Reorganization to hopefully prevent git conflicts.

modules/convert/convert.sh

@@ -14,4 +14,11 @@ if ! check_dependencies "${dependencies[@]}"; then
     exit 1
 fi
 
-msg "$chan" "$(units -v ${*#* } | head -n1 | tr -d '[:space:]')"
+# Validate input
+if [[ -z "$*" ]]; then
+    msg "$chan" "Please provide a unit conversion (e.g., '10 meters to feet')."
+    exit 0
+fi
+
+# Quote variables to prevent command injection
+msg "$chan" "$(units -v "${*#* }" | head -n1 | tr -d '[:space:]')"

modules/fortune/fortune.sh

@@ -5,6 +5,9 @@
 dependencies=("fortune")
 
 target="${3#fortune}"
+# Trim leading/trailing whitespace
+target="${target#"${target%%[![:space:]]*}"}"
+target="${target%"${target##*[![:space:]]}"}"
 
 # Check dependencies before running
 if ! check_dependencies "${dependencies[@]}"; then
@@ -12,6 +15,7 @@ if ! check_dependencies "${dependencies[@]}"; then
     exit 1
 fi
 
-fortuneText="$(fortune -a -e -s -n 512 $target || echo "No fortunes found.")"
+# Quote target to prevent command injection
+fortuneText="$(fortune -a -e -s -n 512 "$target" || echo "No fortunes found.")"
 fortuneText="$(echo "$fortuneText" | tr '[:space:]' ' ' | sed -e 's/"/\"/g')"
 msg "$2" "$fortuneText"

modules/nick/nick.sh

@@ -4,8 +4,35 @@
 user=$1
 shift
 shift
-if [[ "$user" =~ $allowList ]]; then
-    ./modules/do/do.sh "$1" "#$channel" "does a magical gesture and turns into ${1}!"
-    nick $1
-    sed -i bot.cfg -e "s/nick=.*/nick=\"$1\"/"
+
+newNick="$1"
+
+# Validate that user is authorized
+if [[ ! "$user" =~ $allowList ]]; then
+    exit 0
 fi
+
+# Validate IRC nickname format (RFC 2812)
+# Nicknames can contain: a-z A-Z 0-9 _ - [ ] { } \ | ^
+if [[ -z "$newNick" ]]; then
+    msg "#$channel" "$user: Please provide a nickname."
+    exit 0
+fi
+
+if ! [[ "$newNick" =~ ^[a-zA-Z0-9_\[\]\{\}\\|\^-]+$ ]]; then
+    msg "#$channel" "$user: Invalid nickname format. Only alphanumeric and _-[]{}\\|^ allowed."
+    exit 0
+fi
+
+if [[ ${#newNick} -gt 30 ]]; then
+    msg "#$channel" "$user: Nickname too long (max 30 characters)."
+    exit 0
+fi
+
+# Change the nick
+./modules/do/do.sh "$newNick" "#$channel" "does a magical gesture and turns into ${newNick}!"
+nick "$newNick"
+
+# Safely update config file - escape forward slashes for sed
+escapedNick="${newNick//\//\\/}"
+sed -i "s/^nick=.*/nick=\"${escapedNick}\"/" bot.cfg

modules/sing/sing.sh

@@ -13,15 +13,15 @@ if ! check_dependencies "${dependencies[@]}"; then
     msg "$chan" "$1: This module requires: ${dependencies[*]}"
     exit 1
 fi
-#get the lyric text into a variable
-lyricText="$(clyrics $@ | tr '[:space:]' ' ' | tr -s ' ' | fold -s -w 384)"
+# Get the lyric text into a variable (quote $@ to prevent command injection)
+lyricText="$(clyrics "$@" | tr '[:space:]' ' ' | tr -s ' ' | fold -s -w 384)"
 i=$(echo "$lyricText" | wc -l)
-i=$(($RANDOM % $i + 1))
+i=$((RANDOM % i + 1))
 lyricText="$(echo "$lyricText" | tail +$i | head -1 | rev | cut -d '.' -f2- | rev)"
 #Display the lyric text
 if [ ${#lyricText} -gt 15 ] ; then
 msg "$chan" "${lyricText}"
 exit 0
 fi
-msg "$chan" "no lyrics found for $@."
+msg "$chan" "no lyrics found for $*."
 exit 0