git-mirrors/continuwuity
1
0
Fork 0
mirror of https://forgejo.ellis.link/continuwuation/continuwuity.git synced 2025-06-26 19:46:36 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add new room ID check to m.room.create auth

Browse source
This commit is contained in:
nexy7574 2025-06-13 18:06:36 +01:00
parent bb69ee68d0
commit 78f0031c34
No known key found for this signature in database
GPG key ID: 0FA334385D0B689F
1 changed files with 18 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
src/core/matrix/state_res/event_auth.rs
View file

@ -56,6 +56,7 @@ pub fn auth_types_for_event(
sender: &UserId,
state_key: Option<&str>,
content: &RawJsonValue,
room_version: &RoomVersion,
) -> serde_json::Result<Vec<(StateEventType, StateKey)>> {
if kind == &TimelineEventType::RoomCreate {
return Ok(vec![]);
@ -64,8 +65,11 @@ pub fn auth_types_for_event(
let mut auth_types = vec![
(StateEventType::RoomPowerLevels, StateKey::new()),
(StateEventType::RoomMember, sender.as_str().into()),
(StateEventType::RoomCreate, StateKey::new()),
];
if !room_version.create_id_as_room_id {
auth_types.push((StateEventType::RoomCreate, StateKey::new()))
// m.room.create is only referenced if it isn't the room ID
}
if kind == &TimelineEventType::RoomMember {
#[derive(Deserialize)]
@ -183,16 +187,20 @@ where
return Ok(false);
}
// If the domain of the room_id does not match the domain of the sender, reject
let Some(room_id_server_name) = incoming_event.room_id().server_name() else {
warn!("room ID has no servername");
return Ok(false);
};
if room_id_server_name != sender.server_name() {
warn!("servername of room ID does not match servername of sender");
return Ok(false);
if room_version.create_id_as_room_id {
let expected = format!("!{}:{}", incoming_event.event_id().localpart(), sender.server_name());
if incoming_event.room_id().as_str() != expected {
warn!("room create included a room ID that does not match the event ID");
return Ok(false);
}
} else {
// If the domain of the room_id does not match the domain of the sender, reject
let Some(_room_id_server_name) = incoming_event.room_id().server_name() else {
warn!("room ID has no servername");
return Ok(false);
};
}
// If content.room_version is present and is not a recognized version, reject
let content: RoomCreateContentFields = from_json_str(incoming_event.content().get())?;