No description
  • Python 93.4%
  • Shell 5.4%
  • Batchfile 1.1%
  • Dockerfile 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Sebastiaan Koetsier 7ab3d1016d security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code
Security:
- _is_owner: hostmask-only lookup (no username/nick match) — closes
  nickjack privilege escalation
- _sanitize_input: strip \n/\r and all non-printables — closes IRC
  protocol injection via !join/!part/!botnick
- mac.py: remove hardcoded API key; read from config[mac_api_key]
- config.py + install.py: never persist db_password to config.json

Fixed:
- massmeet: per-user SAVEPOINT/RELEASE/ROLLBACK TO — one UNIQUE
  violation no longer poisons the batch; merges no longer discarded
- events: first-match-wins command dispatch (break) — fixes !avail
  double-answer
- events: hyphen in command regex — !bd-set now parses
- events: _split_message caps combined output at 500 chars — prevents
  512-byte IRC line disconnect
- deluser: cascade-delete infoitems/quotes/karma_who/autoop rows
- debug: per-event logging gated behind !debug toggle
- startup.sh: remove dead phreakbot_pydle.py branch
- modules.py: remove duplicate avail registration (help.py is canonical)

Removed:
- modules/roa.py (deprecated; !roa in irrexplorer.py)
- contrib/ (dead pre-pydle code)
- six *_gaps.py skeleton test files (2315 lines of pass-bodies)
- bot.re, bot_trigger_re, user_permissions cache
- pycurl dependency (unused)

313 tests passing.
2026-09-18 11:31:08 +02:00
docs docs(ai): implementation plan for tool-calling and loose addressing 2026-07-16 07:48:22 +02:00
modules security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code 2026-09-18 11:31:08 +02:00
phreakbot_core security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code 2026-09-18 11:31:08 +02:00
scripts security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code 2026-09-18 11:31:08 +02:00
tests security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code 2026-09-18 11:31:08 +02:00
.coveragerc v0.1.28 - Comprehensive test suite with pytest, unit tests, integration tests, and module tests 2025-11-27 11:29:36 +08:00
.dockerignore chore: drop unused imports; build on Python 3.12 with .dockerignore 2026-09-03 11:47:36 +02:00
.env.example Release v0.1.30 - Critical Security Fixes 2026-04-14 10:00:25 +02:00
.gitignore chore: drop unused imports; build on Python 3.12 with .dockerignore 2026-09-03 11:47:36 +02:00
CHANGELOG.md security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code 2026-09-18 11:31:08 +02:00
config.json.pydle.example fix(ai): cap reasoning with thinking_budget=4096 2026-07-16 09:31:29 +02:00
create-autovoice-table.sql Update autovoice module to use channel-based toggle 2025-07-07 12:21:07 +08:00
dbschema.psql Release v0.1.30 - Critical Security Fixes 2026-04-14 10:00:25 +02:00
docker-compose.yml security: fix 9 vulnerabilities found in security audit 2026-06-23 13:29:32 +02:00
Dockerfile chore: drop unused imports; build on Python 3.12 with .dockerignore 2026-09-03 11:47:36 +02:00
install.py security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code 2026-09-18 11:31:08 +02:00
LICENSE Initial release 2025-07-06 17:20:54 +08:00
phreakbot.py fix: resolve podman db race condition and prevent infoitems from capturing karma patterns 2026-05-22 16:00:19 +02:00
pytest.ini v0.1.28 - Comprehensive test suite with pytest, unit tests, integration tests, and module tests 2025-11-27 11:29:36 +08:00
README.md security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code 2026-09-18 11:31:08 +02:00
requirements.txt security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code 2026-09-18 11:31:08 +02:00
VERSION security: close nickjack escalation, IRC injection, and secret leaks; fix massmeet, dispatch, and dead code 2026-09-18 11:31:08 +02:00

PhreakBot (v0.1.42)

PhreakBot is a modular IRC bot written in Python.

Features

  • Modular design with easy-to-add modules
  • Permission system with owner, admin, and user levels
  • Quote database with search functionality
  • URL title and description fetching
  • Channel management (join, part, topic)
  • User registration and management
  • Auto-op functionality
  • CTCP version support
  • Robust error handling and logging
  • Frys-IX peering LAN member information with port speed, IP, and max prefix details
  • MAC address vendor lookup for both full and partial MAC addresses
  • Mass user registration and hostmask merging
  • ROA validation and routing information
  • Karma system with ++ and -- support
  • And more!

Installation

PhreakBot supports both Docker and Podman.

  1. Copy .env.example to .env and update the values:

    cp .env.example .env
    
  2. Start the bot:

    Using Docker:

    docker-compose up -d
    

    Using Podman:

    podman-compose up -d
    

For detailed Podman instructions and features, see docs/PODMAN.md.

Manual Installation

  1. Clone the repository
  2. Install the required dependencies: pip install -r requirements.txt
  3. Set up a PostgreSQL database
  4. Run the SQL in dbschema.psql to create the necessary tables
  5. Configure the bot by editing config/config.json
  6. Run the bot: python phreakbot.py

PhreakBot uses the pydle IRC library, which offers:

  • Better handling of IRC events
  • Improved connection stability
  • Enhanced support for custom commands like !item = value and !item?
  • More detailed logging
  • Asynchronous operation for better performance

Scripts

All utility scripts are located in the scripts/ directory. See scripts/README.md for detailed information about each script.

Configuration

Docker / Podman

Configure via environment variables in .env (see .env.example for defaults):

# PostgreSQL credentials — POSTGRES_PASSWORD is required, no default
POSTGRES_USER=phreakbot
POSTGRES_PASSWORD=changeme
POSTGRES_DB=phreakbot

# IRC configuration — TLS on port 6697 is the default
IRC_SERVER=irc.libera.chat
IRC_PORT=6697
IRC_NICKNAME=PhreakBot
IRC_CHANNEL=#phreakbot

Manual Installation

Edit config/config.json to configure the bot:

{
    "server": "irc.example.com",
    "port": 6697,
    "use_tls": true,
    "tls_verify": true,
    "nickname": "PhreakBot",
    "realname": "PhreakBot",
    "channels": ["#channel1", "#channel2"],
    "command_trigger": "!"
}

Setting Up Ownership

When the bot first starts, use the !owner claim command to claim ownership of the bot. This will grant you admin privileges and allow you to manage the bot.

Module Development

Modules are stored in the modules directory. Each module should have a config function that returns a dictionary with the following keys:

  • events: List of IRC events to listen for
  • commands: List of commands the module provides
  • permissions: List of permissions required to use the module
  • help: Help text for the module

For detailed information on how to create your own modules, see the Module Development Guide.

Security

  • IRC connections default to TLS on port 6697 (use_tls: true). Plaintext port 6667 is intentionally not the default.
  • POSTGRES_PASSWORD must be set explicitly — the bot refuses to start if it is empty.
  • URL fetching (!url, auto-title, !@) is protected against SSRF: all redirect hops are re-checked against a blocked-network list (RFC 1918, loopback, link-local, cloud metadata endpoints).
  • The !ip command only reports public IP addresses; private/reserved addresses are blocked from output.
  • The permission system enforces an allowlist of valid permission names; unknown values are rejected at write time.
  • Exception details are never sent to IRC channels; full errors are logged server-side only.

See CHANGELOG.md for the full history of security fixes.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This project is licensed under the MIT License - see the LICENSE file for details.