Version 4.7.1

When invalid data is received (not an HTTP request), client->http_req->method
is NULL, so we have to check it's not NULL before comparing it to the supported
methods.

This fixes a regression introduced in commit
93ec10b563.

.github/workflows/ci.yml

@@ -194,11 +194,13 @@ jobs:
         weechat-headless \
           --dir /tmp/weechat-test-api \
           --run-command '/set relay.network.password "${{ env.RELAY_PASSWORD }}"' \
+          --run-command '/set relay.network.password_hash_iterations 100' \
+          --run-command '/set relay.network.max_clients 0' \
           --run-command '/relay add api 9000' \
           --daemon \
         ;
         sleep 5
-        ./tools/test_relay_api.sh http://localhost:9000
+        schemathesis run --url http://localhost:9000/api ./src/plugins/relay/api/weechat-relay-api.yaml
         echo '*/quit' >/tmp/weechat-test-api/weechat_fifo_*
 
     - name: Code coverage

CHANGELOG.md

@@ -6,7 +6,13 @@ SPDX-License-Identifier: GPL-3.0-or-later
 
 # WeeChat ChangeLog
 
-## Version 4.7.0 (under dev)
+## Version 4.7.1 (2025-08-16)
+
+### Fixed
+
+- relay/api: fix crash when an invalid HTTP request is received from a client
+
+## Version 4.7.0 (2025-07-19)
 
 ### Changed
 
@@ -15,6 +21,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
 - core: write configuration files on disk only if there are changes ([#2250](https://github.com/weechat/weechat/issues/2250))
 - core: always enable partial completion for templates in option weechat.completion.partial_completion_templates, add option weechat.completion.partial_completion_auto_expand to expand word on new completion ([#2253](https://github.com/weechat/weechat/issues/2253))
 - core: add script name in output of `/debug hooks <plugin>`
+- relay/api: return HTTP error 405 (Method Not Allowed) when the method received is not allowed
 
 ### Added
 
@@ -37,6 +44,8 @@ SPDX-License-Identifier: GPL-3.0-or-later
 - core: fix memory leak in function util_parse_delay
 - irc: display nick changes and quit messages when option irc.look.ignore_tag_messages is enabled ([#2241](https://github.com/weechat/weechat/issues/2241))
 - perl: fix build when multiplicity is not available ([#2243](https://github.com/weechat/weechat/issues/2243))
+- relay/api: reject any invalid or unknown password hash algorithm in handshake resource
+- relay/api: process HTTP request received as soon as a NULL char is received
 - relay/weechat: fix empty buffers in client when WeeChat is running on Solaris/illumos
 - build: fix build on Solaris/illumos (issue #2251)
 

doc/sr/weechat_dev.sr.adoc

@@ -91,33 +91,23 @@ qweechat::
 |       typing/      | Typing додатак.
 |       xfer/        | Xfer додатак (IRC DCC фајл/разговор).
 | tests/             | Тестови.
-// TRANSLATION MISSING
+|    fuzz/           | Fuzz тестирање.
-|    fuzz/           | Fuzz testing.
+|       core/        | Fuzz тестирање функција језгра.
-// TRANSLATION MISSING
-|       core/        | Fuzz testing for core functions.
 |    unit/           | Unit тестови.
 |       core/        | Unit тестови за функције језгра.
-// TRANSLATION MISSING
+|          hook/     | Unit тестову за функције куке.
-|          hook/     | Unit tests for hook functions.
 |       gui/         | Unit тестови за функције интерфејса.
-// TRANSLATION MISSING
+|          curses/   | Unit тестови за функције Curses интерфејса.
-|          curses/   | Unit tests for Curses interface functions.
 |       scripts/     | Тестови за API скриптовања.
 |          python/   | Python скрипте за генерисање и покретање тестова за API скриптовања.
 |       plugins/     | Unit тестови за додатке.
-// TRANSLATION MISSING
+|          alias/    | Unit тестови за alias додатак.
-|          alias/    | Unit tests for alias plugin.
 |          irc/      | Unit тестови за IRC додатак.
-// TRANSLATION MISSING
+|          logger/   | Unit тестови за logger додатак.
-|          logger/   | Unit tests for logger plugin.
+|          relay/    | Unit тестови за relay додатак.
-// TRANSLATION MISSING
+|          trigger/  | Unit тестови за trigger додатак.
-|          relay/    | Unit tests for relay plugin.
+|          typing/   | Unit тестови за typing додатак.
-// TRANSLATION MISSING
+|          xfer/     | Unit тестови за xfer додатак.
-|          trigger/  | Unit tests for trigger plugin.
-// TRANSLATION MISSING
-|          typing/   | Unit tests for typing plugin.
-// TRANSLATION MISSING
-|          xfer/     | Unit tests for xfer plugin.
 | doc/               | Документација.
 | po/                | Фајлови превода (gettext).
 | debian/            | Debian паковање.
@@ -426,24 +416,15 @@ WeeChat „језгро” се налази у следећим директо
 |===
 | Путања/фајл                                     | Опис
 | tests/                                          | Корен тестова.
-// TRANSLATION MISSING
+|    fuzz/                                        | Корен fuzz тестирања.
-|    fuzz/                                        | Root of fuzz testing.
+|       ossfuzz.sh                                | Скрипта изградње за https://github.com/google/oss-fuzz[OSS-Fuzz ^↗^^].
-// TRANSLATION MISSING
+|       core/                                     | Корен fuzz тестирања за језгро.
-|       ossfuzz.sh                                | Build script for https://github.com/google/oss-fuzz[OSS-Fuzz ^↗^^].
+|          calc-fuzzer.c                          | Fuzz тестирање: калкулација израза.
-// TRANSLATION MISSING
+|          crypto-fuzzer.c                        | Fuzz тестирање: криптографске функције.
-|       core/                                     | Root of fuzz testing for core.
+|          secure-fuzzer.c                        | Fuzz тестирање: обезбеђени подаци.
-// TRANSLATION MISSING
+|          string-fuzzer.c                        | Fuzz тестирање: стрингови.
-|          calc-fuzzer.c                          | Fuzz testing: калкулација израза.
+|          utf8-fuzzer.c                          | Fuzz тестирање: UTF-8.
-// TRANSLATION MISSING
+|          util-fuzzer.c                          | Fuzz тестирање: услужне функције.
-|          crypto-fuzzer.c                        | Fuzz testing: криптографске функције.
-// TRANSLATION MISSING
-|          secure-fuzzer.c                        | Fuzz testing: secured data.
-// TRANSLATION MISSING
-|          string-fuzzer.c                        | Fuzz testing: стрингови.
-// TRANSLATION MISSING
-|          utf8-fuzzer.c                          | Fuzz testing: UTF-8.
-// TRANSLATION MISSING
-|          util-fuzzer.c                          | Fuzz testing: utility functions.
 |    unit/                                        | Корен unit тестова.
 |       tests.cpp                                 | Програм који се користи за извршавање свих тестова.
 |       tests-record.cpp                          | Бележење и претрага у приказаним порукама.
@@ -490,13 +471,10 @@ WeeChat „језгро” се налази у следећим директо
 |             test-hook-timer.cpp                 | Тестови: куке „timer”.
 |             test-hook-url.cpp                   | Тестови: куке „url”.
 |       gui/                                      | Корен unit тестова интерфејса.
-// TRANSLATION MISSING
+|          test-gui-bar-item-custom.cpp           | Тестови: функције ставки прилагођене траке.
-|          test-gui-bar-item-custom.cpp           | Tests: custom bar item functions.
+|          test-gui-bar-item.cpp                  | Тестови: функције ставки траке.
-// TRANSLATION MISSING
-|          test-gui-bar-item.cpp                  | Tests: bar item functions.
 |          test-gui-bar-window.cpp                | Тестови: функције прозора траке.
-// TRANSLATION MISSING
+|          test-gui-bar.cpp                       | Тестови: функције траке.
-|          test-gui-bar.cpp                       | Tests: bar functions.
 |          test-gui-buffer.cpp                    | Тестови: бафер функције.
 |          test-gui-chat.cpp                      | Тестови: чет функције.
 |          test-gui-color.cpp                     | Тестови: боје.
@@ -519,10 +497,8 @@ WeeChat „језгро” се налази у следећим директо
 |          test-plugin-config.cpp                 | Тестови: функције конфигурације додатка.
 |          test-plugin-api-info.cpp               | Тестови: инфо функције API додатака.
 |          test-plugins.cpp                       | Тестови: plugins.
-// TRANSLATION MISSING
+|          alias/                                 | Корен unit тестова за alias додатак.
-|          alias/                                 | Root of unit tests for alias plugin.
+|             test-alias.cpp                      | Тестови: алијаси.
-// TRANSLATION MISSING
-|             test-alias.cpp                      | Tests: aliases.
 |          irc/                                   | Корен unit тестова IRC додатка.
 |             test-irc-batch.cpp                  | Тестови: IRC пакетни догађаји.
 |             test-irc-buffer.cpp                 | Тестови: IRC бафери.
@@ -556,12 +532,9 @@ WeeChat „језгро” се налази у следећим директо
 |                test-relay-api.cpp               | Тестови: Релеј „api” протокол: опште функције.
 |                test-relay-api-msg.cpp           | Тестови: Релеј „api” протокол: поруке.
 |                test-relay-api-protocol.cpp      | Тестови: Релеј „api” протокол: протокол.
-// TRANSLATION MISSING
+|                remote/                          | Тестови: Релеј „api” протокол: удаљене функције.
-|                remote/                          | Tests: Relay "api" protocol: remote functions.
+|                   test-relay-remote-event.cpp   | Тестови: Релеј „api” протокол: удаљени догађаји.
-// TRANSLATION MISSING
+|                   test-relay-remote-network.cpp | Тестови: Релеј „api” протокол: удаљена мрежа.
-|                   test-relay-remote-event.cpp   | Tests: Relay "api" protocol: remote events.
-// TRANSLATION MISSING
-|                   test-relay-remote-network.cpp | Tests: Relay "api" protocol: remote network.
 |             irc/                                | Корен unit тестова за Релеј „irc” протокол.
 |                test-relay-irc.cpp               | Тестови: Релеј „irc” протокол.
 |          trigger/                               | Корен unit тестова за окидач додатак.
@@ -1262,13 +1235,11 @@ server->hook_timer_sasl = weechat_hook_timer (timeout * 1000,
 
 | tests/fuzz
 | tests/fuzz/*
-// TRANSLATION MISSING
+| Fuzz тестирање
-| Fuzz testing
 
 | tests/unit
 | tests/unit/*
-// TRANSLATION MISSING
+| Unit тестови
-| Unit tests
 
 | doc
 | doc/*

doc/sr/weechat_plugin_api.sr.adoc

@@ -4484,12 +4484,11 @@ if (weechat_file_compress ("/tmp/test.txt", "/tmp/test.txt.zst", "zstd", 50))
 [NOTE]
 Ова функција није доступна у API скриптовања.
 
-// TRANSLATION MISSING
 ==== file_compare
 
 _WeeChat ≥ 4.7.0._
 
-Compare the content of two files.
+Пореди садржаје два фајла.
 
 Прототип:
 
@@ -4500,14 +4499,14 @@ int weechat_file_compare (const char *filename1, const char *filename2);
 
 Аргументи:
 
-* _filename1_: first file to compare
+* _filename1_: први фајл за поређење
-* _filename2_: second file to compare
+* _filename2_: други фајл за поређење
 
 Повратна вредност:
 
-* 0: both files have same content
+* 0: оба фајла имају исти садржај
-* 1: content is different
+* 1: садржај се разликује
-* 2: error (file not found or read error)
+* 2: грешка (фајл није пронађен или грешка при читању)
 
 C пример:
 
@@ -4515,7 +4514,7 @@ C пример:
 ----
 if (weechat_file_compare ("/tmp/test.txt", "/tmp/test2.txt") == 0)
 {
-    /* same content */
+    /* исти садржај */
 }
 ----
 
@@ -4680,9 +4679,8 @@ int weechat_util_strftimeval (char *string, int max, const char *format, struct
 * _string_: бафер у који се смешта форматирани стринг
 * _max_: величина стринга
 * _format_: формат, исто као за _strftime_ функцију, са следећим додатним спецификаторима:
-// TRANSLATION MISSING
+** `%@`: враћа датум изражен у Coordinated Universal Time (UTC) уместо као датум
-** `%@`: return the date expressed in Coordinated Universal Time (UTC)
+   релативан у односу на временску зону коју је задао корисник _(WeeChat ≥ 4.7.0)_
-   instead of date relative to the user's specified timezone _(WeeChat ≥ 4.7.0)_
 ** `%.N` где је `N` између 1 и 6: микросекунде допуњене нулама на N цифара
    (на пример `%.3` за милисекунде)
 ** `%f`: алијас за `%.6`

doc/sr/weechat_user.sr.adoc

@@ -1002,8 +1002,7 @@ WeeChat командна линија (на дну прозора) вам омо
   kbd:[yyyyyy]           | Текст у боји `xxxxxx` и позадина `yyyyyy` (RGB као хексадецимални број).
 | kbd:[Ctrl+c], kbd:[i]  | Текст у курзиву.
 | kbd:[Ctrl+c], kbd:[o]  | Искључивање боје и атрибута.
-// TRANSLATION MISSING
+| kbd:[Ctrl+c], kbd:[s]  | Прецртани текст (у ncurses интерфејсу се приказује као полусветао јер се не подржава прецртавање).
-| kbd:[Ctrl+c], kbd:[s]  | Strikethrough text (displayed as half bright in ncurses interface because strikethrough is not supported).
 | kbd:[Ctrl+c], kbd:[v]  | Обрнути видео (боје текста и позадине се замењују једна са другом).
 | kbd:[Ctrl+c], kbd:[_]  | Подвучени текст.
 |===
@@ -1549,8 +1548,7 @@ WeeChat нуди доста подразумеваних тастерских п
 | kbd:[Ctrl+c], kbd:[d] | Уметање кода за обојени текст (RGB боја, као хексадецимални број). | `+/input insert \x04+`
 | kbd:[Ctrl+c], kbd:[i] | Уметање кода за текст у курзиву. | `+/input insert \x1D+`
 | kbd:[Ctrl+c], kbd:[o] | Уметање кода за ресет боје. | `+/input insert \x0F+`
-// TRANSLATION MISSING
+| kbd:[Ctrl+c], kbd:[s] | Уметање кода за прецртани текст. | `+/input insert \x1E+`
-| kbd:[Ctrl+c], kbd:[s] | Insert code for strikethrough text. | `+/input insert \x1E+`
 | kbd:[Ctrl+c], kbd:[v] | Уметање кода за обрнуту боју. | `+/input insert \x16+`
 | kbd:[Ctrl+c], kbd:[_] | Уметање кода за подвучени текст. | `+/input insert \x1F+`
 |===

po/cs.po

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-04 09:24+0200\n"
 "Last-Translator: Ondřej Súkup <mimi.vx@gmail.com>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -14025,6 +14025,10 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "%s%s: selhalo parsování příkazu \"%s\" (prosím oznamte to vývojárům):"
 
+#, fuzzy, c-format
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s%s: TLS handshake selhal"
+
 #, fuzzy, c-format
 #| msgid "%s%s: unable to create socket"
 msgid "%sremote[%s]: unable to send data, disconnecting"

po/de.po

@@ -28,7 +28,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-05 09:24+0200\n"
 "Last-Translator: Nils Görs <weechatter@arcor.de>\n"
 "Language-Team: German <kde-i18n-de@kde.org>\n"
@@ -15419,6 +15419,11 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "%s%s: Route „%s %s“ für Client %s%s%s konnte nicht ausgeführt werden"
 
+#, fuzzy, c-format
+#| msgid "%s%s: invalid websocket handshake received for client %s%s%s"
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s%s: ungültigen WebSocket Handshake für Client %s%s%s empfangen"
+
 #, c-format
 msgid "%sremote[%s]: unable to send data, disconnecting"
 msgstr ""

po/es.po

@@ -24,7 +24,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-04 09:25+0200\n"
 "Last-Translator: Santiago Forero <santiago@forero.xyz>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -14359,6 +14359,10 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "%s%s: falló la ejecución del comando \"%s\" por el cliente %s%s%s"
 
+#, fuzzy, c-format
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s%s: agotado el tiempo de espera del saludo TLS del cliente %s%s%s"
+
 #, fuzzy, c-format
 #| msgid "%s%s: unable to create socket"
 msgid "%sremote[%s]: unable to send data, disconnecting"

po/fr.po

@@ -23,8 +23,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
-"PO-Revision-Date: 2025-06-30 09:34+0200\n"
+"PO-Revision-Date: 2025-08-16 19:27+0200\n"
 "Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
 "Language: fr\n"
@@ -15116,6 +15116,10 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "%s%s : échec d'exécution de la route \"%s %s\" pour le client %s%s%s"
 
+#, c-format
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s%s : données invalides reçues du client %s%s%s"
+
 #, c-format
 msgid "%sremote[%s]: unable to send data, disconnecting"
 msgstr "%sremote[%s] : impossible d'envoyer des données, déconnexion"

po/hu.po

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-04 09:25+0200\n"
 "Last-Translator: Andras Voroskoi <voroskoi@frugalware.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -13424,6 +13424,10 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "Nem sikerült a(z) \"%s\" naplófájlt írni\n"
 
+#, fuzzy, c-format
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s gnutls kézfogás sikertelen\n"
+
 #, fuzzy, c-format
 msgid "%sremote[%s]: unable to send data, disconnecting"
 msgstr "%s nem sikerült a szervert létrehozni\n"

po/it.po

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-04 09:25+0200\n"
 "Last-Translator: Esteban I. Ruiz Moreno <exio4.com@gmail.com>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -14361,6 +14361,10 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "%s%s: impossibile eseguire il comando \"%s\" per il client %s%s%s"
 
+#, fuzzy, c-format
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s%s: set di caratter invalido: \"%s\""
+
 #, fuzzy, c-format
 #| msgid "%s%s: unable to create socket"
 msgid "%sremote[%s]: unable to send data, disconnecting"

po/ja.po

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-04 09:25+0200\n"
 "Last-Translator: AYANOKOUZI, Ryuunosuke <i38w7i3@yahoo.co.jp>\n"
 "Language-Team: Japanese <https://github.com/l/weechat/tree/master/"
@@ -14849,6 +14849,12 @@ msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr ""
 "%1$s%2$s: クライアント %4$s%5$s%6$s に対するコマンド \"%3$s\" の実行に失敗"
 
+#, fuzzy, c-format
+#| msgid "%s%s: invalid websocket handshake received for client %s%s%s"
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr ""
+"%s%s: クライアント %s%s%s から受け取った不正なウェブソケットハンドシェイク"
+
 #, fuzzy, c-format
 #| msgid "%s%s: unable to create socket"
 msgid "%sremote[%s]: unable to send data, disconnecting"

po/pl.po

@@ -24,7 +24,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-04 09:25+0200\n"
 "Last-Translator: Krzysztof Korościk <soltys@soltys.info>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -15045,6 +15045,12 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "%s%s: nie udało się wykonać trasy „%s %s” dla klienta %s%s%s"
 
+#, fuzzy, c-format
+#| msgid "%s%s: invalid websocket handshake received for client %s%s%s"
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr ""
+"%s%s: otrzymano niepoprawny pakiet dla gniazda webowego od klienta %s%s%s"
+
 #, fuzzy, c-format
 #| msgid "%sremote[%s]: unable to create socket"
 msgid "%sremote[%s]: unable to send data, disconnecting"

po/pt.po

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-04 09:25+0200\n"
 "Last-Translator: Vasco Almeida <vascomalmeida@sapo.pt>\n"
 "Language-Team: Portuguese <>\n"
@@ -14734,6 +14734,11 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "%s%s: falha ao executar o comando \"%s\" do cliente %s%s%s"
 
+#, fuzzy, c-format
+#| msgid "%s%s: invalid websocket handshake received for client %s%s%s"
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s%s: websocket handshake inválido recebido do cliente %s%s%s"
+
 #, fuzzy, c-format
 #| msgid "%s%s: unable to create socket"
 msgid "%sremote[%s]: unable to send data, disconnecting"

po/pt_BR.po

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-04 09:25+0200\n"
 "Last-Translator: Érico Nogueira <ericonr@disroot.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -13857,6 +13857,10 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "%s%s: falha ao executar comando \"%s\" para cliente %d"
 
+#, fuzzy, c-format
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s%s: handshake TLS falhou"
+
 #, fuzzy, c-format
 msgid "%sremote[%s]: unable to send data, disconnecting"
 msgstr "%s%s: não foi possível criar pipe"

po/ru.po

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2025-05-04 09:25+0200\n"
 "Last-Translator: Aleksey V Zapparov AKA ixti <ixti@member.fsf.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -13476,6 +13476,10 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "Не могу записать лог-файл \"%s\"\n"
 
+#, fuzzy, c-format
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s инициализация gnutls не удалось\n"
+
 #, fuzzy, c-format
 msgid "%sremote[%s]: unable to send data, disconnecting"
 msgstr "%s не могу создать сервер\n"

po/sr.po

@@ -22,8 +22,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
-"PO-Revision-Date: 2025-05-04 09:25+0200\n"
+"PO-Revision-Date: 2025-07-09 15:48+0400\n"
 "Last-Translator: Ivan Pešić <ivan.pesic@gmail.com>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
 "Language: sr\n"
@@ -5864,6 +5864,7 @@ msgstr "шаље упозорење (BEL) када се догоди делим
 msgid ""
 "automatically expand word after partial completion when completing again"
 msgstr ""
+"када се поново довршава, аутоматски развија реч након делимичног довршавања"
 
 msgid ""
 "partially complete command names (stop when many commands found begin with "
@@ -7439,10 +7440,10 @@ msgstr ""
 "бафера"
 
 msgid "    - ${number_zero}: like ${number} but the number is zero-padded"
-msgstr ""
+msgstr "    - ${number_zero}: као ${number} али се број допуњава нулама"
 
 msgid "    - ${number_zero2}: like ${number2} but the number is zero-padded"
-msgstr ""
+msgstr "    - ${number_zero2}: као ${number2} али се број допуњава нулама"
 
 msgid ""
 "    - ${number_displayed}: \"1\" if the number is displayed, otherwise \"0\""
@@ -14668,6 +14669,11 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr "%s%s: није успело извршавање руте „%s %s” за клијента %s%s%s"
 
+#, fuzzy, c-format
+#| msgid "%s%s: invalid websocket handshake received for client %s%s%s"
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr "%s%s: примљено је неважеће вебсокет руковање од клијента %s%s%s"
+
 #, c-format
 msgid "%sremote[%s]: unable to send data, disconnecting"
 msgstr "%sудаљени[%s]: није могао да пошаље податке, веза се прекида"

po/weechat.pot

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2025-06-30 09:32+0200\n"
+"POT-Creation-Date: 2025-08-16 19:26+0200\n"
 "PO-Revision-Date: 2014-08-16 10:27+0200\n"
 "Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -12259,6 +12259,10 @@ msgstr ""
 msgid "%s%s: failed to execute route \"%s %s\" for client %s%s%s"
 msgstr ""
 
+#, c-format
+msgid "%s%s: invalid data received from client %s%s%s"
+msgstr ""
+
 #, c-format
 msgid "%sremote[%s]: unable to send data, disconnecting"
 msgstr ""

schemathesis.toml

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2025 Sébastien Helleu <flashcode@flashtux.org>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+continue-on-failure = true
+
+[[operations]]
+include-path-regex = "/sync/?.*"
+enabled = false
+
+[auth]
+basic = { username = "plain", password = "${RELAY_PASSWORD}" }

src/gui/gui-completion.c

@@ -1771,30 +1771,30 @@ gui_completion_print_log (void)
          ptr_completion = ptr_completion->next_completion)
     {
         log_printf ("[completion (addr:%p)]", ptr_completion);
-        log_printf ("  plugin. . . . . . . . . . : %p", ptr_completion->plugin);
+        log_printf ("  plugin. . . . . . . . . . . : %p", ptr_completion->plugin);
-        log_printf ("  buffer. . . . . . . . . . : %p ('%s')",
+        log_printf ("  buffer. . . . . . . . . . . : %p ('%s')",
                     ptr_completion->buffer,
                     ptr_completion->buffer->full_name);
-        log_printf ("  context . . . . . . . . . : %d", ptr_completion->context);
+        log_printf ("  context . . . . . . . . . . : %d", ptr_completion->context);
-        log_printf ("  case_sensitive. . . . . . : %d", ptr_completion->case_sensitive);
+        log_printf ("  case_sensitive. . . . . . . : %d", ptr_completion->case_sensitive);
-        log_printf ("  base_command. . . . . . . : '%s'", ptr_completion->base_command);
+        log_printf ("  base_command. . . . . . . . : '%s'", ptr_completion->base_command);
-        log_printf ("  base_command_arg_index. . : %d", ptr_completion->base_command_arg_index);
+        log_printf ("  base_command_arg_index. . . : %d", ptr_completion->base_command_arg_index);
-        log_printf ("  base_word . . . . . . . . : '%s'", ptr_completion->base_word);
+        log_printf ("  base_word . . . . . . . . . : '%s'", ptr_completion->base_word);
-        log_printf ("  base_word_pos . . . . . . : %d", ptr_completion->base_word_pos);
+        log_printf ("  base_word_pos . . . . . . . : %d", ptr_completion->base_word_pos);
-        log_printf ("  position. . . . . . . . . : %d", ptr_completion->position);
+        log_printf ("  position. . . . . . . . . . : %d", ptr_completion->position);
-        log_printf ("  args. . . . . . . . . . . : '%s'", ptr_completion->args);
+        log_printf ("  args. . . . . . . . . . . . : '%s'", ptr_completion->args);
-        log_printf ("  direction . . . . . . . . : %d", ptr_completion->direction);
+        log_printf ("  direction . . . . . . . . . : %d", ptr_completion->direction);
-        log_printf ("  add_space . . . . . . . . : %d", ptr_completion->add_space);
+        log_printf ("  add_space . . . . . . . . . : %d", ptr_completion->add_space);
-        log_printf ("  partial_completion. . . . : %d", ptr_completion->partial_completion);
+        log_printf ("  partial_completion. . . . . : %d", ptr_completion->partial_completion);
-        log_printf ("  template_partial_completion: %d", ptr_completion->template_partial_completion);
+        log_printf ("  template_partial_completion : %d", ptr_completion->template_partial_completion);
-        log_printf ("  list. . . . . . . . . . . : %p", ptr_completion->list);
+        log_printf ("  list. . . . . . . . . . . . : %p", ptr_completion->list);
-        log_printf ("  word_found. . . . . . . . : '%s'", ptr_completion->word_found);
+        log_printf ("  word_found. . . . . . . . . : '%s'", ptr_completion->word_found);
-        log_printf ("  word_found_is_nick. . . . : %d", ptr_completion->word_found_is_nick);
+        log_printf ("  word_found_is_nick. . . . . : %d", ptr_completion->word_found_is_nick);
-        log_printf ("  position_replace. . . . . : %d", ptr_completion->position_replace);
+        log_printf ("  position_replace. . . . . . : %d", ptr_completion->position_replace);
-        log_printf ("  diff_size . . . . . . . . : %d", ptr_completion->diff_size);
+        log_printf ("  diff_size . . . . . . . . . : %d", ptr_completion->diff_size);
-        log_printf ("  diff_length . . . . . . . : %d", ptr_completion->diff_length);
+        log_printf ("  diff_length . . . . . . . . : %d", ptr_completion->diff_length);
-        log_printf ("  prev_completion . . . . . : %p", ptr_completion->prev_completion);
+        log_printf ("  prev_completion . . . . . . : %p", ptr_completion->prev_completion);
-        log_printf ("  next_completion . . . . . : %p", ptr_completion->next_completion);
+        log_printf ("  next_completion . . . . . . : %p", ptr_completion->next_completion);
         if (ptr_completion->list && (ptr_completion->list->size > 0))
         {
             log_printf ("");

src/plugins/relay/api/relay-api-protocol.c

@@ -374,7 +374,7 @@ RELAY_API_PROTOCOL_CALLBACK(options)
     relay_api_msg_send_json (
         client,
         RELAY_HTTP_204_NO_CONTENT,
-        "Access-Control-Allow-Methods: GET, POST, PUT, DELETE\r\n"
+        "Access-Control-Allow-Methods: " RELAY_API_ALLOWED_METHODS "\r\n"
         "Access-Control-Allow-Headers: origin, content-type, accept, authorization",
         NULL,  /* body_type */
         NULL);  /* json_body */
@@ -401,9 +401,13 @@ RELAY_API_PROTOCOL_CALLBACK(handshake)
     json_body = cJSON_Parse (client->http_req->body);
     if (json_body)
     {
+        if (!cJSON_IsObject (json_body))
+            return RELAY_API_PROTOCOL_RC_BAD_REQUEST;
         json_algos = cJSON_GetObjectItem (json_body, "password_hash_algo");
         if (json_algos)
         {
+            if (!cJSON_IsArray (json_algos))
+                goto invalid_hash_algo;
             cJSON_ArrayForEach (json_algo, json_algos)
             {
                 ptr_algo = (cJSON_IsString (json_algo)) ?
@@ -411,7 +415,17 @@ RELAY_API_PROTOCOL_CALLBACK(handshake)
                 if (ptr_algo)
                 {
                     index_hash_algo = relay_auth_password_hash_algo_search (ptr_algo);
-                    if ((index_hash_algo >= 0) && (index_hash_algo > hash_algo_found))
+                    if (index_hash_algo < 0)
+                    {
+                        relay_api_msg_send_error_json (
+                            client,
+                            RELAY_HTTP_400_BAD_REQUEST, NULL,
+                            "Hash algorithm \"%s\" not found",
+                            ptr_algo);
+                        cJSON_Delete (json_body);
+                        return RELAY_API_PROTOCOL_RC_OK;
+                    }
+                    if (index_hash_algo > hash_algo_found)
                     {
                         if (weechat_string_match_list (
                                 relay_auth_password_hash_algo_name[index_hash_algo],
@@ -422,6 +436,8 @@ RELAY_API_PROTOCOL_CALLBACK(handshake)
                         }
                     }
                 }
+                else
+                    goto invalid_hash_algo;
             }
         }
     }
@@ -460,6 +476,14 @@ RELAY_API_PROTOCOL_CALLBACK(handshake)
         cJSON_Delete (json_body);
 
     return RELAY_API_PROTOCOL_RC_OK;
+
+invalid_hash_algo:
+    relay_api_msg_send_error_json (
+        client,
+        RELAY_HTTP_400_BAD_REQUEST, NULL,
+        "Invalid hash algorithm");
+    cJSON_Delete (json_body);
+    return RELAY_API_PROTOCOL_RC_OK;
 }
 
 /*
@@ -712,57 +736,55 @@ RELAY_API_PROTOCOL_CALLBACK(input)
     char str_delay[32];
 
     json_body = cJSON_Parse (client->http_req->body);
-    if (!json_body)
+    if (!json_body || !cJSON_IsObject (json_body))
         return RELAY_API_PROTOCOL_RC_BAD_REQUEST;
 
-    /* get buffer either by id or by name */
+    /* get buffer either by name or by id */
     ptr_buffer = NULL;
-    json_buffer_id = cJSON_GetObjectItem (json_body, "buffer_id");
+    json_buffer_name = cJSON_GetObjectItem (json_body, "buffer_name");
-    if (json_buffer_id)
+    if (json_buffer_name)
     {
-        if (cJSON_IsNumber (json_buffer_id))
+        if (cJSON_IsString (json_buffer_name))
         {
-            snprintf (str_id, sizeof (str_id),
+            ptr_buffer_name = cJSON_GetStringValue (json_buffer_name);
-                      "%lld", (long long)cJSON_GetNumberValue (json_buffer_id));
+            ptr_buffer = weechat_buffer_search ("==", ptr_buffer_name);
-            ptr_buffer = weechat_buffer_search ("==id", str_id);
             if (!ptr_buffer)
             {
                 relay_api_msg_send_error_json (
                     client,
                     RELAY_HTTP_400_BAD_REQUEST, NULL,
-                    "Buffer \"%lld\" not found",
+                    "Buffer \"%s\" not found",
-                    (long long)cJSON_GetNumberValue (json_buffer_id));
+                    ptr_buffer_name);
                 cJSON_Delete (json_body);
                 return RELAY_API_PROTOCOL_RC_OK;
             }
         }
     }
-    else
+    if (!ptr_buffer)
     {
-        json_buffer_name = cJSON_GetObjectItem (json_body, "buffer_name");
+        json_buffer_id = cJSON_GetObjectItem (json_body, "buffer_id");
-        if (json_buffer_name)
+        if (json_buffer_id)
         {
-            if (cJSON_IsString (json_buffer_name))
+            if (cJSON_IsNumber (json_buffer_id))
             {
-                ptr_buffer_name = cJSON_GetStringValue (json_buffer_name);
+                snprintf (str_id, sizeof (str_id),
-                ptr_buffer = weechat_buffer_search ("==", ptr_buffer_name);
+                          "%lld", (long long)cJSON_GetNumberValue (json_buffer_id));
+                ptr_buffer = weechat_buffer_search ("==id", str_id);
                 if (!ptr_buffer)
                 {
                     relay_api_msg_send_error_json (
                         client,
                         RELAY_HTTP_400_BAD_REQUEST, NULL,
-                        "Buffer \"%s\" not found",
+                        "Buffer \"%lld\" not found",
-                        ptr_buffer_name);
+                        (long long)cJSON_GetNumberValue (json_buffer_id));
                     cJSON_Delete (json_body);
                     return RELAY_API_PROTOCOL_RC_OK;
                 }
             }
         }
-        else
-        {
-            ptr_buffer = weechat_buffer_search_main ();
-        }
     }
+    if (!ptr_buffer)
+        ptr_buffer = weechat_buffer_search_main ();
     if (!ptr_buffer)
     {
         cJSON_Delete (json_body);
@@ -841,57 +863,55 @@ RELAY_API_PROTOCOL_CALLBACK(completion)
     struct t_gui_buffer *ptr_buffer;
 
     json_body = cJSON_Parse (client->http_req->body);
-    if (!json_body)
+    if (!json_body || !cJSON_IsObject(json_body))
         return RELAY_API_PROTOCOL_RC_BAD_REQUEST;
 
-    /* get buffer either by id or by name */
+    /* get buffer either by name or by id */
     ptr_buffer = NULL;
-    json_buffer_id = cJSON_GetObjectItem (json_body, "buffer_id");
+    json_buffer_name = cJSON_GetObjectItem (json_body, "buffer_name");
-    if (json_buffer_id)
+    if (json_buffer_name)
     {
-        if (cJSON_IsNumber (json_buffer_id))
+        if (cJSON_IsString (json_buffer_name))
         {
-            snprintf (str_id, sizeof(str_id),
+            ptr_buffer_name = cJSON_GetStringValue (json_buffer_name);
-                      "%lld", (long long)cJSON_GetNumberValue (json_buffer_id));
+            ptr_buffer = weechat_buffer_search ("==", ptr_buffer_name);
-            ptr_buffer = weechat_buffer_search ("==id", str_id);
             if (!ptr_buffer)
             {
                 relay_api_msg_send_error_json (
                     client,
                     RELAY_HTTP_400_BAD_REQUEST, NULL,
-                    "Buffer \"%lld\" not found",
+                    "Buffer \"%s\" not found",
-                    (long long)cJSON_GetNumberValue (json_buffer_id));
+                    ptr_buffer_name);
                 cJSON_Delete (json_body);
                 return RELAY_API_PROTOCOL_RC_OK;
             }
         }
     }
-    else
+    if (!ptr_buffer)
     {
-        json_buffer_name = cJSON_GetObjectItem (json_body, "buffer_name");
+        json_buffer_id = cJSON_GetObjectItem (json_body, "buffer_id");
-        if (json_buffer_name)
+        if (json_buffer_id)
         {
-            if (cJSON_IsString (json_buffer_name))
+            if (cJSON_IsNumber (json_buffer_id))
             {
-                ptr_buffer_name = cJSON_GetStringValue (json_buffer_name);
+                snprintf (str_id, sizeof(str_id),
-                ptr_buffer = weechat_buffer_search ("==", ptr_buffer_name);
+                          "%lld", (long long)cJSON_GetNumberValue (json_buffer_id));
+                ptr_buffer = weechat_buffer_search ("==id", str_id);
                 if (!ptr_buffer)
                 {
                     relay_api_msg_send_error_json (
                         client,
                         RELAY_HTTP_400_BAD_REQUEST, NULL,
-                        "Buffer \"%s\" not found",
+                        "Buffer \"%lld\" not found",
-                        ptr_buffer_name);
+                        (long long)cJSON_GetNumberValue (json_buffer_id));
                     cJSON_Delete (json_body);
                     return RELAY_API_PROTOCOL_RC_OK;
                 }
             }
         }
-        else
-        {
-            ptr_buffer = weechat_buffer_search_main ();
-        }
     }
+    if (!ptr_buffer)
+        ptr_buffer = weechat_buffer_search_main ();
     if (!ptr_buffer)
     {
         cJSON_Delete (json_body);
@@ -1197,7 +1217,7 @@ relay_api_protocol_recv_json (struct t_relay_client *client, const char *json)
 void
 relay_api_protocol_recv_http (struct t_relay_client *client)
 {
-    int i, num_args;
+    int i, num_args, match_method, match_resource;
     char str_error[1024];
     enum t_relay_api_protocol_rc return_code;
     struct t_relay_api_protocol_cb protocol_cb[] = {
@@ -1238,18 +1258,22 @@ relay_api_protocol_recv_http (struct t_relay_client *client)
         || !client->http_req->path_items[1]
         || (strcmp (client->http_req->path_items[0], "api") != 0))
     {
-        goto error_not_found;
+        goto resource_not_found;
     }
 
     num_args = client->http_req->num_path_items - 2;
 
     for (i = 0; protocol_cb[i].resource; i++)
     {
-        if (strcmp (protocol_cb[i].method, client->http_req->method) != 0)
+        match_method = (strcmp (protocol_cb[i].method, client->http_req->method) == 0);
-            continue;
 
-        if ((strcmp (protocol_cb[i].resource, "*") != 0)
+        match_resource = ((strcmp (protocol_cb[i].resource, "*") == 0)
-            && (strcmp (protocol_cb[i].resource, client->http_req->path_items[1]) != 0))
+                          || (strcmp (protocol_cb[i].resource, client->http_req->path_items[1]) == 0));
+
+        if (!match_method && (strcmp (protocol_cb[i].resource, "*") != 0) && match_resource)
+            goto error_method_not_allowed;
+
+        if (!match_method || !match_resource)
             continue;
 
         if (protocol_cb[i].auth_required
@@ -1331,7 +1355,19 @@ relay_api_protocol_recv_http (struct t_relay_client *client)
         }
     }
 
-    goto error_not_found;
+resource_not_found:
+    if (!client->http_req->method
+        || ((strcmp (client->http_req->method, "GET") != 0)
+            && (strcmp (client->http_req->method, "POST") != 0)
+            && (strcmp (client->http_req->method, "PUT") != 0)
+            && (strcmp (client->http_req->method, "DELETE") != 0)))
+    {
+        goto error_method_not_allowed;
+    }
+    else
+    {
+        goto error_not_found;
+    }
 
 error_bad_request:
     relay_api_msg_send_error_json (client, RELAY_HTTP_400_BAD_REQUEST,
@@ -1343,6 +1379,12 @@ error_not_found:
                                    NULL, RELAY_HTTP_ERROR_NOT_FOUND);
     goto error;
 
+error_method_not_allowed:
+    relay_api_msg_send_error_json (client, RELAY_HTTP_405_METHOD_NOT_ALLOWED,
+                                   "Allow: " RELAY_API_ALLOWED_METHODS,
+                                   RELAY_HTTP_ERROR_METHOD_NOT_ALLOWED);
+    goto error;
+
 error_memory:
     relay_api_msg_send_error_json (client, RELAY_HTTP_503_SERVICE_UNAVAILABLE,
                                    NULL, RELAY_HTTP_ERROR_OUT_OF_MEMORY);
@@ -1351,15 +1393,28 @@ error_memory:
 error:
     if (weechat_relay_plugin->debug >= 1)
     {
-        weechat_printf (NULL,
+        if (client->http_req->method && client->http_req->path)
-                        _("%s%s: failed to execute route \"%s %s\" "
+        {
-                          "for client %s%s%s"),
+            weechat_printf (NULL,
-                        weechat_prefix ("error"),
+                            _("%s%s: failed to execute route \"%s %s\" "
-                        RELAY_PLUGIN_NAME,
+                              "for client %s%s%s"),
-                        client->http_req->method,
+                            weechat_prefix ("error"),
-                        client->http_req->path,
+                            RELAY_PLUGIN_NAME,
-                        RELAY_COLOR_CHAT_CLIENT,
+                            client->http_req->method,
-                        client->desc,
+                            client->http_req->path,
-                        RELAY_COLOR_CHAT);
+                            RELAY_COLOR_CHAT_CLIENT,
+                            client->desc,
+                            RELAY_COLOR_CHAT);
+        }
+        else
+        {
+            weechat_printf (NULL,
+                            _("%s%s: invalid data received from client %s%s%s"),
+                            weechat_prefix ("error"),
+                            RELAY_PLUGIN_NAME,
+                            RELAY_COLOR_CHAT_CLIENT,
+                            client->desc,
+                            RELAY_COLOR_CHAT);
+        }
     }
 }

src/plugins/relay/api/relay-api-protocol.h

@@ -22,6 +22,8 @@
 #ifndef WEECHAT_PLUGIN_RELAY_API_PROTOCOL_H
 #define WEECHAT_PLUGIN_RELAY_API_PROTOCOL_H
 
+#define RELAY_API_ALLOWED_METHODS "GET, POST, PUT, DELETE"
+
 #define RELAY_API_CB(__command) &relay_api_protocol_cb_##__command
 #define RELAY_API_PROTOCOL_CALLBACK(__command)                          \
     enum t_relay_api_protocol_rc                                        \

src/plugins/relay/api/relay-api.h

@@ -27,7 +27,7 @@ enum t_relay_status;
 
 #define RELAY_API_VERSION_MAJOR 0
 #define RELAY_API_VERSION_MINOR 4
-#define RELAY_API_VERSION_PATCH 0
+#define RELAY_API_VERSION_PATCH 1
 #define RELAY_API_VERSION_NUMBER                                        \
     ((RELAY_API_VERSION_MAJOR << 16)                                    \
      + (RELAY_API_VERSION_MINOR << 8)                                   \

src/plugins/relay/api/weechat-relay-api.yaml

@@ -17,7 +17,7 @@ info:
   license:
     name: CC BY-NC-SA 4.0
     url: https://creativecommons.org/licenses/by-nc-sa/4.0/
-  version: 0.4.0
+  version: 0.4.1
 
 externalDocs:
   url: https://weechat.org/doc/
@@ -50,7 +50,29 @@ paths:
         This endpoint does not require authentication.
       operationId: handshake
       requestBody:
-        $ref: '#/components/requestBodies/HandshakeBody'
+        description: Handshake request
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                password_hash_algo:
+                  type: array
+                  items:
+                    type: string
+                    enum:
+                      - plain
+                      - sha256
+                      - sha512
+                      - pbkdf2+sha256
+                      - pbkdf2+sha512
+                  example:
+                    - plain
+                    - sha256
+                    - sha512
+                    - pbkdf2+sha256
+                    - pbkdf2+sha512
       responses:
         '200':
           description: Successful operation
@@ -58,6 +80,12 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Handshake'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
         '503':
           description: Out of memory
           content:
@@ -174,7 +202,7 @@ paths:
       tags:
         - buffers
       description: |
-        Get buffer by full name, with optional lines and nicks.
+        Get a single buffer by full name, with optional lines and nicks.
       operationId: getBufferByName
       parameters:
         - $ref: '#/components/parameters/totp'
@@ -492,7 +520,31 @@ paths:
       parameters:
         - $ref: '#/components/parameters/totp'
       requestBody:
-        $ref: '#/components/requestBodies/InputBody'
+        description: Buffer and command to execute
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                buffer_id:
+                  type: integer
+                  format: int64
+                  description: Buffer identifier (≥ 0)
+                buffer_name:
+                  type: string
+                  description: >-
+                    Buffer full name
+                  example: 'core.weechat'
+                command:
+                  type: string
+                  description: text or command to send
+                  example: '/print test'
+              required:
+                - command
+            example:
+              buffer_name: 'core.weechat'
+              command: '/print test'
       responses:
         '204':
           description: Successful operation
@@ -516,11 +568,42 @@ paths:
         - completion
       description: |
         Complete user command or text.
-      operationId: input
+      operationId: completion
       parameters:
         - $ref: '#/components/parameters/totp'
       requestBody:
-        $ref: '#/components/requestBodies/CompletionBody'
+        description: Buffer and user text/command to complete
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                buffer_id:
+                  type: integer
+                  format: int64
+                  description: Buffer identifier (≥ 0)
+                buffer_name:
+                  type: string
+                  description: >-
+                    Buffer full name
+                  example: 'core.weechat'
+                command:
+                  type: string
+                  description: user command or text to complete
+                  example: '/hel'
+                position:
+                  type: integer
+                  format: int32
+                  description: Position in data (≥ 0)
+                  example: 4
+              required:
+                - command
+                - position
+            example:
+              buffer_name: 'core.weechat'
+              command: '/hel'
+              position: 4
       responses:
         '200':
           description: Successful operation
@@ -552,7 +635,16 @@ paths:
       parameters:
         - $ref: '#/components/parameters/totp'
       requestBody:
-        $ref: '#/components/requestBodies/PingBody'
+        description: Custom data that will be returned in the response
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                data:
+                  type: string
+                  example: '1714854355123456'
       responses:
         '200':
           description: Successful operation
@@ -589,7 +681,37 @@ paths:
       parameters:
         - $ref: '#/components/parameters/totp'
       requestBody:
-        $ref: '#/components/requestBodies/SyncBody'
+        description: Synchronization parameters
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                sync:
+                  type: boolean
+                  description: Enable synchronization
+                  example: true
+                nicks:
+                  type: boolean
+                  description: Receive nick updates in buffers
+                  example: true
+                input:
+                  type: boolean
+                  description: Receive input changes in buffers (content and cursor position)
+                  example: true
+                colors:
+                  type: string
+                  enum:
+                    - ansi
+                    - weechat
+                    - strip
+                  default: ansi
+                  description: |
+                    How to return strings with color codes:
+                    * `ansi`: return ANSI color codes
+                    * `weechat`: return WeeChat internal color codes
+                    * `strip`: strip colors
       responses:
         '204':
           description: Successful operation
@@ -632,6 +754,7 @@ components:
         type: integer
         format: int64
       description: Buffer identifier
+      example: 1709932823238637
     bufferName:
       name: buffer_name
       in: path
@@ -900,7 +1023,7 @@ components:
           type: string
           format: date-time
           description: date and time of line
-          example: '"2023-12-05T19:46:03.847625Z'
+          example: '2023-12-05T19:46:03.847625Z'
         date_printed:
           type: string
           format: date-time
@@ -1161,11 +1284,11 @@ components:
           type: array
           items:
             type: string
-            example:
+          example:
-              - 'query'
+            - 'query'
-              - 'quiet'
+            - 'quiet'
-              - 'quit'
+            - 'quit'
-              - 'quote'
+            - 'quote'
       required:
         - context
         - base_word
@@ -1177,138 +1300,10 @@ components:
       properties:
         data:
           type: string
-          example: 1714854355123456
+          example: '1714854355123456'
       required:
         - data
 
-  requestBodies:
-    HandshakeBody:
-      description: Handshake request
-      required: false
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              password_hash_algo:
-                type: array
-                items:
-                  type: string
-                  enum:
-                    - plain
-                    - sha256
-                    - sha512
-                    - pbkdf2+sha256
-                    - pbkdf2+sha512
-                  example:
-                    - plain
-                    - sha256
-                    - sha512
-                    - pbkdf2+sha256
-                    - pbkdf2+sha512
-    InputBody:
-      description: Buffer and command to execute
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              buffer_id:
-                type: integer
-                format: int64
-                description: Buffer identifier (≥ 0)
-                example: 1709932823238637
-              buffer_name:
-                type: string
-                description: >-
-                  Buffer full name
-                example: 'irc.libera.#weechat'
-              command:
-                type: string
-                description: text or command to send
-                example: 'hello, world!'
-            required:
-              - command
-          example:
-            buffer_id: 1709932823238637
-            command: 'hello, world!'
-    CompletionBody:
-      description: Buffer and user text/command to complete
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              buffer_id:
-                type: integer
-                format: int64
-                description: Buffer identifier (≥ 0)
-                example: 1709932823238637
-              buffer_name:
-                type: string
-                description: >-
-                  Buffer full name
-                example: 'irc.libera.#weechat'
-              command:
-                type: string
-                description: user command or text to complete
-                example: '/qu'
-              position:
-                type: integer
-                format: int32
-                description: Position in data (≥ 0)
-                example: 3
-            required:
-              - data
-          example:
-            buffer_id: 1709932823238637
-            command: '/qu'
-    PingBody:
-      description: Custom data that will be returned in the response
-      required: false
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              data:
-                type: string
-                example: 1714854355123456
-    SyncBody:
-      description: Synchronization parameters
-      required: false
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              sync:
-                type: boolean
-                description: Enable synchronization
-                example: true
-              nicks:
-                type: boolean
-                description: Receive nick updates in buffers
-                example: true
-              input:
-                type: boolean
-                description: Receive input changes in buffers (content and cursor position)
-                example: true
-              colors:
-                type: string
-                enum:
-                  - ansi
-                  - weechat
-                  - strip
-                default: ansi
-                description: |
-                  How to return strings with color codes:
-                  * `ansi`: return ANSI color codes
-                  * `weechat`: return WeeChat internal color codes
-                  * `strip`: strip colors
-
   securitySchemes:
     password:
       type: http

src/plugins/relay/relay-client.c

@@ -504,7 +504,8 @@ relay_client_recv_text_buffer (struct t_relay_client *client,
             if ((client->websocket == RELAY_CLIENT_WEBSOCKET_INITIALIZING)
                 || (client->recv_data_type == RELAY_CLIENT_DATA_HTTP))
             {
-                relay_http_recv (client, buffer + index);
+                relay_http_recv (client, buffer + index, length_buffer - index);
+                break;
             }
             else
             {
@@ -582,7 +583,7 @@ relay_client_read_websocket_frames (struct t_relay_client *client,
                     if ((client->websocket == RELAY_CLIENT_WEBSOCKET_INITIALIZING)
                         || (client->recv_data_type == RELAY_CLIENT_DATA_HTTP))
                     {
-                        relay_http_recv (client, frames[i].payload);
+                        relay_http_recv (client, frames[i].payload, frames[i].payload_size);
                     }
                     else if ((client->recv_data_type == RELAY_CLIENT_DATA_TEXT_LINE)
                              || (client->recv_data_type == RELAY_CLIENT_DATA_TEXT_MULTILINE))
@@ -694,7 +695,7 @@ relay_client_recv_buffer (struct t_relay_client *client,
         if ((client->websocket == RELAY_CLIENT_WEBSOCKET_INITIALIZING)
             || (client->recv_data_type == RELAY_CLIENT_DATA_HTTP))
         {
-            relay_http_recv (client, buffer);
+            relay_http_recv (client, buffer, buffer_size);
         }
         else if ((client->recv_data_type == RELAY_CLIENT_DATA_TEXT_LINE)
                  || (client->recv_data_type == RELAY_CLIENT_DATA_TEXT_MULTILINE))

src/plugins/relay/relay-http.c

@@ -935,11 +935,13 @@ relay_http_process_request (struct t_relay_client *client)
  */
 
 void
-relay_http_recv (struct t_relay_client *client, const char *data)
+relay_http_recv (struct t_relay_client *client, const char *data, int size)
 {
-    char *new_partial, *pos;
+    char *new_partial, *pos, **null_char;
     int length, ws_deflate_allowed;
 
+    null_char = memchr (data, 0, size);
+
     if (client->partial_message)
     {
         new_partial = realloc (client->partial_message,
@@ -1003,8 +1005,11 @@ relay_http_recv (struct t_relay_client *client, const char *data)
             relay_http_add_to_body (client->http_req, &(client->partial_message));
         }
 
-        /* process the request if it's ready to be processed (all parsed) */
+        /*
-        if (client->http_req->status == RELAY_HTTP_END)
+         * process the request if it's ready to be processed (all parsed)
+         * or if we received a NULL char in the HTTP message (forbidden)
+         * */
+        if ((client->http_req->status == RELAY_HTTP_END) || null_char)
         {
             relay_http_process_request (client);
             relay_http_request_reinit (client->http_req);

src/plugins/relay/relay-http.h

@@ -40,6 +40,7 @@ enum t_relay_client_http_status
 #define RELAY_HTTP_401_UNAUTHORIZED           401, "Unauthorized"
 #define RELAY_HTTP_403_FORBIDDEN              403, "Forbidden"
 #define RELAY_HTTP_404_NOT_FOUND              404, "Not Found"
+#define RELAY_HTTP_405_METHOD_NOT_ALLOWED     405, "Method Not Allowed"
 #define RELAY_HTTP_500_INTERNAL_SERVER_ERROR  500, "Internal Server Error"
 #define RELAY_HTTP_503_SERVICE_UNAVAILABLE    503, "Service Unavailable"
 
@@ -53,6 +54,7 @@ enum t_relay_client_http_status
 #define RELAY_HTTP_ERROR_INVALID_ITERATIONS   "Invalid number of iterations"
 #define RELAY_HTTP_ERROR_BAD_REQUEST          "Bad request"
 #define RELAY_HTTP_ERROR_NOT_FOUND            "Resource not found"
+#define RELAY_HTTP_ERROR_METHOD_NOT_ALLOWED   "Method Not Allowed"
 #define RELAY_HTTP_ERROR_OUT_OF_MEMORY        "Out of memory"
 
 struct t_relay_http_request
@@ -98,7 +100,8 @@ extern long relay_http_get_param_long (struct t_relay_http_request *request,
 extern int relay_http_parse_method_path (struct t_relay_http_request *request,
                                          const char *method_path);
 extern int relay_http_check_auth (struct t_relay_client *client);
-extern void relay_http_recv (struct t_relay_client *client, const char *data);
+extern void relay_http_recv (struct t_relay_client *client,
+                             const char *data, int size);
 extern int relay_http_send (struct t_relay_client *client,
                             int return_code, const char *message,
                             const char *headers,

tests/unit/plugins/relay/api/test-relay-api-protocol.cpp

@@ -321,14 +321,23 @@ TEST(RelayApiProtocolWithClient, CbHandshake)
     /* unknown password hash algorithm */
     test_client_recv_http ("POST /api/handshake", NULL,
                            "{\"password_hash_algo\": [\"invalid\"]}");
-    STRCMP_EQUAL("HTTP/1.1 200 OK\r\n"
+    STRCMP_EQUAL("HTTP/1.1 400 Bad Request\r\n"
                  "Access-Control-Allow-Origin: *\r\n"
                  "Content-Type: application/json; charset=utf-8\r\n"
-                 "Content-Length: 74\r\n"
+                 "Content-Length: 48\r\n"
                  "\r\n"
-                 "{\"password_hash_algo\":null,"
+                 "{\"error\":\"Hash algorithm \\\"invalid\\\" not found\"}",
-                 "\"password_hash_iterations\":100000,"
+                 data_sent[0]);
-                 "\"totp\":false}",
+
+    /* invalid password hash algorithm */
+    test_client_recv_http ("POST /api/handshake", NULL,
+                           "{\"password_hash_algo\": [{}]}");
+    STRCMP_EQUAL("HTTP/1.1 400 Bad Request\r\n"
+                 "Access-Control-Allow-Origin: *\r\n"
+                 "Content-Type: application/json; charset=utf-8\r\n"
+                 "Content-Length: 34\r\n"
+                 "\r\n"
+                 "{\"error\":\"Invalid hash algorithm\"}",
                  data_sent[0]);
 
     /* two supported hash algorithms */
@@ -964,7 +973,7 @@ TEST(RelayApiProtocolWithClient, RecvJson)
 TEST(RelayApiProtocolWithClient, RecvHttp404)
 {
     /* resource not found: error 404 */
-    test_client_recv_http ("GET / HTTP/1.1", NULL, NULL);
+    test_client_recv_http ("GET /", NULL, NULL);
     STRCMP_EQUAL("HTTP/1.1 404 Not Found\r\n"
                  "Access-Control-Allow-Origin: *\r\n"
                  "Content-Type: application/json; charset=utf-8\r\n"
@@ -974,7 +983,7 @@ TEST(RelayApiProtocolWithClient, RecvHttp404)
                  data_sent[0]);
 
     /* resource not found: error 404 */
-    test_client_recv_http ("GET /unknown HTTP/1.1", NULL, NULL);
+    test_client_recv_http ("GET /unknown", NULL, NULL);
     STRCMP_EQUAL("HTTP/1.1 404 Not Found\r\n"
                  "Access-Control-Allow-Origin: *\r\n"
                  "Content-Type: application/json; charset=utf-8\r\n"
@@ -984,7 +993,7 @@ TEST(RelayApiProtocolWithClient, RecvHttp404)
                  data_sent[0]);
 
     /* resource not found: error 404 */
-    test_client_recv_http ("GET /unknown/abc HTTP/1.1", NULL, NULL);
+    test_client_recv_http ("GET /unknown/abc", NULL, NULL);
     STRCMP_EQUAL("HTTP/1.1 404 Not Found\r\n"
                  "Access-Control-Allow-Origin: *\r\n"
                  "Content-Type: application/json; charset=utf-8\r\n"
@@ -994,7 +1003,7 @@ TEST(RelayApiProtocolWithClient, RecvHttp404)
                  data_sent[0]);
 
     /* resource not found: error 404 */
-    test_client_recv_http ("GET /api HTTP/1.1", NULL, NULL);
+    test_client_recv_http ("GET /api", NULL, NULL);
     STRCMP_EQUAL("HTTP/1.1 404 Not Found\r\n"
                  "Access-Control-Allow-Origin: *\r\n"
                  "Content-Type: application/json; charset=utf-8\r\n"
@@ -1004,7 +1013,7 @@ TEST(RelayApiProtocolWithClient, RecvHttp404)
                  data_sent[0]);
 
     /* resource not found: error 404 */
-    test_client_recv_http ("GET /api/unknown HTTP/1.1", NULL, NULL);
+    test_client_recv_http ("GET /api/unknown", NULL, NULL);
     STRCMP_EQUAL("HTTP/1.1 404 Not Found\r\n"
                  "Access-Control-Allow-Origin: *\r\n"
                  "Content-Type: application/json; charset=utf-8\r\n"
@@ -1022,7 +1031,7 @@ TEST(RelayApiProtocolWithClient, RecvHttp404)
 TEST(RelayApiProtocolWithClient, RecvHttpMissingPassword)
 {
     /* unauthorized: missing password */
-    test_client_recv_http_raw ("GET /api/version HTTP/1.1\r\n"
+    test_client_recv_http_raw ("GET /api/version\r\n"
                                "\r\n");
     STRCMP_EQUAL("HTTP/1.1 401 Unauthorized\r\n"
                  "Access-Control-Allow-Origin: *\r\n"
@@ -1041,7 +1050,7 @@ TEST(RelayApiProtocolWithClient, RecvHttpMissingPassword)
 TEST(RelayApiProtocolWithClient, RecvHttpInvalidPassword)
 {
     /* unauthorized: invalid password: "plain:invalid" */
-    test_client_recv_http_raw ("GET /api/version HTTP/1.1\r\n"
+    test_client_recv_http_raw ("GET /api/version\r\n"
                                "Authorization: Basic cGxhaW46aW52YWxpZA==\r\n"
                                "\r\n");
     STRCMP_EQUAL("HTTP/1.1 401 Unauthorized\r\n"
@@ -1052,3 +1061,44 @@ TEST(RelayApiProtocolWithClient, RecvHttpInvalidPassword)
                  "{\"error\":\"Invalid password\"}",
                  data_sent[0]);
 }
+
+/*
+ * Tests functions:
+ *   relay_api_protocol_recv_http (method not allowed)
+ */
+
+TEST(RelayApiProtocolWithClient, RecvHttpMethodNotAllowed)
+{
+    /* method not allowed (PATCH) with existing resource (/api/ping) */
+    test_client_recv_http ("PATCH /api/ping", NULL, "{\"data\": \"abcdef\"}");
+    STRCMP_EQUAL("HTTP/1.1 405 Method Not Allowed\r\n"
+                 "Allow: GET, POST, PUT, DELETE\r\n"
+                 "Access-Control-Allow-Origin: *\r\n"
+                 "Content-Type: application/json; charset=utf-8\r\n"
+                 "Content-Length: 30\r\n"
+                 "\r\n"
+                 "{\"error\":\"Method Not Allowed\"}",
+                 data_sent[0]);
+
+    /* method not allowed (PATCH) with unknown resource (/api/unknown) */
+    test_client_recv_http ("PATCH /api/unknown", NULL, "{\"data\": \"abcdef\"}");
+    STRCMP_EQUAL("HTTP/1.1 405 Method Not Allowed\r\n"
+                 "Allow: GET, POST, PUT, DELETE\r\n"
+                 "Access-Control-Allow-Origin: *\r\n"
+                 "Content-Type: application/json; charset=utf-8\r\n"
+                 "Content-Length: 30\r\n"
+                 "\r\n"
+                 "{\"error\":\"Method Not Allowed\"}",
+                 data_sent[0]);
+
+    /* method not allowed (PATCH) with unknown resource (/unknown) */
+    test_client_recv_http ("PATCH /unknown", NULL, "{\"data\": \"abcdef\"}");
+    STRCMP_EQUAL("HTTP/1.1 405 Method Not Allowed\r\n"
+                 "Allow: GET, POST, PUT, DELETE\r\n"
+                 "Access-Control-Allow-Origin: *\r\n"
+                 "Content-Type: application/json; charset=utf-8\r\n"
+                 "Content-Length: 30\r\n"
+                 "\r\n"
+                 "{\"error\":\"Method Not Allowed\"}",
+                 data_sent[0]);
+}

tools/test_relay_api.sh

@@ -1,89 +0,0 @@
-#!/bin/sh
-#
-# SPDX-FileCopyrightText: 2024-2025 Sébastien Helleu <flashcode@flashtux.org>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of WeeChat, the extensible chat client.
-#
-# WeeChat is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# WeeChat is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with WeeChat.  If not, see <https://www.gnu.org/licenses/>.
-#
-
-#
-# Test WeeChat relay HTTP REST API.
-#
-# Environment variables that can be used:
-#
-#   RELAY_PASSWORD  Password for WeeChat relay
-#
-
-set -o errexit
-
-# default values for options from environment variables
-default_relay_password="test"
-
-usage ()
-{
-    rc=$1
-    cat <<-EOF
-
-Syntax: $0 url
-
-  url  URL of the running WeeChat with relay api (without "/api")
-
-Environment variables used:
-
-  RELAY_PASSWORD  password for the relay (default: "${default_relay_password}")
-
-Example:
-
-  RELAY_PASSWORD="test" $0 http://localhost:9000
-
-EOF
-    exit "${rc}"
-}
-
-error_usage ()
-{
-    echo >&2 "ERROR: $*"
-    usage 1
-}
-
-# ================================== START ==================================
-
-# relay password
-[ -z "${RELAY_PASSWORD}" ] && RELAY_PASSWORD="${default_relay_password}"
-
-# check command line arguments
-if [ $# -eq 0 ]; then
-    usage 0
-fi
-if [ $# -lt 1 ]; then
-    error_usage "missing arguments"
-fi
-
-# command line arguments
-url="$1"
-
-schemathesis run \
-    --checks all \
-    --show-trace \
-    --validate-schema=true \
-    --experimental=openapi-3.1 \
-    --base-url "${url}/api" \
-    --auth "plain:${RELAY_PASSWORD}" \
-    ./src/plugins/relay/api/weechat-relay-api.yaml \
-    ;
-
-exit 0

version.sh

@@ -41,8 +41,8 @@
 #     devel-number   the devel version as hex number ("0x04010000" for "4.1.0-dev")
 #
 
-weechat_stable="4.6.3"
+weechat_stable="4.7.1"
-weechat_devel="4.7.0-dev"
+weechat_devel="4.7.1"
 
 stable_major=$(echo "${weechat_stable}" | cut -d"." -f1)
 stable_minor=$(echo "${weechat_stable}" | cut -d"." -f2)