pisg is an IRC channel statics generator written in Perl, it creates statistics from different logfile formats. It was originally written because IRCStats wasn't open source. So here's an open source/GPL'ed version to anyone interested. It's a funny thing for your IRC channel, and it's highly customizeable.
PROBLEM: pisg does not sanitize the nick of the user before posting to the web
PROOF: 1. silc 2. /connect silc.net 3. /nick <script>alert(document.domain);</script> 4. /log ... 5. /me a couple of times on a channel 6. /quit 3. then generate stats ./pisg 4. surf the index.html
MORE INFO: The silc-client, which is an old irssi-client with the silc stuff patched on, logs in the irssi format which pisg reads, and also silcd allows strange names like the above "<script>alert(document.domain);</script>". But, the major problem is, pisg does not sanitize the nick. This problem does not occur when using irssi connected to a regular ircd because the ircd does not allow the nick. The "/me <stuff>" is required, a regular /msg <channel> will not work.
FIX: Sanitize everything.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
