zynk/cmd_stock.h
hanez 72f7812630 Secure file ops, TLS hardening, input validation, security docs. (0.40.7)
- Added secure_state_open(): hardened file open with O_CLOEXEC, O_NOFOLLOW,
  mode 0600, regular-file and ownership checks. Prevents symlink attacks,
  TOCTOU races, and world-writable temp files.
- Replaced all fopen() calls for temp state files with secure_state_open()
  + fdopen() across hot reload, compile-restart, and rebuild paths.
- Hardened TLS initialization: enforces minimum TLS 1.2, disables
  compression, checks SSL_CTX_set_default_verify_paths() return value.
- CMake compiler/linker hardening: -Wformat=2, -Wstrict-prototypes,
  -fstack-protector-strong, _FORTIFY_SOURCE=3, RELRO, noexecstack.
- Added !calc input validation: max 256 chars, numeric-only characters.
- Added !stock symbol validation: alphanumerics plus .-^= only.
- Fixed !quit, !reload, !restart to require channel context (DMs rejected).
- Fixed log timestamp format: %y (2-digit) to %Y (4-digit year).
- Fixed asprintf return value check in !forecast error paths.
- Fixed !reload fork-in-place mode: only saves TLS state when exec_new=1.
- Cleaned up reload state file on failure and in fork child.
- Fixed git SSH-to-HTTPS URL conversion in !gitlog and !changelog.
- AI plan mode no longer passes --dangerously-skip-permissions.
- Added IRC buffer overflow protection: oversized lines are dropped.
- Added doc comments to ZYNK_RELOAD_FILE, secure_state_open(),
  RateLimitEntry, and rate_limits.
2026-07-24 03:21:49 +02:00

111 lines
4.3 KiB
C

#ifndef CMD_STOCK_H
#define CMD_STOCK_H
#include "zynk.h"
/*
* cmd_stock - Handle the "!stock <SYMBOL>[,SYMBOL...]" command.
*
* Fetches real-time stock quotes from Yahoo Finance's chart API for up to
* 3 comma-separated ticker symbols. Parses the JSON response to extract
* current price, previous close, change/percent, day high/low, and volume.
* Formats each symbol as "SYMB (Name): $price +/-change (+/-pct%) H:high L:low Vol:volM".
* Multiple symbols are separated by " | ". Rate-limited.
*
* Parameters:
* s - The IRC session.
* msg - The raw message text.
* reply_target - Channel or nick to reply to.
* src_nick - The nick of the user who sent the command.
*
* Returns: 1 if matched, 0 otherwise.
*/
int cmd_stock(Session *s, const char *msg, const char *reply_target, const char *src_nick) {
if (strncmp(msg, "!stock", 6) != 0) return 0;
if (msg[6] != ' ' && msg[6] != '\0') return 0;
if (rate_limit_check(src_nick, reply_target) < 0) return 1;
const char *rest = msg[6] == ' ' ? msg + 7 : "";
while (*rest == ' ') rest++;
if (!*rest) {
irc_msg(s, reply_target, "Usage: !stock <SYMBOL>[,SYMBOL...] (max 3, e.g. !stock AAPL or !stock AAPL,MSFT,GOOGL)");
return 1;
}
char buf[2048];
buf[0] = 0;
int count = 0;
char symbols[3][16];
const char *p = rest;
while (*p && count < 3) {
while (*p == ' ' || *p == ',') p++;
if (!*p) break;
int i = 0;
while (*p && *p != ' ' && *p != ',' && i < 15) symbols[count][i++] = toupper((unsigned char)*p++);
symbols[count][i] = 0;
for (int j = 0; symbols[count][j]; j++) {
unsigned char c = (unsigned char)symbols[count][j];
if (!isalnum(c) && c != '.' && c != '-' && c != '^' && c != '=') {
symbols[count][0] = 0;
break;
}
}
count++;
}
for (int si = 0; si < count; si++) {
if (!symbols[si][0]) continue;
char url[512];
snprintf(url, sizeof url, "https://query1.finance.yahoo.com/v8/finance/chart/%s?interval=1d&range=1d", symbols[si]);
char *json = fetch_url(url);
if (!json) {
char tmp[128];
snprintf(tmp, sizeof tmp, "%s: fetch error", symbols[si]);
if (buf[0]) strncat(buf, " | ", sizeof buf - strlen(buf) - 1);
strncat(buf, tmp, sizeof buf - strlen(buf) - 1);
continue;
}
const char *rp_s = json_find(json, "\"regularMarketPrice\":");
const char *pc_s = json_find(json, "\"chartPreviousClose\":");
const char *hi_s = json_find(json, "\"high\":");
const char *lo_s = json_find(json, "\"low\":");
const char *vo_s = json_find(json, "\"volume\":");
const char *nm_s = json_find(json, "\"shortName\":");
if (!rp_s || !pc_s || !hi_s || !lo_s || !vo_s) {
char tmp[480];
size_t jlen = strlen(json);
if (jlen > 400) jlen = 400;
snprintf(tmp, sizeof tmp, "%s: parse error (response: %.*s)", symbols[si], (int)jlen, json);
if (buf[0]) strncat(buf, " | ", sizeof buf - strlen(buf) - 1);
strncat(buf, tmp, sizeof buf - strlen(buf) - 1);
free(json); continue;
}
double price = strtod(rp_s, NULL);
double prev_close = strtod(pc_s, NULL);
double high = strtod(hi_s, NULL);
double low = strtod(lo_s, NULL);
long volume = strtol(vo_s, NULL, 10);
double change = price - prev_close;
double pct = (prev_close != 0) ? (change / prev_close) * 100.0 : 0.0;
char name[32] = "";
if (nm_s && nm_s[0] == '"') {
nm_s++;
const char *nq = strchr(nm_s, '"');
if (nq) { size_t nl = nq - nm_s; if (nl > 31) nl = 31; memcpy(name, nm_s, nl); name[nl] = 0; }
}
char tmp[384];
if (name[0])
snprintf(tmp, sizeof tmp, "%s (%s): $%.2f %+.2f (%+.2f%%) H:%.2f L:%.2f Vol:%ldM",
symbols[si], name, price, change, pct, high, low, volume / 1000000);
else
snprintf(tmp, sizeof tmp, "%s: $%.2f %+.2f (%+.2f%%) H:%.2f L:%.2f Vol:%ldM",
symbols[si], price, change, pct, high, low, volume / 1000000);
if (buf[0]) strncat(buf, " | ", sizeof buf - strlen(buf) - 1);
strncat(buf, tmp, sizeof buf - strlen(buf) - 1);
free(json);
}
if (!buf[0]) snprintf(buf, sizeof buf, "Stock: could not fetch data");
collapse_spaces(buf);
irc_msg(s, reply_target, buf);
log_stamp(); fprintf(stderr, CLR_MAGENTA "STOCK %s from %s:" CLR_RESET " %s\n", reply_target, src_nick, buf);
return 1;
}
#endif