular chat client**: WeeChat has a lightweight core and optional [plugins](https://weechat.org/doc/weechat/user/#plugins). All plugins (including [IRC](https://weechat.org/doc/weechat/user/#irc)) are independent and can be unloaded.
- **Multi-platform**: WeeChat runs on GNU/Linux, *BSD, GNU/Hurd, Haiku, macOS and Windows (Bash/Ubuntu and Cygwin).
- **Multi-protocols**: WeeChat is designed to support multiple protocols by plugins, like IRC.
+- **Multi-platform**: WeeChat runs on GNU/Linux, *BSD, GNU/Hurd, Haiku, macOS and Windows (WSL and Cygwin).
+- **Multi-protocol**: WeeChat is designed to support multiple protocols via plugins, like IRC.
 - **Standards-compliant**: the IRC plugin is compliant with RFCs [1459](https://datatracker.ietf.org/doc/html/rfc1459), [2810](https://datatracker.ietf.org/doc/html/rfc2810), [2811](https://datatracker.ietf.org/doc/html/rfc2811), [2812](https://datatracker.ietf.org/doc/html/rfc2812), [2813](https://datatracker.ietf.org/doc/html/rfc2813) and [7194](https://datatracker.ietf.org/doc/html/rfc7194).
 - **Small, fast, and very light**: the core is and should stay as light and fast as possible.
- **Customizable and extensible**: there are a lot of options to customize WeeChat, and it is extensible with C plugins and [scripts](https://weechat.org/scripts/) ([Perl](https://weechat.org/scripts/language/perl/), [Python](https://weechat.org/scripts/language/python/), [Ruby](https://weechat.org/scripts/language/ruby), [Lua](https://weechat.org/scripts/language/lua/), [Tcl](https://weechat.org/scripts/language/tcl/), [Scheme](https://weechat.org/scripts/language/guile/), [JavaScript](https://weechat.org/scripts/language/javascript/) and [PHP](https://weechat.org/scripts/language/php/)).
+- **Customizable and extensible**: there are a lot of options to customize WeeChat, and it is extensible with C plugins and [scripts](https://weechat.org/scripts/) ([Perl](https://weechat.org/scripts/language/perl/), [Python](https://weechat.org/scripts/language/python/), [Ruby](https://weechat.org/scripts/language/ruby/), [Lua](https://weechat.org/scripts/language/lua/), [Tcl](https://weechat.org/scripts/language/tcl/), [Scheme](https://weechat.org/scripts/language/guile/), [JavaScript](https://weechat.org/scripts/language/javascript/) and [PHP](https://weechat.org/scripts/language/php/)).
 - **Fully documented**: there is comprehensive [documentation](https://weechat.org/doc/weechat/), which is [translated](https://weechat.org/doc/weechat/dev/#translations) into several languages.
 - **Developed from scratch**: WeeChat was built from scratch and is not based on any other client.
 - **Free software**: WeeChat is released under [GPLv3](https://www.gnu.org/licenses/gpl-3.0.html).
@@ -49,7 +49,7 @@ For detailed instructions, please check the [WeeChat user's guide](https://weech

 ## Semantic versioning

-WeeChat is following a "practical" semantic versioning, see file [CONTRIBUTING.md](CONTRIBUTING.md#semantic-versioning).
+WeeChat follows "practical" semantic versioning; see [CONTRIBUTING.md](CONTRIBUTING.md#semantic-versioning).

 ## Copyright

@@ -0,0 +1,26 @@
+<!--
+SPDX-FileCopyrightText: 2026 Sébastien Helleu <flashcode@flashtux.org>
+
+SPDX-License-Identifier: GPL-3.0-or-later
+-->
+
+# Security Policy
+
+## Supported versions
+
+Only the latest stable version of WeeChat is supported.
+
+| Version        | Supported          | Notes                                               |
+| -------------- | ------------------ | --------------------------------------------------- |
+| Latest stable  | :white_check_mark: | Fully supported.                                    |
+| Older releases | :x:                | Not supported. Contact us in case of specific need. |
+
+However, we may help to backport fixes on older versions, especially when they are used in released distributions with no way to upgrade to the latest stable release (please contact us).
+
+## Reporting a vulnerability
+
+Please report security issues using <https://github.com/weechat/weechat/security/advisories/new>.
+
+Alternatively, if you are not able to use this form, you can send an email to [security@weechat.org](mailto:security@weechat.org) instead.
+
+We will investigate all legitimate reports and do our best to quickly fix the problem.
@@ -30,7 +30,7 @@ if(ENABLE_MAN OR ENABLE_DOC)
  set(SCRIPTING_LANG de en fr it ja pl sr)
  set(FAQ_LANG de en es fr it ja pl sr)
  set(QUICKSTART_LANG cs de en es fr it ja pl ru sr)
-  set(RELAY_API_LANG en fr)
+  set(RELAY_API_LANG en fr sr)
  set(RELAY_WEECHAT_LANG en fr ja sr)
  set(DEV_LANG en fr ja sr)

@@ -4348,7 +4348,7 @@ Prototype:

 [source,c]
 ----
-int weechat_mkdir_home (char *directory, int mode);
+int weechat_mkdir_home (const char *directory, int mode);
 ----

 Arguments:
@@ -4395,7 +4395,7 @@ Prototype:

 [source,c]
 ----
-int weechat_mkdir (char *directory, int mode);
+int weechat_mkdir (const char *directory, int mode);
 ----

 Arguments:
@@ -4436,7 +4436,7 @@ Prototype:

 [source,c]
 ----
-int weechat_mkdir_parents (char *directory, int mode);
+int weechat_mkdir_parents (const char *directory, int mode);
 ----

 Arguments:
@@ -7709,7 +7709,7 @@ void weechat_config_search_with_string (const char *option_name,
                                        struct t_config_file **config_file,
                                        struct t_config_section **section,
                                        struct t_config_option **option,
-                                        char **pos_option_name);
+                                        const char **pos_option_name);
 ----

 Arguments:
@@ -7731,7 +7731,7 @@ C example:
 struct t_config_file *ptr_config_file;
 struct t_config_section *ptr_section;
 struct t_config_option *ptr_option;
-char *option_name;
+const char *option_name;

 weechat_config_search_with_string ("file.section.option",
                                   &ptr_config_file,
@@ -541,7 +541,8 @@ HTTP/1.1 200 OK
            "plugin": "core",
            "name": "weechat"
        },
-        "keys": []
+        "keys": [],
+        "last_read_line_id": -1
    },
    {
        "id": 1709932823423765,
@@ -571,7 +572,8 @@ HTTP/1.1 200 OK
            "tls_version": "TLS1.3",
            "host": "~alice@example.com"
        },
-        "keys": []
+        "keys": [],
+        "last_read_line_id": -1
    },
    {
        "id": 1709932823649069,
@@ -599,7 +601,8 @@ HTTP/1.1 200 OK
            "nick": "alice",
            "host": "~alice@example.com"
        },
-        "keys": []
+        "keys": [],
+        "last_read_line_id": -1
    }
 ]
 ----
@@ -655,7 +658,8 @@ HTTP/1.1 200 OK
            "message": "Plugins loaded: alias, buflist, charset, exec, fifo, fset, guile, irc, javascript, logger, lua, perl, php, python, relay, ruby, script, spell, tcl, trigger, typing, xfer",
            "tags": []
        }
-    ]
+    ],
+    "last_read_line_id": -1
 }
 ----

@@ -702,6 +706,7 @@ HTTP/1.1 200 OK
        "host": "~alice@example.com"
    },
    "keys": [],
+    "last_read_line_id": -1,
    "nicklist_root": {
        "id": 0,
        "parent_group_id": -1,
@@ -900,7 +905,8 @@ HTTP/1.1 200 OK
            "key": "up",
            "command": "/fset -up"
        }
-    ]
+    ],
+    "last_read_line_id": -1
 }
 ----

@@ -1173,6 +1179,51 @@ HTTP/1.1 200 OK
 ]
 ----

+[[resource_scripts]]
+=== Scripts
+
+Return loaded scripts (all languages).
+
+Endpoint:
+
+----
+GET /api/scripts
+----
+
+Request example:
+
+[source,shell]
+----
+curl -L -u 'plain:secret_password' 'https://localhost:9000/api/scripts'
+----
+
+Response:
+
+[source,http]
+----
+HTTP/1.1 200 OK
+----
+
+[source,json]
+----
+[
+    {
+        "name": "highmon.pl",
+        "version": "2.7",
+        "description": "Highlight Monitor",
+        "author": "KenjiE20",
+        "license": "GPL3"
+    },
+    {
+        "name": "go.py",
+        "version": "3.1.1",
+        "description": "Quick jump to buffers",
+        "author": "Sébastien Helleu <flashcode@flashtux.org>",
+        "license": "GPL3"
+    }
+]
+----
+
 [[resource_input]]
 === Input

@@ -1504,6 +1555,7 @@ Body types that can be returned:
 * `nick_group` (object)
 * `nick` (object)
 * `hotlist` (object)
+* `scripts` (array)
 * `ping` (object)

 [TIP]
@@ -4424,7 +4424,7 @@ Prototype :

 [source,c]
 ----
-int weechat_mkdir_home (char *directory, int mode);
+int weechat_mkdir_home (const char *directory, int mode);
 ----

 Paramètres :
@@ -4471,7 +4471,7 @@ Prototype :

 [source,c]
 ----
-int weechat_mkdir (char *directory, int mode);
+int weechat_mkdir (const char *directory, int mode);
 ----

 Paramètres :
@@ -4512,7 +4512,7 @@ Prototype :

 [source,c]
 ----
-int weechat_mkdir_parents (char *directory, int mode);
+int weechat_mkdir_parents (const char *directory, int mode);
 ----

 Paramètres :
@@ -7838,7 +7838,7 @@ void weechat_config_search_with_string (const char *option_name,
                                        struct t_config_file **config_file,
                                        struct t_config_section **section,
                                        struct t_config_option **option,
-                                        char **pos_option_name);
+                                        const char **pos_option_name);
 ----

 Paramètres :
@@ -7861,7 +7861,7 @@ Exemple en C :
 struct t_config_file *ptr_config_file;
 struct t_config_section *ptr_section;
 struct t_config_option *ptr_option;
-char *option_name;
+const char *option_name;

 weechat_config_search_with_string ("fichier.section.option",
                                   &ptr_config_file,
@@ -551,7 +551,8 @@ HTTP/1.1 200 OK
            "plugin": "core",
            "name": "weechat"
        },
-        "keys": []
+        "keys": [],
+        "last_read_line_id": -1
    },
    {
        "id": 1709932823423765,
@@ -580,7 +581,8 @@ HTTP/1.1 200 OK
            "tls_version": "TLS1.3",
            "host": "~alice@example.com"
        },
-        "keys": []
+        "keys": [],
+        "last_read_line_id": -1
    },
    {
        "id": 1709932823649069,
@@ -607,7 +609,8 @@ HTTP/1.1 200 OK
            "nick": "alice",
            "host": "~alice@example.com"
        },
-        "keys": []
+        "keys": [],
+        "last_read_line_id": -1
    }
 ]
 ----
@@ -663,7 +666,8 @@ HTTP/1.1 200 OK
            "message": "Plugins loaded: alias, buflist, charset, exec, fifo, fset, guile, irc, javascript, logger, lua, perl, php, python, relay, ruby, script, spell, tcl, trigger, typing, xfer",
            "tags": []
        }
-    ]
+    ],
+    "last_read_line_id": -1
 }
 ----

@@ -709,6 +713,7 @@ HTTP/1.1 200 OK
        "host": "~alice@example.com"
    },
    "keys": [],
+    "last_read_line_id": -1,
    "nicklist_root": {
        "id": 0,
        "parent_group_id": -1,
@@ -906,7 +911,8 @@ HTTP/1.1 200 OK
            "key": "up",
            "command": "/fset -up"
        }
-    ]
+    ],
+    "last_read_line_id": -1
 }
 ----

@@ -1185,6 +1191,51 @@ HTTP/1.1 200 OK
 ]
 ----

+[[resource_scripts]]
+=== Scripts
+
+Retourner la liste des scripts chargés (tous les langages).
+
+Point de terminaison :
+
+----
+GET /api/scripts
+----
+
+Exemple de requête :
+
+[source,shell]
+----
+curl -L -u 'plain:secret_password' 'https://localhost:9000/api/scripts'
+----
+
+Réponse :
+
+[source,http]
+----
+HTTP/1.1 200 OK
+----
+
+[source,json]
+----
+[
+    {
+        "name": "highmon.pl",
+        "version": "2.7",
+        "description": "Highlight Monitor",
+        "author": "KenjiE20",
+        "license": "GPL3"
+    },
+    {
+        "name": "go.py",
+        "version": "3.1.1",
+        "description": "Quick jump to buffers",
+        "author": "Sébastien Helleu <flashcode@flashtux.org>",
+        "license": "GPL3"
+    }
+]
+----
+
 [[resource_input]]
 === Entrée

@@ -1524,6 +1575,7 @@ Les types de corps qui peuvent être retournés :
 * `nick_group` (objet)
 * `nick` (objet)
 * `hotlist` (objet)
+* `scripts` (tableau)
 * `ping` (objet)

 [TIP]
@@ -4549,7 +4549,7 @@ Prototipo:

 [source,c]
 ----
-int weechat_mkdir_home (char *directory, int mode);
+int weechat_mkdir_home (const char *directory, int mode);
 ----

 Argomenti:
@@ -4597,7 +4597,7 @@ Prototipo:

 [source,c]
 ----
-int weechat_mkdir (char *directory, int mode);
+int weechat_mkdir (const char *directory, int mode);
 ----

 Argomenti:
@@ -4638,7 +4638,7 @@ Prototipo:

 [source,c]
 ----
-int weechat_mkdir_parents (char *directory, int mode);
+int weechat_mkdir_parents (const char *directory, int mode);
 ----

 Argomenti:
@@ -8011,7 +8011,7 @@ void weechat_config_search_with_string (const char *option_name,
                                        struct t_config_file **config_file,
                                        struct t_config_section **section,
                                        struct t_config_option **option,
-                                        char **pos_option_name);
+                                        const char **pos_option_name);
 ----

 Argomenti:
@@ -8034,7 +8034,7 @@ Esempio in C:
 struct t_config_file *ptr_config_file;
 struct t_config_section *ptr_section;
 struct t_config_option *ptr_option;
-char *option_name;
+const char *option_name;

 weechat_config_search_with_string ("file.section.option",
                                   &ptr_config_file,
@@ -4477,7 +4477,7 @@ WeeChat ホームディレクトリの下にディレクトリを作成。

 [source,c]
 ----
-int weechat_mkdir_home (char *directory, int mode);
+int weechat_mkdir_home (const char *directory, int mode);
 ----

 引数:
@@ -4525,7 +4525,7 @@ weechat.mkdir_home("${weechat_cache_dir}/temp", 0755)

 [source,c]
 ----
-int weechat_mkdir (char *directory, int mode);
+int weechat_mkdir (const char *directory, int mode);
 ----

 引数:
@@ -4566,7 +4566,7 @@ weechat.mkdir("/tmp/mydir", 0755)

 [source,c]
 ----
-int weechat_mkdir_parents (char *directory, int mode);
+int weechat_mkdir_parents (const char *directory, int mode);
 ----

 引数:
@@ -7816,7 +7816,7 @@ void weechat_config_search_with_string (const char *option_name,
                                        struct t_config_file **config_file,
                                        struct t_config_section **section,
                                        struct t_config_option **option,
-                                        char **pos_option_name);
+                                        const char **pos_option_name);
 ----

 引数:
@@ -7838,7 +7838,7 @@ C 言語での使用例:
 struct t_config_file *ptr_config_file;
 struct t_config_section *ptr_section;
 struct t_config_option *ptr_option;
-char *option_name;
+const char *option_name;

 weechat_config_search_with_string ("file.section.option",
                                   &ptr_config_file,
@@ -4209,7 +4209,7 @@ _Ажурирано у верзији 3.2._

 [source,c]
 ----
-int weechat_mkdir_home (char *directory, int mode);
+int weechat_mkdir_home (const char *directory, int mode);
 ----

 Аргументи:
@@ -4255,7 +4255,7 @@ weechat.mkdir_home("${weechat_cache_dir}/temp", 0755)

 [source,c]
 ----
-int weechat_mkdir (char *directory, int mode);
+int weechat_mkdir (const char *directory, int mode);
 ----

 Аргументи:
@@ -4296,7 +4296,7 @@ weechat.mkdir("/tmp/mydir", 0755)

 [source,c]
 ----
-int weechat_mkdir_parents (char *directory, int mode);
+int weechat_mkdir_parents (const char *directory, int mode);
 ----

 Аргументи:
@@ -7492,7 +7492,7 @@ void weechat_config_search_with_string (const char *option_name,
                                        struct t_config_file **config_file,
                                        struct t_config_section **section,
                                        struct t_config_option **option,
-                                        char **pos_option_name);
+                                        const char **pos_option_name);
 ----

 Аргументи:
@@ -7510,7 +7510,7 @@ C пример:
 struct t_config_file *ptr_config_file;
 struct t_config_section *ptr_section;
 struct t_config_option *ptr_option;
-char *option_name;
+const char *option_name;

 weechat_config_search_with_string ("file.section.option",
                                   &ptr_config_file,
@@ -543,7 +543,8 @@ HTTP/1.1 200 OK
            "plugin": "core",
            "name": "weechat"
        },
-        "keys": []
+        "keys": [],
+        "last_read_line_id": -1
    },
    {
        "id": 1709932823423765,
@@ -573,7 +574,8 @@ HTTP/1.1 200 OK
            "tls_version": "TLS1.3",
            "host": "~alice@example.com"
        },
-        "keys": []
+        "keys": [],
+        "last_read_line_id": -1
    },
    {
        "id": 1709932823649069,
@@ -601,7 +603,8 @@ HTTP/1.1 200 OK
            "nick": "alice",
            "host": "~alice@example.com"
        },
-        "keys": []
+        "keys": [],
+        "last_read_line_id": -1
    }
 ]
 ----
@@ -657,7 +660,8 @@ HTTP/1.1 200 OK
            "message": "Учитани додаци: alias, buflist, charset, exec, fifo, fset, guile, irc, javascript, logger, lua, perl, php, python, relay, ruby, script, spell, tcl, trigger, typing, xfer",
            "tags": []
        }
-    ]
+    ],
+    "last_read_line_id": -1
 }
 ----

@@ -704,6 +708,7 @@ HTTP/1.1 200 OK
        "host": "~alice@example.com"
    },
    "keys": [],
+    "last_read_line_id": -1,
    "nicklist_root": {
        "id": 0,
        "parent_group_id": -1,
@@ -902,7 +907,8 @@ HTTP/1.1 200 OK
            "key": "up",
            "command": "/fset -up"
        }
-    ]
+    ],
+    "last_read_line_id": -1
 }
 ----

@@ -1175,6 +1181,53 @@ HTTP/1.1 200 OK
 ]
 ----

+// TRANSLATION MISSING
+[[resource_scripts]]
+=== Scripts
+
+// TRANSLATION MISSING
+Return loaded scripts (all languages).
+
+Крајња тачка:
+
+----
+GET /api/scripts
+----
+
+Пример захтева:
+
+[source,shell]
+----
+curl -L -u 'plain:secret_password' 'https://localhost:9000/api/scripts'
+----
+
+Одговор:
+
+[source,http]
+----
+HTTP/1.1 200 OK
+----
+
+[source,json]
+----
+[
+    {
+        "name": "highmon.pl",
+        "version": "2.7",
+        "description": "Highlight Monitor",
+        "author": "KenjiE20",
+        "license": "GPL3"
+    },
+    {
+        "name": "go.py",
+        "version": "3.1.1",
+        "description": "Quick jump to buffers",
+        "author": "Sébastien Helleu <flashcode@flashtux.org>",
+        "license": "GPL3"
+    }
+]
+----
+
 [[resource_input]]
 === Input

@@ -1504,6 +1557,7 @@ GUID `258EAFA5-E914-47DA-95CA-C5AB0DC85B11` (SHA-1 се кодира у base64).
 * `nick_group` (објекат)
 * `nick` (објекат)
 * `hotlist` (објекат)
+* `scripts` (низ)
 * `ping` (објекат)

 [TIP]
@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:01+0200\n"
 "Last-Translator: Ondřej Súkup <mimi.vx@gmail.com>\n"
 "Language-Team: Czech <weechat-dev@nongnu.org>\n"
@@ -16068,6 +16068,10 @@ msgstr "načteny %s skripty:"
 msgid "script name with extension"
 msgstr "seznam skriptů"

+#, fuzzy
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "čárkami oddělený seznam slovníků, které použít pro tento buffer"
+
 #, fuzzy
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr "jméno serveru (zástupný znak \"*\" je povolen) (volitelné)"
@@ -29,8 +29,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
-"PO-Revision-Date: 2026-05-30 14:01+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
+"PO-Revision-Date: 2026-06-09 10:41+0200\n"
 "Last-Translator: Nils Görs <weechatter@arcor.de>\n"
 "Language-Team: German - Germany <weechat-dev@nongnu.org>\n"
 "Language: de\n"
@@ -17510,6 +17510,11 @@ msgstr "1 falls Skript geladen wurde"
 msgid "script name with extension"
 msgstr "Skriptname mit Erweiterung"

+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr ""
+"durch Kommata getrennte Liste von Erweiterungen: Endung mit unterstützen "
+"Sprachen"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "Name des Skriptes, mit Dateierweiterung (Platzhalter \"*\" kann verwendet "
@@ -24,7 +24,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:01+0200\n"
 "Last-Translator: Santiago Forero <santiago@forero.xyz>\n"
 "Language-Team: Spanish - Spain <weechat-dev@nongnu.org>\n"
@@ -16346,6 +16346,11 @@ msgstr "scripts en %s cargados:"
 msgid "script name with extension"
 msgstr "lista de scripts"

+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "lista separada por comas de extensiones de archivo para plugins"
+
 #, fuzzy
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
@@ -23,8 +23,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
-"PO-Revision-Date: 2026-05-30 14:01+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
+"PO-Revision-Date: 2026-06-08 23:14+0200\n"
 "Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
 "Language-Team: French - France <weechat-dev@nongnu.org>\n"
 "Language: fr\n"
@@ -17182,6 +17182,9 @@ msgstr "1 si le script est chargé"
 msgid "script name with extension"
 msgstr "nom du script avec l'extension"

+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "liste de extension:extension_fichier avec les langages supportés"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "nom du script avec extension (le caractère joker \"*\" est autorisé) "
@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-03-08 08:59+0100\n"
 "Last-Translator: Andras Voroskoi <voroskoi@frugalware.org>\n"
 "Language-Team: Hungarian <weechat-dev@nongnu.org>\n"
@@ -15314,6 +15314,9 @@ msgstr "FIFO cső bezárva\n"
 msgid "script name with extension"
 msgstr "Aliaszok listája:\n"

+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr ""
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Esteban I. Ruiz Moreno <exio4.com@gmail.com>\n"
 "Language-Team: Italian <weechat-dev@nongnu.org>\n"
@@ -16432,6 +16432,11 @@ msgstr "script %s caricati:"
 msgid "script name with extension"
 msgstr "elenco degli script"

+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "elenco separato da virgole di estensioni dei nomi file per i plugin"
+
 #, fuzzy
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: AYANOKOUZI, Ryuunosuke <i38w7i3@yahoo.co.jp>\n"
 "Language-Team: Japanese <weechat-dev@nongnu.org>\n"
@@ -16996,6 +16996,11 @@ msgstr "ロードされた %s スクリプト:"
 msgid "script name with extension"
 msgstr "スクリプトの拡張子のリスト"

+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "プラグインのファイル拡張子のコンマ区切りリスト"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "拡張子を含めたスクリプト名 (ワイルドカード \"*\" を使うことができます) (任意)"
@@ -24,7 +24,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Krzysztof Korościk <soltys@soltys.info>\n"
 "Language-Team: Polish <weechat-dev@nongnu.org>\n"
@@ -16747,6 +16747,11 @@ msgstr "1 jeśli skrypt jest załadowany"
 msgid "script name with extension"
 msgstr "nazwa skryptu z rozszerzeniem"

+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "oddzielona przecinkami lista rozszerzeń nazw plików dla wtyczek"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "nazwa skryptu z rozszerzeniem (wildcard \"*\" jest dozwolony) (opcjonalne)\""
@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Vasco Almeida <vascomalmeida@sapo.pt>\n"
 "Language-Team: Portuguese - Portugal <weechat-dev@nongnu.org>\n"
@@ -16869,6 +16869,11 @@ msgstr "scripts %s carregados:"
 msgid "script name with extension"
 msgstr "lista de extensões de script"

+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "lista de extensões de ficheiros separadas por vírgula para os plugins"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "nome do script com extensão (o caráter universal \"*\" é permitido) "
@@ -46,7 +46,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Érico Nogueira <ericonr@disroot.org>\n"
 "Language-Team: Portuguese - Brazil <weechat-dev@nongnu.org>\n"
@@ -15838,6 +15838,10 @@ msgstr "scripts %s carregados:"
 msgid "script name with extension"
 msgstr "list de scripts"

+#, fuzzy
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "lista de dicionários (separados por vírgula) para uso neste buffer"
+
 #, fuzzy
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-03-08 08:59+0100\n"
 "Last-Translator: Aleksey V Zapparov AKA ixti <ixti@member.fsf.org>\n"
 "Language-Team: Russian <weechat-dev@nongnu.org>\n"
@@ -15367,6 +15367,9 @@ msgstr "FIFO pipe закрыт\n"
 msgid "script name with extension"
 msgstr "Список сокращений:\n"

+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr ""
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Ivan Pešić <ivan.pesic@gmail.com>\n"
 "Language-Team: Serbian <weechat-dev@nongnu.org>\n"
@@ -16695,6 +16695,11 @@ msgstr "1 ако је скрипта учитана"
 msgid "script name with extension"
 msgstr "име скрипте са екстензијом"

+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "листа екстензија имена фајлова за додатке раздвојених запетама"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr "име скрипте са екстензијом (дозвољен је џокер „*”) (није обавезно)"

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Emir SARI <emir_sari@icloud.com>\n"
 "Language-Team: Turkish <weechat-dev@nongnu.org>\n"
@@ -17120,6 +17120,11 @@ msgstr "Hiçbir betik yüklenmedi"
 msgid "script name with extension"
 msgstr "betik uzantılarının listesi"

+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "eklentiler için dosya adı uzantılarının virgülle ayrılmış listesi"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr "betik adı, uzantı ile (\"*\" jokerine izin verilir) (isteğe bağlı)"

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2014-08-16 10:27+0200\n"
 "Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -14018,6 +14018,9 @@ msgstr ""
 msgid "script name with extension"
 msgstr ""

+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr ""
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""

@@ -705,7 +705,8 @@ config_file_new_option (struct t_config_file *config_file,
 {
    struct t_config_option *new_option;
    int var_type, int_value, argc, i, index_value, number;
-    char *pos, *option_name, *parent_name;
+    const char *pos;
+    char *option_name, *parent_name;

    new_option = NULL;
    option_name = NULL;
@@ -1095,12 +1096,13 @@ config_file_search_with_string (const char *option_name,
                                struct t_config_file **config_file,
                                struct t_config_section **section,
                                struct t_config_option **option,
-                                char **pos_option_name)
+                                const char **pos_option_name)
 {
    struct t_config_file *ptr_config;
    struct t_config_section *ptr_section;
    struct t_config_option *ptr_option;
-    char *file_name, *pos_section, *section_name, *pos_option;
+    const char *pos_section, *pos_option;
+    char *file_name, *section_name;

    if (config_file)
        *config_file = NULL;
@@ -2553,7 +2555,7 @@ config_file_option_set_with_string (const char *option_name, const char *value)
    struct t_config_file *ptr_config;
    struct t_config_section *ptr_section;
    struct t_config_option *ptr_option;
-    char *pos_option;
+    const char *pos_option;

    rc = WEECHAT_CONFIG_OPTION_SET_OPTION_NOT_FOUND;

@@ -286,7 +286,7 @@ extern void config_file_search_with_string (const char *option_name,
                                            struct t_config_file **config_file,
                                            struct t_config_section **section,
                                            struct t_config_option **option,
-                                            char **pos_option_name);
+                                            const char **pos_option_name);
 extern int config_file_string_to_boolean (const char *text);
 extern int config_file_option_reset (struct t_config_option *option,
                                     int run_callback);
@@ -1709,7 +1709,7 @@ config_weechat_update_cb (const void *pointer, void *data,
                          int version_read,
                          struct t_hashtable *data_read)
 {
-    const char *ptr_config, *ptr_section, *ptr_option, *ptr_value;
+    const char *ptr_config, *ptr_section, *ptr_option, *ptr_value, *pos_option;
    char *new_commands[][2] = {
        /* old command, new command */
        { "/input jump_smart", "/buffer jump smart" },
@@ -1739,7 +1739,7 @@ config_weechat_update_cb (const void *pointer, void *data,
        { "number_desc" "-buffer.number" },
        { NULL, NULL },
    };
-    char *new_option, *new_value, *pos_option;
+    char *new_option, *new_value;
    int changes, i;

    /* make C compiler happy */
@@ -2262,7 +2262,8 @@ config_weechat_proxy_read_cb (const void *pointer, void *data,
                              struct t_config_section *section,
                              const char *option_name, const char *value)
 {
-    char *pos_option, *proxy_name;
+    const char *pos_option;
+    char *proxy_name;
    struct t_proxy *ptr_temp_proxy;
    int index_option;

@@ -2341,7 +2342,8 @@ config_weechat_bar_read_cb (const void *pointer, void *data,
                            struct t_config_section *section,
                            const char *option_name, const char *value)
 {
-    char *pos_option, *bar_name;
+    const char *pos_option;
+    char *bar_name;
    struct t_gui_bar *ptr_temp_bar;
    int index_option;

@@ -2421,7 +2423,8 @@ config_weechat_custom_bar_item_read_cb (const void *pointer, void *data,
                                        struct t_config_section *section,
                                        const char *option_name, const char *value)
 {
-    char *pos_option, *item_name;
+    const char *pos_option;
+    char *item_name;
    struct t_gui_bar_item_custom *ptr_temp_item;
    int index_option;

@@ -2512,7 +2515,8 @@ config_weechat_layout_read_cb (const void *pointer, void *data,
                               const char *option_name, const char *value)
 {
    int argc, force_current_layout, number1, number2, number3, number4;
-    char **argv, *pos, *layout_name;
+    const char *pos;
+    char **argv, *layout_name;
    const char *ptr_option_name;
    struct t_gui_layout *ptr_layout;
    struct t_gui_layout_window *parent;
@@ -508,10 +508,11 @@ eval_string_repeat (const char *text)
 char *
 eval_string_split (const char *text)
 {
-    char *pos, *pos2, *pos3, *str_number, *separators, **items, *value;
+    const char *pos, *pos2, *pos3;
+    char *str_number, *separators, **items, *value;
    char str_value[32], *str_flags, **list_flags, *strip_items, **ptr_flag;
-    int num_items, count_items, random_item, flags;
-    long number, max_items;
+    int num_items, count_items, random_item, flags, max_items;
+    long number;

    str_number = NULL;
    separators = NULL;
@@ -582,7 +583,7 @@ eval_string_split (const char *text)
            }
            else if (strncmp (*ptr_flag, "max_items=", 10) == 0)
            {
-                if (!util_parse_long (*ptr_flag + 10, 10, &max_items)
+                if (!util_parse_int (*ptr_flag + 10, 10, &max_items)
                    || (max_items < 0))
                    goto end;
            }
@@ -655,7 +656,8 @@ end:
 char *
 eval_string_split_shell (const char *text)
 {
-    char *pos, *str_number, **items, *value, str_value[32];
+    const char *pos;
+    char *str_number, **items, *value, str_value[32];
    int num_items, count_items, random_item;
    long number;

@@ -1046,7 +1048,8 @@ eval_string_if (const char *text, struct t_eval_context *eval_context)
 char *
 eval_string_random (const char *text)
 {
-    char *pos, *tmp, result[128];
+    const char *pos;
+    char *tmp, result[128];
    long long min_number, max_number;

    if (!text || !text[0])
@@ -1112,7 +1115,8 @@ eval_string_translate (const char *text)
 void
 eval_string_define (const char *text, struct t_eval_context *eval_context)
 {
-    char *pos, *name;
+    const char *pos;
+    char *name;

    pos = strchr (text, ',');
    if (!pos)
@@ -1139,7 +1143,8 @@ eval_hdata_count (const char *text, struct t_eval_context *eval_context)
    struct t_hdata *hdata;
    unsigned long ptr_value;
    void *pointer;
-    char *pos1, *pos2, *value, *hdata_name, *pointer_name, str_count[64];
+    const char *pos1, *pos2;
+    char *value, *hdata_name, *pointer_name, str_count[64];
    int rc, count;

    value = NULL;
@@ -1211,8 +1216,8 @@ char *
 eval_hdata_get_value (struct t_hdata *hdata, void *pointer, const char *path,
                      struct t_eval_context *eval_context)
 {
-    char *value, *var_name, str_value[128], *pos, *property;
-    const char *ptr_value, *hdata_name, *ptr_var_name, *pos_open_paren;
+    char *value, *var_name, str_value[128], *property;
+    const char *ptr_value, *hdata_name, *ptr_var_name, *pos, *pos_open_paren;
    int type, debug_id;
    struct t_hashtable *hashtable;

@@ -1539,8 +1544,8 @@ eval_syntax_highlight_add_markers (const char *prefix, const char *text,
 char *
 eval_syntax_highlight_colorize (const char *value)
 {
-    const char *ptr_value;
-    char **result, *pos;
+    const char *ptr_value, *pos;
+    char **result;
    int color;

    if (!value)
@@ -688,7 +688,8 @@ hdata_count (struct t_hdata *hdata, void *pointer)
 void
 hdata_get_index_and_name (const char *name, int *index, const char **ptr_name)
 {
-    char *pos, *str_index;
+    const char *pos;
+    char *str_index;
    int number;

    if (index)
@@ -242,8 +242,8 @@ int
 input_data (struct t_gui_buffer *buffer, const char *data,
            const char *commands_allowed, int split_newline, int user_data)
 {
-    char *pos, str_buffer[128], *new_data, *buffer_full_name;
-    const char *ptr_data, *ptr_data_for_buffer;
+    const char *ptr_data_for_buffer;
+    char *pos, str_buffer[128], *new_data, *buffer_full_name, *ptr_data;
    int first_command, rc;

    if (!buffer || !gui_buffer_valid (buffer) || !data)
@@ -272,8 +272,13 @@ input_data (struct t_gui_buffer *buffer, const char *data,
    if (data[0] && new_data && !new_data[0])
        goto end;

+    if (!new_data)
+        new_data = strdup (data);
+    if (!new_data)
+        goto end;
+
    first_command = 1;
-    ptr_data = (new_data) ? new_data : data;
+    ptr_data = new_data;
    while (ptr_data)
    {
        /*
@@ -582,7 +582,13 @@ network_pass_socks5proxy (struct t_proxy *proxy, int sock, const char *address,
                          int port)
 {
    struct t_network_socks5 socks5;
-    unsigned char buffer[288];
+    /*
+     * buffer must be large enough for the username/password authentication
+     * request, which is the longest message sent/received here; according to
+     * RFC 1929 it is: version (1) + username length (1) + username (max 255)
+     * + password length (1) + password (max 255)
+     */
+    unsigned char buffer[2 + 255 + 1 + 255];
    int username_len, password_len, addr_len, addr_buffer_len;
    unsigned char *addr_buffer;
    char *username, *password;
@@ -631,6 +637,18 @@ network_pass_socks5proxy (struct t_proxy *proxy, int sock, const char *address,
        username_len = strlen (username);
        password_len = strlen (password);

+        /*
+         * username and password length are each stored on a single byte
+         * (RFC 1929), so they cannot exceed 255 bytes: reject longer values,
+         * otherwise the memcpy calls below would overflow the buffer
+         */
+        if ((username_len > 255) || (password_len > 255))
+        {
+            free (username);
+            free (password);
+            return 0;
+        }
+
        /* make username/password buffer */
        buffer[0] = 1;
        buffer[1] = (unsigned char) username_len;
@@ -1686,9 +1686,8 @@ string_mask_to_regex (const char *mask)
 const char *
 string_regex_flags (const char *regex, int default_flags, int *flags)
 {
-    const char *ptr_regex, *ptr_flags;
+    const char *ptr_regex, *ptr_flags, *pos;
    int set_flag, flag;
-    char *pos;

    if (flags)
        *flags = default_flags;
@@ -1966,6 +1965,9 @@ string_replace (const char *string, const char *search, const char *replace)
    if (!string || !search || !replace)
        return NULL;

+    if (!search[0])
+        return strdup (string);
+
    length1 = strlen (search);
    length2 = strlen (replace);

@@ -2963,8 +2965,9 @@ char **
 string_split_command (const char *command, char separator)
 {
    int nb_substr, arr_idx, str_idx, type;
+    const char *p;
    char **array, **array2;
-    char *buffer, *p;
+    char *buffer;
    const char *ptr;

    if (!command || !command[0])
@@ -4135,8 +4138,7 @@ string_is_command_char (const char *string)
 const char *
 string_input_for_buffer (const char *string)
 {
-    char *pos_slash, *pos_space, *pos_newline;
-    const char *next_char;
+    const char *pos_slash, *pos_space, *pos_newline, *next_char;

    if (!string)
        return NULL;
@@ -4473,7 +4475,8 @@ string_get_priority_and_name (const char *string,
                              int *priority, const char **name,
                              int default_priority)
 {
-    char *pos, *str_priority;
+    const char *pos;
+    char *str_priority;
    int number;

    if (priority)
@@ -416,8 +416,8 @@ util_strftimeval (char *string, int max, const char *format, struct timeval *tv)
 int
 util_parse_time (const char *datetime, struct timeval *tv)
 {
-    char *string, *pos, *pos2, *pos_colon, *pos_hyphen, *pos_dot;
-    char str_usec[16], str_date[128];
+    const char *pos_colon, *pos_hyphen, *pos_dot;
+    char *pos, *pos2, *string, str_usec[16], str_date[128];
    struct tm tm_date, tm_date_gm, tm_date_local, *local_time;
    time_t time_now, time_gm, time_local;
    long long value;
@@ -597,8 +597,8 @@ hook_command_exec (struct t_gui_buffer *buffer, int any_plugin,
    struct t_hook *hook_plugin, *hook_other_plugin, *hook_other_plugin2;
    struct t_hook *hook_incomplete_command;
    struct t_hook_exec_cb hook_exec_cb;
-    char **argv, **argv_eol, *command_name, *pos;
-    const char *ptr_string;
+    char **argv, **argv_eol, *command_name;
+    const char *ptr_string, *pos;
    int argc, rc, length_command_name, allow_incomplete_commands;
    int count_other_plugin, count_incomplete_commands, flags;

@@ -132,7 +132,8 @@ void
 hook_signal_extract_flags (const char *signal, const char **ptr_signal,
                           int *stop_on_error, int *ignore_eat)
 {
-    char *pos, *str_flags, **flags;
+    const char *pos;
+    char *str_flags, **flags;
    int i, num_flags;

    if (!signal || !ptr_signal || !stop_on_error || !ignore_eat)
@@ -47,7 +47,7 @@ void
 daemonize (void)
 {
    pid_t pid;
-    int fd, i;
+    int fd, i, rc;

    printf ("%s ", _("Running WeeChat in background..."));

@@ -77,8 +77,9 @@ daemonize (void)
        close (i);
    }
    fd = open ("/dev/null", O_RDWR);
-    (void) dup (fd);
-    (void) dup (fd);
+    rc = dup (fd);
+    rc = dup (fd);
+    (void) rc;
 }

 /*
@@ -138,7 +138,8 @@ gui_bar_item_custom_search (const char *item_name)
 struct t_gui_bar_item_custom *
 gui_bar_item_custom_search_with_option_name (const char *option_name)
 {
-    char *item_name, *pos_option;
+    const char *pos_option;
+    char *item_name;
    struct t_gui_bar_item_custom *ptr_item;

    if (!option_name)
@@ -1880,9 +1880,9 @@ gui_bar_item_buffer_nicklist_cb (const void *pointer, void *data,
                {
                    if (strchr (ptr_nick->prefix_color, '.'))
                    {
-                        config_file_search_with_string (ptr_nick->prefix_color,
-                                                        NULL, NULL, &ptr_option,
-                                                            NULL);
+                        config_file_search_with_string (
+                            ptr_nick->prefix_color,
+                            NULL, NULL, &ptr_option, NULL);
                        if (ptr_option)
                        {
                            string_dyn_concat (
@@ -1907,9 +1907,9 @@ gui_bar_item_buffer_nicklist_cb (const void *pointer, void *data,
                {
                    if (strchr (ptr_nick->color, '.'))
                    {
-                        config_file_search_with_string (ptr_nick->color,
-                                                        NULL, NULL, &ptr_option,
-                                                        NULL);
+                        config_file_search_with_string (
+                            ptr_nick->color,
+                            NULL, NULL, &ptr_option, NULL);
                        if (ptr_option)
                        {
                            string_dyn_concat (
@@ -1940,9 +1940,9 @@ gui_bar_item_buffer_nicklist_cb (const void *pointer, void *data,
                {
                    if (strchr (ptr_group->color, '.'))
                    {
-                        config_file_search_with_string (ptr_group->color,
-                                                        NULL, NULL, &ptr_option,
-                                                        NULL);
+                        config_file_search_with_string (
+                            ptr_group->color,
+                            NULL, NULL, &ptr_option, NULL);
                        if (ptr_option)
                        {
                            string_dyn_concat (
@@ -515,7 +515,8 @@ gui_bar_search (const char *name)
 struct t_gui_bar *
 gui_bar_search_with_option_name (const char *option_name)
 {
-    char *bar_name, *pos_option;
+    const char *pos_option;
+    char *bar_name;
    struct t_gui_bar *ptr_bar;

    if (!option_name)
@@ -118,8 +118,8 @@ gui_chat_init (void)
 void
 gui_chat_prefix_build (void)
 {
-    const char *ptr_prefix;
-    char prefix[512], *pos_color;
+    const char *ptr_prefix, *pos_color;
+    char prefix[512];
    int prefix_color[GUI_CHAT_NUM_PREFIXES] =
        { GUI_COLOR_CHAT_PREFIX_ERROR, GUI_COLOR_CHAT_PREFIX_NETWORK,
          GUI_COLOR_CHAT_PREFIX_ACTION, GUI_COLOR_CHAT_PREFIX_JOIN,
@@ -170,8 +170,7 @@ gui_color_search_config (const char *color_name)
    /* search in any configuration file (example: "irc.color.message_quit") */
    if (strchr (color_name, '.'))
    {
-        config_file_search_with_string (color_name, NULL, NULL, &ptr_option,
-                                        NULL);
+        config_file_search_with_string (color_name, NULL, NULL, &ptr_option, NULL);
        if (ptr_option)
            return gui_color_from_option (ptr_option);
    }
@@ -255,8 +254,8 @@ gui_color_get_custom (const char *color_name)
    static char color[32][96];
    static int index_color = 0;
    char color_fg[32], color_bg[32];
-    char *pos_delim, *str_fg, *pos_bg, *error, *color_attr;
-    const char *ptr_color_name;
+    char *str_fg, *error, *color_attr;
+    const char *ptr_color_name, *pos_delim, *pos_bg;

    /* attribute or other color name (GUI dependent) */
    index_color = (index_color + 1) % 32;
@@ -366,8 +366,8 @@ gui_filter_new (int enabled, const char *name, const char *buffer_name,
 {
    struct t_gui_filter *new_filter;
    regex_t *regex1, *regex2;
-    char *pos_tab, *regex_prefix, buf[512], str_error[1024];
-    const char *ptr_start_regex, *pos_regex_message;
+    char *regex_prefix, buf[512], str_error[1024];
+    const char *ptr_start_regex, *pos_regex_message, *pos_tab;
    int rc;

    if (!name || !buffer_name || !tags || !regex)
@@ -1076,7 +1076,7 @@ gui_key_set_area_type_name (const char *area,
                            int *area_type, char **area_name)
 {
    int focus, length;
-    char *pos_end;
+    const char *pos_end;

    for (focus = 0; focus < GUI_KEY_NUM_FOCUS; focus++)
    {
@@ -2925,7 +2925,8 @@ void
 irc_command_join_server (struct t_irc_server *server, const char *arguments,
                         int manual_join, int noswitch)
 {
-    char *new_args, **channels, **keys, *pos_space, *pos_keys, *pos_channel;
+    const char *pos_space, *pos_keys;
+    char *new_args, **channels, **keys, *pos_channel;
    char *channel_name_lower;
    int i, num_channels, num_keys, length;
    time_t time_now;
@@ -470,7 +470,7 @@ irc_completion_modelist_masks_cb (const void *pointer, void *data,
                                  struct t_gui_buffer *buffer,
                                  struct t_gui_completion *completion)
 {
-    char *pos;
+    const char *pos;
    struct t_irc_modelist *ptr_modelist;
    struct t_irc_modelist_item *ptr_item;

@@ -512,7 +512,8 @@ irc_completion_modelist_numbers_cb (const void *pointer, void *data,
                                    struct t_gui_buffer *buffer,
                                    struct t_gui_completion *completion)
 {
-    char *pos, str_number[32];
+    const char *pos;
+    char str_number[32];
    struct t_irc_modelist *ptr_modelist;
    struct t_irc_modelist_item *ptr_item;

@@ -201,7 +201,8 @@ struct t_irc_server *
 irc_config_get_server_from_option_name (const char *name)
 {
    struct t_irc_server *ptr_server;
-    char *pos_option, *server_name;
+    const char *pos_option;
+    char *server_name;

    ptr_server = NULL;

@@ -274,7 +275,7 @@ irc_config_compute_nick_colors (void)
 int
 irc_config_display_channel_modes_arguments (const char *modes)
 {
-    char *pos_space, *pos;
+    const char *pos_space, *pos;
    const char *ptr_mode;

    pos_space = strchr (modes, ' ');
@@ -2811,7 +2812,8 @@ irc_config_server_read_cb (const void *pointer, void *data,
 {
    struct t_irc_server *ptr_server;
    int index_option, rc, i;
-    char *pos_option, *server_name;
+    const char *pos_option;
+    char *server_name;

    /* make C compiler happy */
    (void) pointer;
@@ -2940,9 +2942,9 @@ irc_config_update_cb (const void *pointer, void *data,
                      int version_read,
                      struct t_hashtable *data_read)
 {
-    const char *ptr_config, *ptr_section, *ptr_option, *ptr_value;
+    const char *ptr_config, *ptr_section, *ptr_option, *ptr_value, *pos_option;
    const char *option_autojoin_delay = "autojoin_delay";
-    char *new_option, *pos_option, *new_value;
+    char *new_option, *pos_new_option, *new_value;
    int changes, length;

    /* make C compiler happy */
@@ -2997,11 +2999,11 @@ irc_config_update_cb (const void *pointer, void *data,
                new_option = strdup (ptr_option);
                if (new_option)
                {
-                    pos_option = strrchr (new_option, '.');
-                    if (pos_option)
+                    pos_new_option = strrchr (new_option, '.');
+                    if (pos_new_option)
                    {
-                        pos_option++;
-                        memcpy (pos_option, "tls", 3);
+                        pos_new_option++;
+                        memcpy (pos_new_option, "tls", 3);
                        weechat_printf (
                            NULL,
                            _("IRC option renamed: \"irc.%s.%s\" => \"irc.%s.%s\""),
@@ -857,7 +857,7 @@ irc_ctcp_recv_dcc (struct t_irc_protocol_ctxt *ctxt, const char *arguments)
             * double-quote
             */
            pos = strrchr (pos_file, '"');
-            if (!pos || (pos == pos_file))
+            if (!pos || (pos == pos_file) || !pos[1])
            {
                weechat_printf (
                    ctxt->server->buffer,
@@ -1032,7 +1032,7 @@ irc_ctcp_recv_dcc (struct t_irc_protocol_ctxt *ctxt, const char *arguments)
             * double-quote
             */
            pos = strrchr (pos_file, '"');
-            if (!pos || (pos == pos_file))
+            if (!pos || (pos == pos_file) || !pos[1])
            {
                weechat_printf (
                    ctxt->server->buffer,
@@ -1176,7 +1176,7 @@ irc_ctcp_recv_dcc (struct t_irc_protocol_ctxt *ctxt, const char *arguments)
             * double-quote
             */
            pos = strrchr (pos_file, '"');
-            if (!pos || (pos == pos_file))
+            if (!pos || (pos == pos_file) || !pos[1])
            {
                weechat_printf (
                    ctxt->server->buffer,
@@ -67,8 +67,8 @@ irc_info_info_irc_is_channel_cb (const void *pointer, void *data,
                                 const char *info_name,
                                 const char *arguments)
 {
-    char *pos_comma, *server;
-    const char *pos_channel;
+    char *server;
+    const char *pos_channel, *pos_comma;
    struct t_irc_server *ptr_server;

    /* make C compiler happy */
@@ -106,8 +106,8 @@ irc_info_info_irc_is_nick_cb (const void *pointer, void *data,
                              const char *info_name,
                              const char *arguments)
 {
-    char *pos_comma, *server;
-    const char *pos_nick;
+    char *server;
+    const char *pos_nick, *pos_comma;
    struct t_irc_server *ptr_server;

    /* make C compiler happy */
@@ -233,8 +233,8 @@ irc_info_info_irc_buffer_cb (const void *pointer, void *data,
                             const char *info_name,
                             const char *arguments)
 {
-    char *pos_comma, *pos_comma2, *server, *channel, *host;
-    const char *nick;
+    char *server, *channel, *host;
+    const char *nick, *pos_comma, *pos_comma2;
    struct t_irc_server *ptr_server;
    struct t_irc_channel *ptr_channel;

@@ -332,8 +332,8 @@ irc_info_info_irc_server_isupport_cb (const void *pointer, void *data,
                                      const char *info_name,
                                      const char *arguments)
 {
-    char *pos_comma, *server;
-    const char *isupport_value;
+    char *server;
+    const char *isupport_value, *pos_comma;
    struct t_irc_server *ptr_server;

    /* make C compiler happy */
@@ -373,8 +373,8 @@ irc_info_info_irc_server_isupport_value_cb (const void *pointer, void *data,
                                            const char *info_name,
                                            const char *arguments)
 {
-    char *pos_comma, *server;
-    const char *isupport_value;
+    char *server;
+    const char *isupport_value, *pos_comma;
    struct t_irc_server *ptr_server;

    /* make C compiler happy */
@@ -414,7 +414,8 @@ irc_info_info_irc_server_cap_cb (const void *pointer, void *data,
                                 const char *info_name,
                                 const char *arguments)
 {
-    char *pos_comma, *server;
+    char *server;
+    const char *pos_comma;
    int has_cap;
    struct t_irc_server *ptr_server;

@@ -455,8 +456,8 @@ irc_info_info_irc_server_cap_value_cb (const void *pointer, void *data,
                                       const char *info_name,
                                       const char *arguments)
 {
-    char *pos_comma, *server;
-    const char *cap_value;
+    char *server;
+    const char *cap_value, *pos_comma;
    struct t_irc_server *ptr_server;

    /* make C compiler happy */
@@ -496,8 +497,8 @@ irc_info_info_irc_is_message_ignored_cb (const void *pointer, void *data,
                                         const char *info_name,
                                         const char *arguments)
 {
-    char *pos_comma, *server;
-    const char *pos_message;
+    char *server;
+    const char *pos_message, *pos_comma;
    struct t_irc_server *ptr_server;

    /* make C compiler happy */
@@ -457,7 +457,7 @@ irc_input_send_cb (const void *pointer, void *data,
                   const char *type_data, void *signal_data)
 {
    const char *ptr_string, *ptr_message;
-    char *pos_semicol1, *pos_semicol2, *pos_semicol3, *pos_semicol4;
+    const char *pos_semicol1, *pos_semicol2, *pos_semicol3, *pos_semicol4;
    char *server, *channel, *options, *tags, *data_with_colors, **list_options;
    int i, num_options, flags, force_user_message;
    struct t_irc_server *ptr_server;
@@ -707,8 +707,8 @@ const char *
 irc_message_get_nick_from_host (const char *host)
 {
    static char nick[128];
-    char host2[128], *pos_space, *pos;
-    const char *ptr_host;
+    char host2[128];
+    const char *ptr_host, *pos_space, *pos;

    if (!host)
        return NULL;
@@ -756,8 +756,8 @@ const char *
 irc_message_get_address_from_host (const char *host)
 {
    static char address[256];
-    char host2[256], *pos_space, *pos;
-    const char *ptr_host;
+    char host2[256];
+    const char *ptr_host, *pos_space, *pos;

    if (!host)
        return NULL;
@@ -1182,8 +1182,9 @@ irc_message_split_join (struct t_irc_message_split_context *context,
 {
    int channels_count, keys_count, length, length_no_channel;
    int length_to_add, index_channel;
-    char **channels, **keys, *pos, *str;
+    char **channels, **keys, *str;
    char msg_to_send[16384], keys_to_add[16384];
+    const char *pos;

    max_length -= 2;  /* by default: 512 - 2 = 510 bytes */

@@ -1510,7 +1511,7 @@ irc_message_split_privmsg_notice (struct t_irc_message_split_context *context,
 int
 irc_message_split_005 (struct t_irc_message_split_context *context,
                       const char *tags, const char *host, const char *command,
-                       const char *target, const char *arguments,
+                       const char *target, char *arguments,
                       int max_length)
 {
    char *pos, suffix[4096];
@@ -1570,7 +1571,8 @@ irc_message_split (struct t_irc_server *server, const char *message)
 {
    struct t_irc_message_split_context split_context;
    char **argv, **argv_eol, *tags, *host, *command, *arguments, target[4096];
-    char *pos, monitor_action[3];
+    char monitor_action[3];
+    const char *pos;
    int split_ok, split_privmsg, argc, index_args, max_length_nick;
    int max_length_user, max_length_host, max_length_nick_user_host;
    int split_msg_max_length, multiline, multiline_max_bytes;
@@ -104,8 +104,8 @@ irc_mode_get_arguments_colors (const char *arguments)
 char
 irc_mode_get_chanmode_type (struct t_irc_server *server, char chanmode)
 {
-    char chanmode_type, *pos;
-    const char *chanmodes, *ptr_chanmodes;
+    char chanmode_type;
+    const char *chanmodes, *ptr_chanmodes, *pos;

    /*
     * assume it is type 'B' if mode is in prefix
@@ -785,9 +785,8 @@ int
 irc_notify_hsignal_cb (const void *pointer, void *data, const char *signal,
                       struct t_hashtable *hashtable)
 {
-    const char *error, *server, *pattern, *command, *output;
-    char **messages, **nicks_sent, **nicks_recv, *irc_cmd, *arguments;
-    char *ptr_args, *pos;
+    const char *error, *server, *pattern, *command, *output, *ptr_args;
+    char **messages, **nicks_sent, **nicks_recv, *irc_cmd, *arguments, *pos;
    int i, j, num_messages, num_nicks_sent, num_nicks_recv, nick_was_sent;
    int away_message_updated, no_such_nick;
    struct t_irc_server *ptr_server;
@@ -2499,8 +2499,8 @@ IRC_PROTOCOL_CALLBACK(note)

 IRC_PROTOCOL_CALLBACK(notice)
 {
-    char *notice_args, *pos, end_char, *channel, str_tags[1024];
-    const char *pos_target, *pos_args, *nick_address;
+    char *notice_args, end_char, *channel, str_tags[1024];
+    const char *pos, *pos_target, *pos_args, *nick_address;
    struct t_irc_channel *ptr_channel;
    struct t_irc_nick *ptr_nick;
    int notify_private, is_channel, is_channel_orig, display_host;
@@ -4164,16 +4164,25 @@ IRC_PROTOCOL_CALLBACK(005)
        if (ctxt->server->isupport)
        {
            length_isupport = strlen (ctxt->server->isupport);
-            isupport2 = realloc (ctxt->server->isupport,
-                                 length_isupport +  /* existing */
-                                 1 +  /* space */
-                                 length +  /* new */
-                                 1);
-            if (isupport2)
+            /*
+             * limit the size of the accumulated ISUPPORT data: once the
+             * maximum is reached, ignore the extra data (protection against a
+             * server flooding "005" messages, which would consume all the
+             * memory)
+             */
+            if (length_isupport + 1 + length < IRC_SERVER_ISUPPORT_MAX_LENGTH)
            {
-                ctxt->server->isupport = isupport2;
-                strcat (ctxt->server->isupport, " ");
-                strcat (ctxt->server->isupport, str_info);
+                isupport2 = realloc (ctxt->server->isupport,
+                                     length_isupport +  /* existing */
+                                     1 +  /* space */
+                                     length +  /* new */
+                                     1);
+                if (isupport2)
+                {
+                    ctxt->server->isupport = isupport2;
+                    strcat (ctxt->server->isupport, " ");
+                    strcat (ctxt->server->isupport, str_info);
+                }
            }
        }
        else
@@ -7912,12 +7921,11 @@ irc_protocol_recv_command (struct t_irc_server *server,
                           int ignore_batch_tag)
 {
    int i, cmd_found, return_code, ignored;
-    char *pos_space, *tags;
    struct t_irc_channel *ptr_channel;
    t_irc_recv_func *cmd_recv_func;
    const char *ptr_msg_after_tags, *ptr_batch_ref, *ptr_tag_time;
-    const char *nick1, *address1, *host1;
-    char *host, *host_no_color;
+    const char *pos_space, *nick1, *address1, *host1;
+    char *tags, *host, *host_no_color, *pos_space_host;
    struct t_irc_protocol_ctxt ctxt;
    struct timeval tv;

@@ -8189,9 +8197,9 @@ irc_protocol_recv_command (struct t_irc_server *server,
    host = (host1) ? strdup (host1) : NULL;
    if (host)
    {
-        pos_space = strchr (host, ' ');
-        if (pos_space)
-            pos_space[0] = '\0';
+        pos_space_host = strchr (host, ' ');
+        if (pos_space_host)
+            pos_space_host[0] = '\0';
    }
    host_no_color = (host) ? irc_color_decode (host, 0) : NULL;
    ctxt.host = (host) ?
@@ -616,7 +616,7 @@ void
 irc_redirect_init_command (struct t_irc_redirect *redirect,
                           const char *command)
 {
-    char *pos;
+    const char *pos;

    if (!redirect)
        return;
@@ -588,7 +588,7 @@ irc_server_sasl_enabled (struct t_irc_server *server)
 char *
 irc_server_get_name_without_port (const char *name)
 {
-    char *pos;
+    const char *pos;

    if (!name)
        return NULL;
@@ -1134,7 +1134,7 @@ void
 irc_server_set_prefix_modes_chars (struct t_irc_server *server,
                                   const char *prefix)
 {
-    char *pos;
+    const char *pos;
    int i, old_length_chars, length_modes, length_chars;

    if (!server || !prefix)
@@ -1379,8 +1379,7 @@ irc_server_get_prefix_chars (struct t_irc_server *server)
 int
 irc_server_get_prefix_mode_index (struct t_irc_server *server, char mode)
 {
-    const char *prefix_modes;
-    char *pos;
+    const char *prefix_modes, *pos;

    if (server)
    {
@@ -1405,8 +1404,7 @@ int
 irc_server_get_prefix_char_index (struct t_irc_server *server,
                                  char prefix_char)
 {
-    const char *prefix_chars;
-    char *pos;
+    const char *prefix_chars, *pos;

    if (server)
    {
@@ -2443,8 +2441,8 @@ irc_server_copy (struct t_irc_server *server, const char *new_name)
 {
    struct t_irc_server *new_server;
    struct t_infolist *infolist;
-    char *mask, *pos;
-    const char *option_name;
+    const char *option_name, *pos;
+    char *mask;
    int index_option;

    /* check if another server exists with this name */
@@ -2502,9 +2500,9 @@ irc_server_copy (struct t_irc_server *server, const char *new_name)
 int
 irc_server_rename (struct t_irc_server *server, const char *new_name)
 {
-    char *mask, *pos_option, *new_option_name, charset_modifier[1024];
+    char *mask, *new_option_name, charset_modifier[1024];
    char *buffer_name;
-    const char *option_name;
+    const char *option_name, *pos_option;
    struct t_infolist *infolist;
    struct t_config_option *ptr_option;
    struct t_irc_channel *ptr_channel;
@@ -2999,8 +2997,8 @@ irc_server_send_one_msg (struct t_irc_server *server, int flags,
                         const char *tags)
 {
    static char buffer[4096];
-    const char *ptr_msg, *ptr_chan_nick;
-    char *new_msg, *pos, *tags_to_send, *msg_encoded;
+    const char *ptr_chan_nick;
+    char *new_msg, *ptr_msg, *pos, *tags_to_send, *msg_encoded;
    char str_modifier[128], modifier_data[1024];
    int first_message, queue_msg, pos_channel, pos_text, pos_encode;
    struct t_irc_redirect *ptr_redirect;
@@ -3013,150 +3011,148 @@ irc_server_send_one_msg (struct t_irc_server *server, int flags,
                                          server->name,
                                          message);

-    /* no changes in new message */
-    if (new_msg && (strcmp (message, new_msg) == 0))
-    {
-        free (new_msg);
-        new_msg = NULL;
-    }
-
-    /* message not dropped? */
-    if (!new_msg || new_msg[0])
-    {
-        first_message = 1;
-        ptr_msg = (new_msg) ? new_msg : message;
-
-        msg_encoded = NULL;
-        irc_message_parse (server,
-                           ptr_msg,
-                           NULL,  /* tags */
-                           NULL,  /* message_without_tags */
-                           NULL,  /* nick */
-                           NULL,  /* user */
-                           NULL,  /* host */
-                           NULL,  /* command */
-                           NULL,  /* channel */
-                           NULL,  /* arguments */
-                           NULL,  /* text */
-                           NULL,  /* params */
-                           NULL,  /* num_params */
-                           NULL,  /* pos_command */
-                           NULL,  /* pos_arguments */
-                           &pos_channel,
-                           &pos_text);
-        switch (IRC_SERVER_OPTION_ENUM(server,
-                                       IRC_SERVER_OPTION_CHARSET_MESSAGE))
-        {
-            case IRC_SERVER_CHARSET_MESSAGE_MESSAGE:
-                pos_encode = 0;
-                break;
-            case IRC_SERVER_CHARSET_MESSAGE_CHANNEL:
-                pos_encode = (pos_channel >= 0) ? pos_channel : pos_text;
-                break;
-            case IRC_SERVER_CHARSET_MESSAGE_TEXT:
-                pos_encode = pos_text;
-                break;
-            default:
-                pos_encode = 0;
-                break;
-        }
-        if (pos_encode >= 0)
-        {
-            ptr_chan_nick = (channel) ? channel : nick;
-            if (ptr_chan_nick)
-            {
-                snprintf (modifier_data, sizeof (modifier_data),
-                          "%s.%s.%s",
-                          weechat_plugin->name,
-                          server->name,
-                          ptr_chan_nick);
-            }
-            else
-            {
-                snprintf (modifier_data, sizeof (modifier_data),
-                          "%s.%s",
-                          weechat_plugin->name,
-                          server->name);
-            }
-
-            /*
-             * when UTF8ONLY is enabled, clients must not send non-UTF-8 data
-             * to the server; the charset encoding below is then done only if
-             * UTF8ONLY is *NOT* enabled
-             * (see: https://ircv3.net/specs/extensions/utf8-only)
-             */
-            if (!server->utf8only)
-            {
-                msg_encoded = irc_message_convert_charset (ptr_msg, pos_encode,
-                                                           "charset_encode",
-                                                           modifier_data);
-            }
-        }
-
-        if (msg_encoded)
-            ptr_msg = msg_encoded;
-
-        while (ptr_msg && ptr_msg[0])
-        {
-            pos = strchr (ptr_msg, '\n');
-            if (pos)
-                pos[0] = '\0';
-
-            snprintf (buffer, sizeof (buffer), "%s\r\n", ptr_msg);
-
-            if (flags & IRC_SERVER_SEND_OUTQ_PRIO_IMMEDIATE)
-                queue_msg = 0;
-            else if (flags & IRC_SERVER_SEND_OUTQ_PRIO_HIGH)
-                queue_msg = 1;
-            else if (flags & IRC_SERVER_SEND_OUTQ_PRIO_LOW)
-                queue_msg = 2;
-            else
-            {
-                /*
-                 * if connected to server (message 001 received), consider
-                 * it's low priority (otherwise send immediately)
-                 */
-                queue_msg = (server->is_connected) ? 2 : 0;
-            }
-
-            tags_to_send = irc_server_get_tags_to_send (tags);
-
-            ptr_redirect = irc_redirect_search_available (server);
-
-            /* queue message (do not send anything now) */
-            irc_server_outqueue_add (server,
-                                     queue_msg,
-                                     command,
-                                     (new_msg && first_message) ? message : NULL,
-                                     buffer,
-                                     (new_msg) ? 1 : 0,
-                                     tags_to_send,
-                                     ptr_redirect);
-
-            /* mark redirect as "used" */
-            if (ptr_redirect)
-                ptr_redirect->assigned_to_command = 1;
-
-            free (tags_to_send);
-
-            if (pos)
-            {
-                pos[0] = '\n';
-                ptr_msg = pos + 1;
-            }
-            else
-                ptr_msg = NULL;
-
-            first_message = 0;
-        }
-        free (msg_encoded);
-    }
-    else
+    /* message dropped? */
+    if (new_msg && !new_msg[0])
    {
        irc_raw_print (server, IRC_RAW_FLAG_SEND | IRC_RAW_FLAG_MODIFIED,
                       _("(message dropped)"));
+        free (new_msg);
+        return;
    }

+    if (!new_msg)
+        new_msg = strdup (message);
+    if (!new_msg)
+        return;
+
+    first_message = 1;
+    ptr_msg = new_msg;
+
+    msg_encoded = NULL;
+    irc_message_parse (server,
+                       ptr_msg,
+                       NULL,  /* tags */
+                       NULL,  /* message_without_tags */
+                       NULL,  /* nick */
+                       NULL,  /* user */
+                       NULL,  /* host */
+                       NULL,  /* command */
+                       NULL,  /* channel */
+                       NULL,  /* arguments */
+                       NULL,  /* text */
+                       NULL,  /* params */
+                       NULL,  /* num_params */
+                       NULL,  /* pos_command */
+                       NULL,  /* pos_arguments */
+                       &pos_channel,
+                       &pos_text);
+    switch (IRC_SERVER_OPTION_ENUM(server,
+                                   IRC_SERVER_OPTION_CHARSET_MESSAGE))
+    {
+        case IRC_SERVER_CHARSET_MESSAGE_MESSAGE:
+            pos_encode = 0;
+            break;
+        case IRC_SERVER_CHARSET_MESSAGE_CHANNEL:
+            pos_encode = (pos_channel >= 0) ? pos_channel : pos_text;
+            break;
+        case IRC_SERVER_CHARSET_MESSAGE_TEXT:
+            pos_encode = pos_text;
+            break;
+        default:
+            pos_encode = 0;
+            break;
+    }
+    if (pos_encode >= 0)
+    {
+        ptr_chan_nick = (channel) ? channel : nick;
+        if (ptr_chan_nick)
+        {
+            snprintf (modifier_data, sizeof (modifier_data),
+                      "%s.%s.%s",
+                      weechat_plugin->name,
+                      server->name,
+                      ptr_chan_nick);
+        }
+        else
+        {
+            snprintf (modifier_data, sizeof (modifier_data),
+                      "%s.%s",
+                      weechat_plugin->name,
+                      server->name);
+        }
+
+        /*
+         * when UTF8ONLY is enabled, clients must not send non-UTF-8 data
+         * to the server; the charset encoding below is then done only if
+         * UTF8ONLY is *NOT* enabled
+         * (see: https://ircv3.net/specs/extensions/utf8-only)
+         */
+        if (!server->utf8only)
+        {
+            msg_encoded = irc_message_convert_charset (ptr_msg, pos_encode,
+                                                       "charset_encode",
+                                                       modifier_data);
+        }
+    }
+
+    if (msg_encoded)
+        ptr_msg = msg_encoded;
+
+    while (ptr_msg && ptr_msg[0])
+    {
+        pos = strchr (ptr_msg, '\n');
+        if (pos)
+            pos[0] = '\0';
+
+        snprintf (buffer, sizeof (buffer), "%s\r\n", ptr_msg);
+
+        if (flags & IRC_SERVER_SEND_OUTQ_PRIO_IMMEDIATE)
+            queue_msg = 0;
+        else if (flags & IRC_SERVER_SEND_OUTQ_PRIO_HIGH)
+            queue_msg = 1;
+        else if (flags & IRC_SERVER_SEND_OUTQ_PRIO_LOW)
+            queue_msg = 2;
+        else
+        {
+            /*
+             * if connected to server (message 001 received), consider
+             * it's low priority (otherwise send immediately)
+             */
+            queue_msg = (server->is_connected) ? 2 : 0;
+        }
+
+        tags_to_send = irc_server_get_tags_to_send (tags);
+
+        ptr_redirect = irc_redirect_search_available (server);
+
+        /* queue message (do not send anything now) */
+        irc_server_outqueue_add (server,
+                                 queue_msg,
+                                 command,
+                                 (new_msg && first_message) ? message : NULL,
+                                 buffer,
+                                 (new_msg) ? 1 : 0,
+                                 tags_to_send,
+                                 ptr_redirect);
+
+        /* mark redirect as "used" */
+        if (ptr_redirect)
+            ptr_redirect->assigned_to_command = 1;
+
+        free (tags_to_send);
+
+        if (pos)
+        {
+            pos[0] = '\n';
+            ptr_msg = pos + 1;
+        }
+        else
+            ptr_msg = NULL;
+
+        first_message = 0;
+    }
+    free (msg_encoded);
+
    free (new_msg);
 }

@@ -3409,6 +3405,14 @@ irc_server_msgq_add_unterminated (struct t_irc_server *server,

    if (server->unterminated_message)
    {
+        /*
+         * limit the size of the unterminated message: once the maximum is
+         * reached, ignore the extra data (protection against a server sending
+         * a very long line without end-of-line, which would consume all the
+         * memory)
+         */
+        if (strlen (server->unterminated_message) >= IRC_SERVER_RECV_MSG_MAX_LENGTH)
+            return;
        unterminated_message2 =
            realloc (server->unterminated_message,
                     (strlen (server->unterminated_message) +
@@ -3442,7 +3446,7 @@ irc_server_msgq_add_unterminated (struct t_irc_server *server,
 */

 void
-irc_server_msgq_add_buffer (struct t_irc_server *server, const char *buffer)
+irc_server_msgq_add_buffer (struct t_irc_server *server, char *buffer)
 {
    char *pos_cr, *pos_lf;

@@ -144,6 +144,15 @@ enum t_irc_server_option
 #define IRC_SERVER_MULTILINE_DEFAULT_MAX_BYTES 4096
 #define IRC_SERVER_MULTILINE_DEFAULT_MAX_LINES 24

+/*
+ * maximum length of an unterminated message (a received line without
+ * end-of-line) and of the accumulated "005" (ISUPPORT) data; these limits
+ * protect against a server sending a huge amount of data without end-of-line
+ * (or a flood of "005" messages), which would consume all the memory
+ */
+#define IRC_SERVER_RECV_MSG_MAX_LENGTH (64 * 1024)
+#define IRC_SERVER_ISUPPORT_MAX_LENGTH (64 * 1024)
+
 /* casemapping (string comparisons for nicks/channels) */
 enum t_irc_server_casemapping
 {
@@ -418,7 +427,7 @@ extern struct t_arraylist *irc_server_sendf (struct t_irc_server *server,
                                             const char *tags,
                                             const char *format, ...);
 extern void irc_server_msgq_add_buffer (struct t_irc_server *server,
-                                        const char *buffer);
+                                        char *buffer);
 extern void irc_server_msgq_flush (void);
 extern void irc_server_set_buffer_title (struct t_irc_server *server);
 extern struct t_gui_buffer *irc_server_create_buffer (struct t_irc_server *server);
@@ -802,7 +802,8 @@ plugin_api_info_color_rgb2term_cb (const void *pointer, void *data,
                                   const char *info_name,
                                   const char *arguments)
 {
-    char value[32], *pos, *color;
+    const char *pos;
+    char value[32], *color;
    int rgb, limit;

    /* make C compiler happy */
@@ -350,9 +350,13 @@ relay_api_msg_buffer_to_json (struct t_gui_buffer *buffer,
 {
    struct t_hdata *hdata;
    struct t_gui_buffer *pointer;
+    struct t_gui_lines *ptr_lines;
+    struct t_gui_line *ptr_line;
+    struct t_gui_line_data *ptr_line_data;
    cJSON *json, *json_local_vars, *json_lines, *json_nicklist_root;
    const char *ptr_string;
    char *string;
+    int last_read_line_id;

    hdata = relay_hdata_buffer;
    pointer = buffer;
@@ -405,6 +409,24 @@ relay_api_msg_buffer_to_json (struct t_gui_buffer *buffer,
        if (json_lines)
            cJSON_AddItemToObject (json, "lines", json_lines);
    }
+    last_read_line_id = -1;
+    ptr_lines = weechat_hdata_pointer (relay_hdata_buffer, buffer, "own_lines");
+    if (ptr_lines)
+    {
+        ptr_line = weechat_hdata_pointer (relay_hdata_lines, ptr_lines, "last_read_line");
+        if (ptr_line)
+        {
+            ptr_line_data = weechat_hdata_pointer (relay_hdata_line, ptr_line, "data");
+            if (ptr_line_data)
+            {
+                last_read_line_id = weechat_hdata_integer (relay_hdata_line_data,
+                                                           ptr_line_data, "id");
+            }
+        }
+    }
+    cJSON_AddItemToObject (
+        json, "last_read_line_id",
+        cJSON_CreateNumber (last_read_line_id));

    /* nicks */
    if (nicks)
@@ -826,3 +848,40 @@ relay_api_msg_hotlist_to_json (struct t_gui_hotlist *hotlist)

    return json;
 }
+
+/*
+ * Create a JSON object with a script.
+ */
+
+cJSON *
+relay_api_msg_script_to_json (struct t_hdata *hdata, void *script, const char *extension)
+{
+    cJSON *json;
+    void *pointer;
+    const char *ptr_string;
+    char name[1024];
+
+    if (!hdata)
+        return NULL;
+
+    pointer = script;
+
+    json = cJSON_CreateObject ();
+    if (!json)
+        return NULL;
+
+    if (!script)
+        return json;
+
+    snprintf (name, sizeof (name),
+              "%s.%s",
+              weechat_hdata_string (hdata, script, "name"),
+              extension);
+    MSG_ADD_STR_BUF("name", name);
+    MSG_ADD_HDATA_STR("version", "version");
+    MSG_ADD_HDATA_STR("description", "description");
+    MSG_ADD_HDATA_STR("author", "author");
+    MSG_ADD_HDATA_STR("license", "license");
+
+    return json;
+}
@@ -58,5 +58,7 @@ extern cJSON *relay_api_msg_nick_group_to_json (struct t_gui_nick_group *nick_gr
                                                enum t_relay_api_colors colors);
 extern cJSON *relay_api_msg_completion_to_json (struct t_gui_completion *completion);
 extern cJSON *relay_api_msg_hotlist_to_json (struct t_gui_hotlist *hotlist);
+extern cJSON *relay_api_msg_script_to_json (struct t_hdata *hdata, void *script,
+                                            const char *extension);

 #endif /* WEECHAT_PLUGIN_RELAY_API_MSG_H */
@@ -402,7 +402,10 @@ RELAY_API_PROTOCOL_CALLBACK(handshake)
    if (json_body)
    {
        if (!cJSON_IsObject (json_body))
+        {
+            cJSON_Delete (json_body);
            return RELAY_API_PROTOCOL_RC_BAD_REQUEST;
+        }
        json_algos = cJSON_GetObjectItem (json_body, "password_hash_algo");
        if (json_algos)
        {
@@ -764,6 +767,64 @@ RELAY_API_PROTOCOL_CALLBACK(hotlist)
    return RELAY_API_PROTOCOL_RC_OK;
 }

+/*
+ * Callback for resource "scripts".
+ *
+ * Routes:
+ *   GET /api/scripts
+ */
+
+RELAY_API_PROTOCOL_CALLBACK(scripts)
+{
+    cJSON *json;
+    char *info_languages, **languages, hdata_name[256], *pos;
+    int num_languages, i;
+    struct t_hdata *ptr_hdata;
+    void *ptr_script;
+
+    json = cJSON_CreateArray ();
+    if (!json)
+        return RELAY_API_PROTOCOL_RC_MEMORY;
+
+    info_languages = weechat_info_get ("script_languages", NULL);
+    if (info_languages)
+    {
+        languages = weechat_string_split (info_languages, ",", NULL,
+                                          WEECHAT_STRING_SPLIT_STRIP_LEFT
+                                          | WEECHAT_STRING_SPLIT_STRIP_RIGHT
+                                          | WEECHAT_STRING_SPLIT_COLLAPSE_SEPS,
+                                          0, &num_languages);
+        if (languages)
+        {
+            for (i = 0; i < num_languages; i++)
+            {
+                pos = strchr (languages[i], ':');
+                if (pos)
+                {
+                    pos[0] = '\0';
+                    snprintf (hdata_name, sizeof (hdata_name),
+                              "%s_script", languages[i]);
+                    ptr_hdata = weechat_hdata_get (hdata_name);
+                    ptr_script = weechat_hdata_get_list (ptr_hdata, "scripts");
+                    while (ptr_script)
+                    {
+                        cJSON_AddItemToArray (
+                            json,
+                            relay_api_msg_script_to_json (ptr_hdata, ptr_script, pos + 1));
+                        ptr_script = weechat_hdata_move (ptr_hdata, ptr_script, 1);
+                    }
+                }
+            }
+            weechat_string_free_split (languages);
+        }
+        free (info_languages);
+    }
+
+    relay_api_msg_send_json (client, RELAY_HTTP_200_OK, NULL, "scripts", json);
+    cJSON_Delete (json);
+    return RELAY_API_PROTOCOL_RC_OK;
+}
+
 /*
 * Callback for resource "input".
 *
@@ -781,8 +842,13 @@ RELAY_API_PROTOCOL_CALLBACK(input)
    char str_delay[32];

    json_body = cJSON_Parse (client->http_req->body);
-    if (!json_body || !cJSON_IsObject (json_body))
+    if (!json_body)
        return RELAY_API_PROTOCOL_RC_BAD_REQUEST;
+    if (!cJSON_IsObject (json_body))
+    {
+        cJSON_Delete (json_body);
+        return RELAY_API_PROTOCOL_RC_BAD_REQUEST;
+    }

    /* get buffer either by name or by id */
    ptr_buffer = NULL;
@@ -908,8 +974,13 @@ RELAY_API_PROTOCOL_CALLBACK(completion)
    struct t_gui_buffer *ptr_buffer;

    json_body = cJSON_Parse (client->http_req->body);
-    if (!json_body || !cJSON_IsObject(json_body))
+    if (!json_body)
        return RELAY_API_PROTOCOL_RC_BAD_REQUEST;
+    if (!cJSON_IsObject(json_body))
+    {
+        cJSON_Delete (json_body);
+        return RELAY_API_PROTOCOL_RC_BAD_REQUEST;
+    }

    /* get buffer either by name or by id */
    ptr_buffer = NULL;
@@ -1286,6 +1357,7 @@ relay_api_protocol_recv_http (struct t_relay_client *client)
        { "GET",     "version",    1,    0,  0,  RELAY_API_CB(version)    },
        { "GET",     "buffers",    1,    0,  3,  RELAY_API_CB(buffers)    },
        { "GET",     "hotlist",    1,    0,  3,  RELAY_API_CB(hotlist)    },
+        { "GET",     "scripts",    1,    0,  0,  RELAY_API_CB(scripts)    },
        { "POST",    "input",      1,    0,  0,  RELAY_API_CB(input)      },
        { "POST",    "completion", 1,    0,  0,  RELAY_API_CB(completion) },
        { "POST",    "ping",       1,    0,  0,  RELAY_API_CB(ping)       },
@@ -26,8 +26,8 @@ struct t_relay_client;
 enum t_relay_status;

 #define RELAY_API_VERSION_MAJOR 0
-#define RELAY_API_VERSION_MINOR 4
-#define RELAY_API_VERSION_PATCH 1
+#define RELAY_API_VERSION_MINOR 6
+#define RELAY_API_VERSION_PATCH 0
 #define RELAY_API_VERSION_NUMBER                                        \
    ((RELAY_API_VERSION_MAJOR << 16)                                    \
     + (RELAY_API_VERSION_MINOR << 8)                                   \
@@ -17,7 +17,7 @@ info:
  license:
    name: CC BY-NC-SA 4.0
    url: https://creativecommons.org/licenses/by-nc-sa/4.0/
-  version: 0.4.1
+  version: 0.6.0

 externalDocs:
  url: https://weechat.org/doc/
@@ -32,6 +32,7 @@ tags:
  - name: version
  - name: buffers
  - name: hotlist
+  - name: scripts
  - name: input
  - name: completion
  - name: ping
@@ -96,7 +97,7 @@ paths:
    get:
      tags:
        - version
-      description: Get the WeeChat and API versions
+      description: Get the WeeChat and API versions.
      parameters:
        - $ref: '#/components/parameters/totp'
      operationId: getVersion
@@ -531,7 +532,7 @@ paths:
    get:
      tags:
        - hotlist
-      description: Get hotlist
+      description: Get hotlist.
      operationId: getHotlist
      parameters:
        - $ref: '#/components/parameters/totp'
@@ -564,6 +565,37 @@ paths:
                $ref: '#/components/schemas/Error'
      security:
        - password: []
+  /scripts:
+    get:
+      tags:
+        - scripts
+      description: Get list of loaded scripts.
+      operationId: getScripts
+      parameters:
+        - $ref: '#/components/parameters/totp'
+      responses:
+        '200':
+          description: Successful operation
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/Script'
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+        '503':
+          description: Out of memory
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+      security:
+        - password: []
  /input:
    post:
      tags:
@@ -1043,6 +1075,11 @@ components:
          type: array
          items:
            $ref: '#/components/schemas/Line'
+        last_read_line_id:
+          type: integer
+          format: int64
+          description: identifier of the last line read in the buffer (-1 if read marker is not displayed)
+          example: -1
        nicklist_root:
          $ref: '#/components/schemas/NickGroup'
      required:
@@ -1331,6 +1368,31 @@ components:
        - date
        - buffer_id
        - count
+    Script:
+      type: object
+      properties:
+        name:
+          type: string
+          description: script name
+          example: 'go.py'
+        version:
+          type: string
+          example: '3.1.1'
+        description:
+          type: string
+          example: 'Quick jump to buffers'
+        author:
+          type: string
+          example: 'Sébastien Helleu <flashcode@flashtux.org>'
+        license:
+          type: string
+          example: 'GPL3'
+      required:
+        - name
+        - version
+        - description
+        - author
+        - license
    Completion:
      type: object
      properties:
@@ -202,9 +202,9 @@ void
 relay_irc_sendf (struct t_relay_client *client, const char *format, ...)
 {
    int number;
-    char *pos, hash_key[32], *message, *new_msg1, *new_msg2;
+    char *pos, hash_key[32], *message, *new_msg1, *new_msg2, *ptr_msg1, *ptr_msg2;
    char modifier_data[128];
-    const char *str_message, *ptr_msg1, *ptr_msg2;
+    const char *str_message;
    struct t_hashtable *hashtable_in, *hashtable_out;

    if (!client || !format)
@@ -234,7 +234,12 @@ relay_irc_sendf (struct t_relay_client *client, const char *format, ...)
    if (new_msg1 && !new_msg1[0])
        goto end;

-    ptr_msg1 = (new_msg1) ? new_msg1 : vbuffer;
+    if (!new_msg1)
+        new_msg1 = strdup (vbuffer);
+    if (!new_msg1)
+        goto end;
+
+    ptr_msg1 = new_msg1;

    pos = strchr (ptr_msg1, '\r');
    if (pos)
@@ -275,7 +280,11 @@ relay_irc_sendf (struct t_relay_client *client, const char *format, ...)
        /* message not dropped? */
        if (!new_msg2 || new_msg2[0])
        {
-            ptr_msg2 = (new_msg2) ? new_msg2 : str_message;
+            if (!new_msg2)
+                new_msg2 = strdup (str_message);
+            if (!new_msg2)
+                break;
+            ptr_msg2 = new_msg2;
            if (weechat_asprintf (&message, "%s\r\n", ptr_msg2) >= 0)
            {
                relay_client_send (client, RELAY_MSG_STANDARD,
@@ -470,10 +479,9 @@ relay_irc_signal_irc_outtags_cb (const void *pointer, void *data,
 {
    struct t_relay_client *client;
    struct t_hashtable *hash_parsed;
-    const char *irc_command, *irc_args, *host, *ptr_message;
-    char *pos, *tags, *irc_channel, *message;
+    const char *irc_command, *irc_args, *host, *ptr_message, *pos;
+    char *pos_cr, *tags, *irc_channel, *message, str_infolist_args[256];
    struct t_infolist *infolist_nick;
-    char str_infolist_args[256];

    /* make C compiler happy */
    (void) data;
@@ -487,9 +495,9 @@ relay_irc_signal_irc_outtags_cb (const void *pointer, void *data,
    message = strdup ((char *)signal_data);
    if (!message)
        goto end;
-    pos = strchr (message, '\r');
-    if (pos)
-        pos[0] = '\0';
+    pos_cr = strchr (message, '\r');
+    if (pos_cr)
+        pos_cr[0] = '\0';

    ptr_message = message;

@@ -1595,10 +1603,10 @@ relay_irc_recv (struct t_relay_client *client, const char *data)
    struct t_hashtable *hash_parsed, *hash_redirect;
    struct t_infolist *infolist_server;
    const char *irc_command, *str_num_params, *isupport, *pos_password;
-    const char *ptr_data, *ptr_nick_modes;
+    const char *ptr_data, *ptr_nick_modes, *pos;
    char str_time[128], str_signal[128], str_server_channel[256], *nick;
    char str_param[128], *str_args, *version, str_command[128], **params;
-    char *pos, *password, *irc_is_channel, *info, *error, *str_cmd_lower;
+    char *password, *irc_is_channel, *info, *error, *str_cmd_lower;
    char modifier_data[128], *new_data, *ctcp_type, *ctcp_params, *nick_modes;
    long num_params;
    int i, redirect_msg;
@@ -999,7 +999,8 @@ struct t_relay_remote *
 relay_config_get_remote_from_option_name (const char *name)
 {
    struct t_relay_remote *ptr_remote;
-    char *pos_option, *remote_name;
+    const char *pos_option;
+    char *remote_name;

    ptr_remote = NULL;

@@ -1244,7 +1245,8 @@ relay_config_remote_read_cb (const void *pointer, void *data,
                             struct t_config_section *section,
                             const char *option_name, const char *value)
 {
-    char *pos_option, *remote_name;
+    const char *pos_option;
+    char *remote_name;
    struct t_relay_remote *ptr_temp_remote;
    int index_option;

@@ -244,7 +244,8 @@ relay_http_parse_path (const char *path,
                       char ***paths, int *num_paths,
                       struct t_hashtable *params)
 {
-    char *pos, *str_path, *str_params, **items_path, **items2_path;
+    const char *pos;
+    char *str_path, *str_params, **items_path, **items2_path;
    char **items_params, *name, *value;
    int i, num_items_path, num_items_params;

@@ -410,8 +411,8 @@ relay_http_parse_header (struct t_relay_http_request *request,
                         const char *header,
                         int ws_deflate_allowed)
 {
-    char *pos, *name, *name_lower, *error, **items;
-    const char *existing_value, *ptr_value;
+    char *name, *name_lower, *error, **items;
+    const char *pos, *existing_value, *ptr_value;
    int i, num_items;
    long number;

@@ -513,6 +514,19 @@ relay_http_add_to_body (struct t_relay_http_request *request,
    if (!partial_message || !*partial_message)
        return;

+    /*
+     * reject the body if its announced length is too big: this prevents a
+     * client from forcing an unbounded allocation by announcing a huge
+     * "Content-Length"
+     */
+    if (request->content_length > RELAY_HTTP_BODY_MAX_LENGTH)
+    {
+        free (*partial_message);
+        *partial_message = NULL;
+        request->status = RELAY_HTTP_END;
+        return;
+    }
+
    num_bytes_missing = request->content_length
        - request->body_size;
    if (num_bytes_missing <= 0)
@@ -986,13 +1000,22 @@ relay_http_process_request (struct t_relay_client *client)
 void
 relay_http_recv (struct t_relay_client *client, const char *data, int size)
 {
-    char *new_partial, *pos, **null_char;
+    const void *null_char;
+    char *new_partial, *pos;
    int length, ws_deflate_allowed;

    null_char = memchr (data, 0, size);

    if (client->partial_message)
    {
+        /*
+         * limit the size of the partial message: once the maximum is reached,
+         * ignore the extra data (protection against a client sending a huge
+         * amount of data without any end-of-line and dribbling it, which would
+         * consume all the memory)
+         */
+        if (strlen (client->partial_message) >= RELAY_HTTP_PARTIAL_MESSAGE_MAX_LENGTH)
+            return;
        new_partial = realloc (client->partial_message,
                               strlen (client->partial_message) +
                               strlen (data) + 1);
@@ -1543,8 +1566,8 @@ int
 relay_http_parse_response_header (struct t_relay_http_response *response,
                                  const char *header)
 {
-    char *pos, *name, *name_lower, *error;
-    const char *ptr_value;
+    char *name, *name_lower, *error;
+    const char *pos, *ptr_value;
    long number;

    /* empty line => end of headers */
@@ -1695,7 +1718,7 @@ relay_http_print_log_request (struct t_relay_http_request *request)
    weechat_log_printf ("    path_items. . . . . . . : %p", request->path_items);
    if (request->path_items)
    {
-        for (i = 0; request->path_items[0]; i++)
+        for (i = 0; request->path_items[i]; i++)
        {
            weechat_log_printf ("      '%s'", request->path_items[i]);
        }
@@ -57,6 +57,22 @@ enum t_relay_client_http_status
 #define RELAY_HTTP_ERROR_METHOD_NOT_ALLOWED   "Method Not Allowed"
 #define RELAY_HTTP_ERROR_OUT_OF_MEMORY        "Out of memory"

+/*
+ * maximum length of an HTTP request body: used as an upper bound on the
+ * "Content-Length" accepted from a client, to prevent a client from forcing
+ * an unbounded allocation by announcing a huge body
+ */
+#define RELAY_HTTP_BODY_MAX_LENGTH (8 * 1024 * 1024)
+
+/*
+ * maximum length of the partial message accumulated while reading an HTTP
+ * request: once this limit is reached, the extra data is ignored; this
+ * protects against a client sending a huge amount of data without any
+ * end-of-line (an unterminated method or header line), which would consume
+ * all the memory
+ */
+#define RELAY_HTTP_PARTIAL_MESSAGE_MAX_LENGTH (8 * 1024 * 1024)
+
 struct t_relay_http_request
 {
    enum t_relay_client_http_status status; /* HTTP status                  */
@@ -202,8 +202,8 @@ int
 relay_remote_parse_url (const char *url,
                        int *tls, char **address, int *port)
 {
-    const char *ptr_url;
-    char *pos, *str_port, *error;
+    const char *ptr_url, *pos;
+    char *str_port, *error;
    long number;

    if (tls)
@@ -79,7 +79,7 @@ relay_server_get_protocol_args (const char *protocol_and_args,
                                char **protocol, char **protocol_args)
 {
    int opt_ipv4, opt_ipv6, opt_tls, opt_unix_socket;
-    char *pos;
+    const char *pos;

    opt_ipv4 = -1;
    opt_ipv6 = -1;
@@ -703,6 +703,14 @@ relay_websocket_decode_frame (const unsigned char *buffer,
            index_buffer += length_frame_size;
        }

+        /*
+         * reject the frame if its announced length is too big: this prevents
+         * a client from forcing an unbounded allocation (and unbounded
+         * accumulation of partial frames) by announcing a huge frame
+         */
+        if (length_frame > WEBSOCKET_FRAME_MAX_LENGTH)
+            return 0;
+
        if (masked_frame)
        {
            /* read mask (4 bytes) */
@@ -41,6 +41,14 @@

 #define WEBSOCKET_SUB_PROTOCOL_API_WEECHAT "api.weechat"

+/*
+ * maximum length of a websocket frame received from a client (or a remote
+ * WeeChat): used as an upper bound on the announced frame payload length, to
+ * prevent a client from forcing an unbounded allocation by announcing a huge
+ * frame and dribbling its payload
+ */
+#define WEBSOCKET_FRAME_MAX_LENGTH (8 * 1024 * 1024)
+
 /*
 * maximum size of a decompressed websocket frame (with "permessage-deflate"):
 * used as an upper bound when inflating, to prevent a small compressed frame
@@ -586,9 +586,9 @@ relay_weechat_msg_add_hdata (struct t_relay_weechat_msg *msg,
                             const char *path, const char *keys)
 {
    struct t_hdata *ptr_hdata_head, *ptr_hdata;
-    char *hdata_head, *pos, **list_keys, *keys_types, **list_path;
-    char *path_returned;
-    const char *hdata_name, *array_size;
+    char *hdata_head, **list_keys, *keys_types, **list_path;
+    char *path_returned, *pos_paren;
+    const char *hdata_name, *array_size, *pos;
    void *pointer, **path_pointers;
    unsigned long value;
    int rc, num_keys, num_path, i, type, pos_count, count, rc_sscanf;
@@ -626,9 +626,9 @@ relay_weechat_msg_add_hdata (struct t_relay_weechat_msg *msg,

    /* extract pointer from first path (direct pointer or list name) */
    pointer = NULL;
-    pos = strchr (list_path[0], '(');
-    if (pos)
-        pos[0] = '\0';
+    pos_paren = strchr (list_path[0], '(');
+    if (pos_paren)
+        pos_paren[0] = '\0';
    if (strncmp (list_path[0], "0x", 2) == 0)
    {
        rc_sscanf = sscanf (list_path[0], "%lx", &value);
@@ -651,8 +651,8 @@ relay_weechat_msg_add_hdata (struct t_relay_weechat_msg *msg,
    }
    else
        pointer = weechat_hdata_get_list (ptr_hdata_head, list_path[0]);
-    if (pos)
-        pos[0] = '(';
+    if (pos_paren)
+        pos_paren[0] = '(';
    if (!pointer)
        goto end;

@@ -668,9 +668,9 @@ relay_weechat_msg_add_hdata (struct t_relay_weechat_msg *msg,
    strcpy (path_returned, hdata_head);
    for (i = 1; i < num_path; i++)
    {
-        pos = strchr (list_path[i], '(');
-        if (pos)
-            pos[0] = '\0';
+        pos_paren = strchr (list_path[i], '(');
+        if (pos_paren)
+            pos_paren[0] = '\0';
        hdata_name = weechat_hdata_get_var_hdata (ptr_hdata, list_path[i]);
        if (!hdata_name)
            goto end;
@@ -679,8 +679,8 @@ relay_weechat_msg_add_hdata (struct t_relay_weechat_msg *msg,
            goto end;
        strcat (path_returned, "/");
        strcat (path_returned, hdata_name);
-        if (pos)
-            pos[0] = '(';
+        if (pos_paren)
+            pos_paren[0] = '(';
    }

    /* split keys */
@@ -1740,8 +1740,8 @@ RELAY_WEECHAT_PROTOCOL_CALLBACK(quit)
 void
 relay_weechat_protocol_recv (struct t_relay_client *client, const char *data)
 {
-    const char *ptr_data;
-    char *data_unescaped, *pos, *id, *command, **argv, **argv_eol;
+    const char *ptr_data, *pos;
+    char *data_unescaped, *id, *command, **argv, **argv_eol;
    int i, argc, return_code;
    struct t_relay_weechat_protocol_cb protocol_cb[] =
        { { "handshake", &relay_weechat_protocol_cb_handshake },
@@ -184,7 +184,8 @@ script_action_run_list_input (struct t_gui_buffer *buffer,
 void
 script_action_run_load (const char *name, int quiet)
 {
-    char *pos, str_command[1024];
+    const char *pos;
+    char str_command[1024];
    int language;

    language = -1;
@@ -227,8 +228,8 @@ script_action_run_load (const char *name, int quiet)
 void
 script_action_run_unload (const char *name, int quiet)
 {
-    char *pos, hdata_name[128], *filename, *ptr_base_name, str_command[1024];
-    const char *ptr_filename, *ptr_registered_name;
+    char hdata_name[128], *filename, *ptr_base_name, str_command[1024];
+    const char *pos, *ptr_filename, *ptr_registered_name;
    int language, found, i;
    struct t_hdata *hdata;
    void *ptr_script;
@@ -332,8 +333,8 @@ script_action_run_unload (const char *name, int quiet)
 void
 script_action_run_reload (const char *name, int quiet)
 {
-    char *pos, hdata_name[128], *filename, *ptr_base_name, str_command[1024];
-    const char *ptr_filename, *ptr_registered_name;
+    char hdata_name[128], *filename, *ptr_base_name, str_command[1024];
+    const char *pos, *ptr_filename, *ptr_registered_name;
    int language, found, i;
    struct t_hdata *hdata;
    void *ptr_script;
@@ -443,7 +444,8 @@ void
 script_action_run_autoload (const char *name, int quiet, int autoload)
 {
    struct t_script_repo *ptr_script;
-    char *pos, str_signal[256], *weechat_data_dir, *filename;
+    char str_signal[256], *weechat_data_dir, *filename;
+    const char *pos;
    int language, script_found, script_autoloaded;
    struct stat st;

@@ -156,8 +156,8 @@ void
 script_completion_exec_file_cb (void *data, const char *filename)
 {
    struct t_gui_completion *completion;
-    const char *extension;
-    char *pos, *filename2, *ptr_base_name;
+    const char *extension, *pos;
+    char *filename2, *ptr_base_name;

    completion = (struct t_gui_completion *)(((void **)data)[0]);
    extension = (const char *)(((void **)data)[1]);
@@ -159,6 +159,37 @@ script_info_info_script_loaded_cb (const void *pointer, void *data,
    return NULL;
 }

+/*
+ * Return script info "script_languages".
+ */
+
+char *
+script_info_info_languages_cb (const void *pointer, void *data,
+                               const char *info_name,
+                               const char *arguments)
+{
+    char **output;
+    int i;
+
+    /* make C compiler happy */
+    (void) pointer;
+    (void) data;
+    (void) info_name;
+    (void) arguments;
+
+    output = weechat_string_dyn_alloc (256);
+    for (i = 0; i < SCRIPT_NUM_LANGUAGES; i++)
+    {
+        if (i > 0)
+            weechat_string_dyn_concat (output, ",", -1);
+        weechat_string_dyn_concat (output, script_language[i], -1);
+        weechat_string_dyn_concat (output, ":", -1);
+        weechat_string_dyn_concat (output, script_extension[i], -1);
+    }
+
+    return weechat_string_dyn_free (output, 0);
+}
+
 /*
 * Return script infolist "script_script".
 */
@@ -235,6 +266,11 @@ script_info_init (void)
        N_("1 if script is loaded"),
        N_("script name with extension"),
        &script_info_info_script_loaded_cb, NULL, NULL);
+    weechat_hook_info (
+        "script_languages",
+        N_("comma-separated list of plugin:extension with supported languages"),
+        NULL,
+        &script_info_info_languages_cb, NULL, NULL);

    /* infolist hooks */
    weechat_hook_infolist (
@@ -714,8 +714,7 @@ script_repo_remove_all (void)
 int
 script_repo_script_is_held (struct t_script_repo *script)
 {
-    const char *hold;
-    char *pos;
+    const char *hold, *pos;
    int length;

    hold = weechat_config_string (script_config_scripts_hold);
@@ -140,7 +140,8 @@ void
 spell_command_speller_list_dicts (void)
 {
 #ifndef USE_ENCHANT
-    char *country, *lang, *pos, *iso;
+    const char *pos;
+    char *country, *lang, *iso;
    char str_dict[256], str_country[128];
    struct AspellConfig *config;
    AspellDictInfoList *list;
@@ -391,7 +391,7 @@ spell_string_is_url (const char *word)
 */

 int
-spell_string_is_nick (struct t_gui_buffer *buffer, const char *word)
+spell_string_is_nick (struct t_gui_buffer *buffer, char *word)
 {
    char *pos, *pos_nick_completer, *pos_space, saved_char;
    const char *buffer_type, *buffer_nick, *buffer_channel;
@@ -810,8 +810,8 @@ trigger_callback_modifier_cb (const void *pointer, void *data,
                              const char *modifier, const char *modifier_data,
                              const char *string)
 {
-    const char *ptr_string;
-    char *string_modified, *pos, *buffer_pointer;
+    const char *ptr_string, *pos;
+    char *string_modified, *buffer_pointer;
    char *str_tags, **tags, *prefix, *string_no_color;
    unsigned long value;
    int num_tags, rc;
@@ -550,7 +550,8 @@ trigger_config_trigger_read_cb (const void *pointer, void *data,
                                struct t_config_section *section,
                                const char *option_name, const char *value)
 {
-    char *pos_option, *trigger_name;
+    const char *pos_option;
+    char *trigger_name;
    struct t_trigger *ptr_temp_trigger;
    int index_option;

@@ -239,8 +239,7 @@ trigger_search (const char *name)
 struct t_trigger *
 trigger_search_with_option (struct t_config_option *option)
 {
-    const char *ptr_name;
-    char *pos_option;
+    const char *ptr_name, *pos_option;
    struct t_trigger *ptr_trigger;
    int num_chars;

@@ -76,7 +76,7 @@ struct t_weelist_item;
 * please change the date with current one; for a second change at same
 * date, increment the 01, otherwise please keep 01.
 */
-#define WEECHAT_PLUGIN_API_VERSION "20260530-01"
+#define WEECHAT_PLUGIN_API_VERSION "20260614-01"

 /* macros for defining plugin infos */
 #define WEECHAT_PLUGIN_NAME(__name)                                     \
@@ -671,7 +671,7 @@ struct t_weechat_plugin
                                       struct t_config_file **config_file,
                                       struct t_config_section **section,
                                       struct t_config_option **option,
-                                       char **pos_option_name);
+                                       const char **pos_option_name);
    int (*config_string_to_boolean) (const char *text);
    int (*config_option_reset) (struct t_config_option *option,
                                int run_callback);
@@ -162,7 +162,7 @@ xfer_chat_recv_cb (const void *pointer, void *data, int fd)
            {
                ctcp_action = 0;
                length = strlen (ptr_buf);
-                if (ptr_buf[length - 1] == '\r')
+                if ((length > 0) && (ptr_buf[length - 1] == '\r'))
                {
                    ptr_buf[length - 1] = '\0';
                    length--;
@@ -242,8 +242,8 @@ int
 xfer_dcc_resume_hash (struct t_xfer *xfer)
 {
    char *buf;
-    unsigned long long total_read;
-    ssize_t length_buf, to_read, num_read;
+    unsigned long long total_read, length_buf, to_read;
+    ssize_t num_read;
    int ret, fd;

    total_read = 0;
@@ -251,7 +251,7 @@ xfer_file_find_suffix (struct t_xfer *xfer)
 void
 xfer_file_find_filename (struct t_xfer *xfer)
 {
-    char *dir_separator, *path;
+    char *dir_separator, *path, *nick;
    struct t_hashtable *options;

    if (!XFER_IS_FILE(xfer->type))
@@ -287,12 +287,20 @@ xfer_file_find_filename (struct t_xfer *xfer)
    {
        strcat (xfer->local_filename, dir_separator);
    }
-    free (dir_separator);
    if (weechat_config_boolean (xfer_config_file_use_nick_in_filename))
    {
-        strcat (xfer->local_filename, xfer->remote_nick);
+        /*
+         * the remote nick comes from the server and can contain a directory
+         * separator: replace it so the nick cannot make the file be written
+         * outside the download directory
+         */
+        nick = (dir_separator) ?
+            weechat_string_replace (xfer->remote_nick, dir_separator, "_") : NULL;
+        strcat (xfer->local_filename, (nick) ? nick : xfer->remote_nick);
+        free (nick);
        strcat (xfer->local_filename, ".");
    }
+    free (dir_separator);
    strcat (xfer->local_filename, xfer->filename);

    free (path);
@@ -526,7 +526,7 @@ TEST(CoreConfigFile, SearchWithString)
    struct t_config_file *ptr_config;
    struct t_config_section *ptr_section;
    struct t_config_option *ptr_option;
-    char *pos_option_name;
+    const char *pos_option_name;

    ptr_config = (struct t_config_file *)0x1;
    ptr_section = (struct t_config_section *)0x1;
@@ -1454,6 +1454,8 @@ TEST(CoreString, Replace)
    WEE_TEST_STR(NULL, string_replace ("string", NULL, "replace"));
    WEE_TEST_STR(NULL, string_replace (NULL, "search", "replace"));

+    WEE_TEST_STR("test abc def", string_replace("test abc def", "", "xxx"));
+
    WEE_TEST_STR("test abc def", string_replace("test abc def", "xyz", "xxx"));
    WEE_TEST_STR("test xxx def", string_replace("test abc def", "abc", "xxx"));
    WEE_TEST_STR("xxx test xxx def xxx",
@@ -305,7 +305,7 @@ TEST_GROUP(IrcProtocolWithServer)

    void server_recv (const char *command)
    {
-        char str_command[4096];
+        char str_command[8192];

        record_start ();
        arraylist_clear (sent_messages);
@@ -3866,6 +3866,44 @@ TEST(IrcProtocolWithServer, 005_full)
    STRCMP_EQUAL(IRC_MSG_005 " " IRC_MSG_005, ptr_server->isupport);
 }

+/*
+ * Test functions:
+ *   irc_protocol_cb_005 (accumulated ISUPPORT is bounded)
+ */
+
+TEST(IrcProtocolWithServer, 005_limit)
+{
+    char str_msg[4096], str_value[3500];
+    size_t length1, length2;
+    int i;
+
+    SRV_INIT;
+
+    memset (str_value, 'X', sizeof (str_value) - 1);
+    str_value[sizeof (str_value) - 1] = '\0';
+    snprintf (str_msg, sizeof (str_msg),
+              ":server 005 alice TEST=%s :are supported", str_value);
+
+    /* flood the server with "005" messages */
+    for (i = 0; i < 100; i++)
+    {
+        server_recv (str_msg);
+    }
+    CHECK(ptr_server->isupport);
+    length1 = strlen (ptr_server->isupport);
+
+    /* the accumulated ISUPPORT data must be bounded */
+    CHECK(length1 <= IRC_SERVER_ISUPPORT_MAX_LENGTH + sizeof (str_value));
+
+    /* receiving more "005" messages must not grow it any further */
+    for (i = 0; i < 100; i++)
+    {
+        server_recv (str_msg);
+    }
+    length2 = strlen (ptr_server->isupport);
+    LONGS_EQUAL(length1, length2);
+}
+
 /*
 * Test functions:
 *   irc_protocol_cb_005 (infos from server, multiple messages)
@@ -65,6 +65,49 @@ TEST(IrcServer, Valid)
    irc_server_free (server);
 }

+/*
+ * Test functions:
+ *   irc_server_msgq_add_unterminated (via irc_server_msgq_add_buffer)
+ *
+ * Check that data received without any end-of-line does not grow the
+ * unterminated message buffer without limit.
+ */
+
+TEST(IrcServer, MsgqAddBufferLimit)
+{
+    struct t_irc_server *server;
+    char chunk[4097];
+    int i;
+    size_t length1, length2;
+
+    server = irc_server_alloc ("server_msgq");
+    CHECK(server);
+
+    memset (chunk, 'a', sizeof (chunk) - 1);
+    chunk[sizeof (chunk) - 1] = '\0';
+
+    /* feed a lot of data with no end-of-line */
+    for (i = 0; i < 100; i++)
+    {
+        irc_server_msgq_add_buffer (server, chunk);
+    }
+    CHECK(server->unterminated_message);
+    length1 = strlen (server->unterminated_message);
+
+    /* the buffer must be bounded (not ~400 KB) */
+    CHECK(length1 <= IRC_SERVER_RECV_MSG_MAX_LENGTH + sizeof (chunk));
+
+    /* feeding more data must not grow the buffer any further */
+    for (i = 0; i < 100; i++)
+    {
+        irc_server_msgq_add_buffer (server, chunk);
+    }
+    length2 = strlen (server->unterminated_message);
+    LONGS_EQUAL(length1, length2);
+
+    irc_server_free (server);
+}
+
 /*
 * Test functions:
 *   irc_server_search
@@ -23,13 +23,18 @@

 #include "CppUTest/TestHarness.h"

+#include "tests.h"
+
 extern "C"
 {
+#include <string.h>
 #include <time.h>
 #include <sys/time.h>
 #include <cjson/cJSON.h>
 #include "src/core/core-hdata.h"
+#include "src/core/core-hook.h"
 #include "src/core/core-util.h"
+#include "src/core/weechat.h"
 #include "src/gui/gui-buffer.h"
 #include "src/gui/gui-chat.h"
 #include "src/gui/gui-color.h"
@@ -177,6 +182,7 @@ TEST(RelayApiMsg, BufferToJson)
    WEE_CHECK_OBJ_STR("core", json_local_vars, "plugin");
    WEE_CHECK_OBJ_STR("weechat", json_local_vars, "name");
    POINTERS_EQUAL(NULL, cJSON_GetObjectItem (json, "lines"));
+    WEE_CHECK_OBJ_NUM(-1, json, "last_read_line_id");
    POINTERS_EQUAL(NULL, cJSON_GetObjectItem (json, "nicks"));
    cJSON_Delete (json);

@@ -652,3 +658,63 @@ TEST(RelayApiMsg, HotlistToJson)

    gui_hotlist_remove_buffer (gui_buffers, 1);
 }
+
+/*
+ * Test functions:
+ *   relay_api_msg_script_to_json
+ */
+
+TEST(RelayApiMsg, ScriptToJson)
+{
+    struct t_hdata *ptr_hdata;
+    void *ptr_script;
+    cJSON *json, *json_obj;
+    char path_testapigen[PATH_MAX], path_testapi[PATH_MAX];
+    char *test_scripts_dir, str_command[(PATH_MAX * 2) + 128];
+    const char *ptr_test_scripts_dir;
+
+    POINTERS_EQUAL(NULL, relay_api_msg_script_to_json (NULL, NULL, NULL));
+
+    ptr_hdata = hook_hdata_get (NULL, "python_script");
+
+    json = relay_api_msg_script_to_json (ptr_hdata, NULL, NULL);
+    CHECK(json);
+    CHECK(cJSON_IsObject (json));
+    cJSON_Delete (json);
+
+    /* load a python script for this test */
+    ptr_test_scripts_dir = getenv ("WEECHAT_TESTS_SCRIPTS_DIR");
+    test_scripts_dir = strdup (
+        (ptr_test_scripts_dir) ?
+        ptr_test_scripts_dir : "./scripts/python");
+    snprintf (path_testapigen, sizeof (path_testapigen),
+              "%s%s%s",
+              test_scripts_dir,
+              DIR_SEPARATOR,
+              "testapigen.py");
+    snprintf (path_testapi, sizeof (path_testapi),
+              "%s%s%s",
+              test_scripts_dir,
+              DIR_SEPARATOR,
+              "testapi.py");
+    snprintf (str_command, sizeof (str_command),
+              "/script load %s", path_testapigen);
+    run_cmd (str_command);
+
+    ptr_script = hdata_get_list (ptr_hdata, "scripts");
+    CHECK(ptr_script);
+    json = relay_api_msg_script_to_json (ptr_hdata, ptr_script, "py");
+    CHECK(json);
+    CHECK(cJSON_IsObject (json));
+    WEE_CHECK_OBJ_STR("testapigen.py", json, "name");
+    WEE_CHECK_OBJ_STR("0.1", json, "version");
+    WEE_CHECK_OBJ_STR("Generate scripting API test scripts", json, "description");
+    WEE_CHECK_OBJ_STR("Sébastien Helleu <flashcode@flashtux.org>", json, "author");
+    WEE_CHECK_OBJ_STR("GPL3", json, "license");
+    cJSON_Delete (json);
+
+    /* unload script */
+    snprintf (str_command, sizeof (str_command),
+              "/script unload -q weechat_testapi.py");
+    run_cmd (str_command);
+}
@@ -23,6 +23,7 @@

 #include "CppUTest/TestHarness.h"

+#include "tests.h"
 #include "tests-record.h"

 extern "C"
@@ -34,6 +35,7 @@ extern "C"
 #include "src/core/core-string.h"
 #include "src/core/core-util.h"
 #include "src/core/core-version.h"
+#include "src/core/weechat.h"
 #include "src/gui/gui-buffer.h"
 #include "src/gui/gui-chat.h"
 #include "src/gui/gui-hotlist.h"
@@ -611,6 +613,65 @@ TEST(RelayApiProtocolWithClient, CbHotlist)
    gui_hotlist_remove_buffer (gui_buffers, 1);
 }

+/*
+ * Test functions:
+ *   relay_api_protocol_cb_scripts
+ */
+
+TEST(RelayApiProtocolWithClient, CbScripts)
+{
+    cJSON *json, *json_obj;
+    char path_testapigen[PATH_MAX], path_testapi[PATH_MAX];
+    char *test_scripts_dir, str_command[(PATH_MAX * 2) + 128];
+    const char *ptr_test_scripts_dir;
+
+    /* get scripts (no scripts loaded) */
+    test_client_recv_http ("GET /api/scripts", NULL, NULL);
+    WEE_CHECK_HTTP_CODE(200, "OK");
+    CHECK(json_body_sent[0]);
+    CHECK(cJSON_IsArray (json_body_sent[0]));
+    LONGS_EQUAL(0, cJSON_GetArraySize (json_body_sent[0]));
+
+    /* load a python script for this test */
+    ptr_test_scripts_dir = getenv ("WEECHAT_TESTS_SCRIPTS_DIR");
+    test_scripts_dir = strdup (
+        (ptr_test_scripts_dir) ?
+        ptr_test_scripts_dir : "./scripts/python");
+    snprintf (path_testapigen, sizeof (path_testapigen),
+              "%s%s%s",
+              test_scripts_dir,
+              DIR_SEPARATOR,
+              "testapigen.py");
+    snprintf (path_testapi, sizeof (path_testapi),
+              "%s%s%s",
+              test_scripts_dir,
+              DIR_SEPARATOR,
+              "testapi.py");
+    snprintf (str_command, sizeof (str_command),
+              "/script load %s", path_testapigen);
+    run_cmd (str_command);
+
+    /* get scripts (one loaded) */
+    test_client_recv_http ("GET /api/scripts", NULL, NULL);
+    WEE_CHECK_HTTP_CODE(200, "OK");
+    CHECK(json_body_sent[0]);
+    CHECK(cJSON_IsArray (json_body_sent[0]));
+    LONGS_EQUAL(1, cJSON_GetArraySize (json_body_sent[0]));
+    json = cJSON_GetArrayItem (json_body_sent[0], 0);
+    CHECK(json);
+    CHECK(cJSON_IsObject (json));
+    WEE_CHECK_OBJ_STR("testapigen.py", json, "name");
+    WEE_CHECK_OBJ_STR("0.1", json, "version");
+    WEE_CHECK_OBJ_STR("Generate scripting API test scripts", json, "description");
+    WEE_CHECK_OBJ_STR("Sébastien Helleu <flashcode@flashtux.org>", json, "author");
+    WEE_CHECK_OBJ_STR("GPL3", json, "license");
+
+    /* unload script */
+    snprintf (str_command, sizeof (str_command),
+              "/script unload -q weechat_testapi.py");
+    run_cmd (str_command);
+}
+
 /*
 * Test functions:
 *   relay_api_protocol_cb_completion
@@ -41,6 +41,7 @@ extern "C"
 #include "src/plugins/relay/relay-client.h"
 #include "src/plugins/relay/relay-config.h"
 #include "src/plugins/relay/relay-http.h"
+#include "src/plugins/relay/relay-server.h"
 #include "src/plugins/relay/relay-websocket.h"
 #include "src/plugins/weechat-plugin.h"

@@ -161,6 +162,35 @@ TEST(RelayHttp, RequestAllocReinitFree)
    relay_http_request_free (request);
 }

+/*
+ * Test functions:
+ *   relay_http_add_to_body (body too large is rejected)
+ */
+
+TEST(RelayHttp, AddToBodyLimit)
+{
+    struct t_relay_http_request *request;
+    char *partial;
+
+    request = relay_http_request_alloc ();
+    CHECK(request);
+
+    /* announce a body larger than the maximum allowed */
+    request->status = RELAY_HTTP_BODY;
+    request->content_length = RELAY_HTTP_BODY_MAX_LENGTH + 1;
+    partial = strdup ("some body data");
+
+    relay_http_add_to_body (request, &partial);
+
+    /* the body must be rejected: nothing allocated, request ended */
+    POINTERS_EQUAL(NULL, request->body);
+    LONGS_EQUAL(0, request->body_size);
+    POINTERS_EQUAL(NULL, partial);
+    LONGS_EQUAL(RELAY_HTTP_END, request->status);
+
+    relay_http_request_free (request);
+}
+
 /*
 * Test functions:
 *   relay_http_url_decode
@@ -992,6 +1022,69 @@ TEST(RelayHttp, Recv)
    /* TODO: write tests */
 }

+/*
+ * Test functions:
+ *   relay_http_recv (partial message accumulated is bounded)
+ *
+ * Check that data received without any end-of-line does not grow the partial
+ * message buffer without limit.
+ */
+
+TEST(RelayHttp, RecvLimit)
+{
+    struct t_relay_server *server;
+    struct t_relay_client *client;
+    char *chunk;
+    int chunk_size, i;
+    size_t length1, length2;
+
+    /* disable auto-open of relay buffer (it would pollute other tests) */
+    config_file_option_set (relay_config_look_auto_open_buffer, "off", 1);
+
+    server = relay_server_new ("weechat", RELAY_PROTOCOL_WEECHAT, NULL,
+                               9000,
+                               NULL,  /* path */
+                               1,  /* ipv4 */
+                               0,  /* ipv6 */
+                               0,  /* tls */
+                               0);  /* unix_socket */
+    CHECK(server);
+    client = relay_client_new (-1, "test", server);
+    CHECK(client);
+
+    chunk_size = 1024 * 1024;
+    chunk = (char *)malloc (chunk_size + 1);
+    CHECK(chunk);
+    memset (chunk, 'a', chunk_size);
+    chunk[chunk_size] = '\0';
+
+    /* feed more than the maximum, with no end-of-line (16 MB) */
+    for (i = 0; i < 16; i++)
+    {
+        relay_http_recv (client, chunk, chunk_size);
+    }
+    CHECK(client->partial_message);
+    length1 = strlen (client->partial_message);
+
+    /* the partial message must be bounded (not ~16 MB) */
+    CHECK(length1 <= RELAY_HTTP_PARTIAL_MESSAGE_MAX_LENGTH + (size_t)chunk_size);
+
+    /* feeding more data must not grow it any further */
+    for (i = 0; i < 16; i++)
+    {
+        relay_http_recv (client, chunk, chunk_size);
+    }
+    length2 = strlen (client->partial_message);
+    LONGS_EQUAL(length1, length2);
+
+    free (chunk);
+    relay_client_free (client);
+    relay_server_free (server);
+
+    /* restore auto-open of relay buffer */
+    config_file_option_reset (relay_config_look_auto_open_buffer, 1);
+}
+
 /*
 * Test functions:
 *   relay_http_compress
@@ -510,7 +510,44 @@ TEST(RelayWebsocket, Inflate)

 TEST(RelayWebsocket, DecodeFrame)
 {
-    /* TODO: write tests */
+    struct t_relay_websocket_frame *frames;
+    char *partial_ws_frame;
+    int num_frames, partial_ws_frame_size;
+    /* small unmasked binary frame with payload "hello" */
+    unsigned char frame_ok[7] = { 0x82, 0x05, 'h', 'e', 'l', 'l', 'o' };
+    /* masked frame announcing a 1 GB payload (64-bit length field) */
+    unsigned char frame_too_big[10] = {
+        0x82, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
+    };
+
+    /* a valid small frame is decoded */
+    frames = NULL;
+    num_frames = 0;
+    partial_ws_frame = NULL;
+    partial_ws_frame_size = 0;
+    LONGS_EQUAL(1, relay_websocket_decode_frame (
+                    frame_ok, sizeof (frame_ok), 0, NULL,
+                    &frames, &num_frames, &partial_ws_frame,
+                    &partial_ws_frame_size));
+    LONGS_EQUAL(1, num_frames);
+    CHECK(frames);
+    LONGS_EQUAL(5, frames[0].payload_size);
+    MEMCMP_EQUAL("hello", frames[0].payload, 5);
+    free (frames[0].payload);
+    free (frames);
+    free (partial_ws_frame);
+
+    /* a frame announcing an oversized payload is rejected (return 0) */
+    frames = NULL;
+    num_frames = 0;
+    partial_ws_frame = NULL;
+    partial_ws_frame_size = 0;
+    LONGS_EQUAL(0, relay_websocket_decode_frame (
+                    frame_too_big, sizeof (frame_too_big), 1, NULL,
+                    &frames, &num_frames, &partial_ws_frame,
+                    &partial_ws_frame_size));
+    free (frames);
+    free (partial_ws_frame);
 }

 /*
@@ -25,6 +25,11 @@

 extern "C"
 {
+#include <stdlib.h>
+#include <string.h>
+#include "src/core/core-config-file.h"
+#include "src/plugins/xfer/xfer.h"
+#include "src/plugins/xfer/xfer-config.h"
 #include "src/plugins/xfer/xfer-file.h"
 }

@@ -32,6 +37,42 @@ TEST_GROUP(XferFile)
 {
 };

+/*
+ * Build a "file recv" xfer with the given remote nick (and a fixed filename),
+ * call xfer_file_find_filename and return a copy of the basename of the local
+ * filename (the part after the last directory separator).
+ *
+ * Note: result must be freed after use.
+ */
+
+static char *
+test_find_filename_basename (const char *remote_nick)
+{
+    struct t_xfer xfer;
+    char *pos, *result;
+
+    memset (&xfer, 0, sizeof (xfer));
+    xfer.type = XFER_TYPE_FILE_RECV_ACTIVE;
+    xfer.remote_nick = strdup (remote_nick);
+    xfer.filename = strdup ("test.txt");
+
+    xfer_file_find_filename (&xfer);
+
+    result = NULL;
+    if (xfer.local_filename)
+    {
+        pos = strrchr (xfer.local_filename, DIR_SEPARATOR_CHAR);
+        result = strdup ((pos) ? pos + 1 : xfer.local_filename);
+    }
+
+    free (xfer.remote_nick);
+    free (xfer.filename);
+    free (xfer.local_filename);
+    free (xfer.temp_local_filename);
+
+    return result;
+}
+
 /*
 * Test functions:
 *   xfer_file_search_crc32
@@ -91,7 +132,30 @@ TEST(XferFile, FindSuffix)

 TEST(XferFile, FindFilename)
 {
-    /* TODO: write tests */
+    char *basename;
+
+    config_file_option_set (xfer_config_file_download_path, "/tmp/weechat_test_xfer", 1);
+
+    /* remote nick without directory separator: used as-is */
+    basename = test_find_filename_basename ("alice");
+    STRCMP_EQUAL("alice.test.txt", basename);
+    free (basename);
+
+    /*
+     * remote nick with a directory separator: the separator is replaced by
+     * "_" so the nick cannot make the file be written outside the download
+     * directory
+     */
+    basename = test_find_filename_basename ("../foo");
+    STRCMP_EQUAL(".._foo.test.txt", basename);
+    free (basename);
+
+    /* all directory separators in the nick are replaced */
+    basename = test_find_filename_basename ("a/b/c");
+    STRCMP_EQUAL("a_b_c.test.txt", basename);
+    free (basename);
+
+    config_file_option_unset (xfer_config_file_download_path);
 }

 /*
@@ -41,7 +41,7 @@
 #     devel-number   the devel version as hex number ("0x04010000" for "4.1.0-dev")
 #

-weechat_stable="4.9.1"
+weechat_stable="4.9.2"
 weechat_devel="4.10.0-dev"

 stable_major=$(echo "${weechat_stable}" | cut -d"." -f1)
Author	SHA1	Message	Date
Sébastien Helleu	3200a05c00	relay/api: fix memory leak in resources "handshake", "input" and "completion"	2026-06-17 21:54:15 +02:00
Sébastien Helleu	861f589fc2	core: update ChangeLog (#2326 )	2026-06-17 21:31:03 +02:00
aizu-m	c40261aed1	xfer: fix out-of-bounds write in xfer_dcc_resume_hash (#2326 )	2026-06-17 21:29:45 +02:00
Sébastien Helleu	770e733303	ci: switch from Ubuntu 24.04 to 26.04	2026-06-15 21:55:54 +02:00
Sébastien Helleu	9bd2aaa25d	core: mute compiler warning on calls to `dup()` function	2026-06-15 08:22:03 +02:00
Sébastien Helleu	4e206ee3ae	trigger: use "const char *" variables for result of string functions with const parameter	2026-06-15 07:55:20 +02:00
Sébastien Helleu	7ff71d2b0e	spell: use "const char *" variables for result of string functions with const parameter	2026-06-15 07:55:10 +02:00
Sébastien Helleu	203fdca3e8	script: use "const char *" variables for result of string functions with const parameter	2026-06-15 07:54:40 +02:00
Sébastien Helleu	e3ba25df19	relay: use "const char *" variables for result of string functions with const parameter	2026-06-15 07:54:10 +02:00
Sébastien Helleu	64566629c5	irc: use "const char *" variables for result of string functions with const parameter	2026-06-15 07:52:12 +02:00
Sébastien Helleu	7e3afaf46d	core, api: use "const char *" variables for result of string functions with const parameter	2026-06-15 07:52:10 +02:00
Sébastien Helleu	cf702d541f	api: change type of parameter "pos_option_name" to "const char **" in function config_search_with_string	2026-06-15 07:29:33 +02:00
Sébastien Helleu	a8067751eb	doc/plugin: fix parameters of mkdir functions The directory parameter is always `const char ` and not `char `.	2026-06-15 07:29:28 +02:00
Sébastien Helleu	a696a100d8	core: update ChangeLog (#2325 )	2026-06-12 13:02:05 +02:00
aizu-m	e60786d059	core: fix buffer overflow in function network_pass_socks5proxy (#2325 ) bound the configured proxy username and password before they are copied into the fixed stack buffer in network_pass_socks5proxy, otherwise a login longer than the buffer (a long password or token) overruns it while building the SOCKS5 auth request.	2026-06-12 13:00:17 +02:00
Sébastien Helleu	d78105ddf5	core: add CVE IDs in ChangeLog	2026-06-09 22:10:17 +02:00
weechatter	2a8c86242b	core: update German translations	2026-06-09 10:42:23 +02:00
Sébastien Helleu	dd9ef2f4d9	tests: add missing include of string.h	2026-06-08 23:17:19 +02:00
Sébastien Helleu	4c6c55befe	core: update translations	2026-06-08 23:15:00 +02:00
Sébastien Helleu	de878b2303	relay/api: remove error 400 which is never returned in response to `GET /api/scripts`	2026-06-08 23:11:27 +02:00
Sébastien Helleu	80a47b6731	relay/api: add missing fields in script object in OpenAPI document	2026-06-08 23:11:06 +02:00
Sébastien Helleu	551c12e049	relay/api: add resource `GET /api/scripts`	2026-06-08 23:04:40 +02:00
Sébastien Helleu	12016c4c05	script: add info "script_languages"	2026-06-08 18:54:06 +02:00
Sébastien Helleu	3aeaa70e64	ci: bump poexam to version 0.0.11	2026-06-07 21:56:22 +02:00
Sébastien Helleu	66e633e27e	core: add version 4.9.2	2026-06-07 11:51:55 +02:00
Sébastien Helleu	436bbeceff	tests: increase buffer size for injection of fake IRC message	2026-06-07 08:47:36 +02:00
Sébastien Helleu	c307087e2d	core: update ChangeLog (#2324 )	2026-06-06 11:19:14 +02:00
aizu-m	51a1149852	relay: fix out-of-bounds read in relay_http_print_log_request (#2324 )	2026-06-06 11:18:06 +02:00
Sébastien Helleu	d74993a42c	relay: limit size of partial message received while reading an HTTP request to prevent memory exhaustion A relay client could send data with no end-of-line (an unterminated method or header line) and dribble its payload, making WeeChat accumulate it in the partial message buffer that grew without limit, until all memory was exhausted. This path is reachable before authentication during websocket initialization with the "weechat" and "irc" protocols. The accumulated partial message is now bounded by RELAY_HTTP_PARTIAL_MESSAGE_MAX_LENGTH: once the limit is reached, the extra data is ignored.	2026-06-06 09:36:22 +02:00
Sébastien Helleu	51464e400f	core: add links to issues in ChangeLog (#2321 , #2322 )	2026-06-06 07:20:41 +02:00
Sébastien Helleu	1c5e6c3fc2	core: update ChangeLog (#2323 )	2026-06-06 07:20:38 +02:00
Sébastien Helleu	e563dfc903	doc: add build of Serbian API Relay doc	2026-06-06 07:09:04 +02:00
Sébastien Helleu	befbcceb7f	relay/api: add field "last_read_line_id" in GET /api/buffers	2026-06-06 07:04:46 +02:00
aizu-m	56f9ad68fb	xfer: fix out-of-bounds read in xfer_chat_recv_cb on empty line (#2323 )	2026-06-06 07:01:18 +02:00
aizu-m	328f86affc	irc: fix out-of-bounds read in DCC command with quoted filename	2026-06-04 23:17:58 +02:00
Sébastien Helleu	f4dc30ec58	tests: add tests on function xfer_file_find_filename	2026-06-04 23:17:58 +02:00
aizu-m	23291acb7b	xfer: replace directory separator in remote nick by underscore in download filename	2026-06-04 22:38:08 +02:00
Sébastien Helleu	b802681230	api: fix infinite loop in function string_replace when the search string is empty	2026-06-03 21:15:16 +02:00
Sébastien Helleu	3687ce0f0f	relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion A relay client could announce a huge websocket frame (or HTTP body via "Content-Length") and dribble its payload, making WeeChat accumulate it in a buffer that grew without limit, until all memory was exhausted. The websocket frame path is reachable before authentication with the "weechat" and "irc" protocols. The announced websocket frame length and HTTP "Content-Length" are now bounded by WEBSOCKET_FRAME_MAX_LENGTH and RELAY_HTTP_BODY_MAX_LENGTH: an oversized websocket frame closes the connection, and an oversized body is rejected.	2026-06-01 21:56:34 +02:00
Sébastien Helleu	1211510ded	irc: limit size of data received from the server to prevent memory exhaustion A malicious or compromised IRC server could send data with no end-of-line (or a flood of "005" messages), making WeeChat accumulate it in a buffer that grew without limit, until all memory was exhausted. The unterminated received message and the accumulated "005" (ISUPPORT) data are now bounded by IRC_SERVER_RECV_MSG_MAX_LENGTH and IRC_SERVER_ISUPPORT_MAX_LENGTH: extra data is ignored once the limit is reached.	2026-06-01 21:53:03 +02:00
aizu-m	07871f123f	core: fix possible integer truncation in function eval_string_split (#2320 )	2026-06-01 10:25:35 +02:00
Sébastien Helleu	a0cf82d4a6	core: replace Bash/Ubuntu with WSL in README	2026-05-31 17:24:41 +02:00
Sébastien Helleu	13291b6b9a	core: add missing trailing slash to Ruby scripts URL in README	2026-05-31 17:24:24 +02:00
Sébastien Helleu	76d652a513	core: fix multi-protocol feature wording in README	2026-05-31 17:24:13 +02:00
Sébastien Helleu	ff9b698665	core: improve wording of semantic versioning section in README	2026-05-31 17:24:01 +02:00
Sébastien Helleu	d5c985eb11	core: add security policy in SECURITY.md	2026-05-31 16:04:33 +02:00