Skip to content

Commit aabc552

Browse files
S7evinKS7evinK
authored
Merge branch 'main' into main
2 parents 519cf56 + 79fcff2 commit aabc552

File tree

10 files changed

+260
-57
lines changed

10 files changed

+260
-57
lines changed

‎eventV2.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,7 @@ var lenientByteLimitRoomVersions = map[RoomVersion]struct{}{
196196
RoomVersionV8: {},
197197
RoomVersionV9: {},
198198
RoomVersionV10: {},
199+
RoomVersionV11: {},
199200
RoomVersionPseudoIDs: {},
200201
"org.matrix.msc3787": {},
201202
"org.matrix.msc3667": {},

‎eventauth.go‎

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -370,7 +370,11 @@ func (a *allowerContext) update(provider AuthEventProvider) {
370370
}
371371
}
372372
if e, _ := provider.PowerLevels(); a.powerLevelsEvent == nil || a.powerLevelsEvent != e {
373-
if p, err := NewPowerLevelContentFromAuthEvents(provider, a.create.Creator); err == nil {
373+
creator := ""
374+
if a.createEvent != nil {
375+
creator = string(a.createEvent.SenderID())
376+
}
377+
if p, err := NewPowerLevelContentFromAuthEvents(provider, creator); err == nil {
374378
a.powerLevelsEvent = e
375379
a.powerLevels = p
376380
}
@@ -431,21 +435,15 @@ func (a *allowerContext) createEventAllowed(event PDU) error {
431435
if sender.Domain() != event.RoomID().Domain() {
432436
return errorf("create event room ID domain does not match sender: %q != %q", event.RoomID().Domain(), sender.String())
433437
}
434-
c := struct {
435-
Creator *string `json:"creator"`
436-
RoomVersion *RoomVersion `json:"room_version"`
437-
}{}
438-
if err := json.Unmarshal(event.Content(), &c); err != nil {
439-
return errorf("create event has invalid content: %s", err.Error())
440-
}
441-
if c.Creator == nil {
442-
return errorf("create event has no creator field")
438+
439+
verImpl, err := GetRoomVersion(event.Version())
440+
if err != nil {
441+
return nil
443442
}
444-
if c.RoomVersion != nil {
445-
if !KnownRoomVersion(*c.RoomVersion) {
446-
return errorf("create event has unrecognised room version %q", *c.RoomVersion)
447-
}
443+
if err = verImpl.CheckCreateEvent(event, KnownRoomVersion); err != nil {
444+
return err
448445
}
446+
449447
return nil
450448
}
451449

@@ -1013,7 +1011,7 @@ func (m *membershipAllower) membershipAllowed(event PDU) error { // nolint: gocy
10131011

10141012
// Special case the first join event in the room to allow the creator to join.
10151013
// https://github.com/matrix-org/synapse/blob/v0.18.5/synapse/api/auth.py#L328
1016-
if m.targetID == m.create.Creator &&
1014+
if m.targetID == string(m.createEvent.SenderID()) &&
10171015
m.newMember.Membership == spec.Join &&
10181016
m.senderID == m.targetID &&
10191017
len(event.PrevEventIDs()) == 1 {

‎eventcontent.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -575,3 +575,27 @@ type RelatesTo struct {
575575
EventID string `json:"event_id"`
576576
RelationType string `json:"rel_type"`
577577
}
578+
579+
func noCheckCreateEvent(event PDU, knownRoomVersion knownRoomVersionFunc) error {
580+
return nil
581+
}
582+
583+
func checkCreateEvent(event PDU, knownRoomVersion knownRoomVersionFunc) error {
584+
c := struct {
585+
Creator *string `json:"creator"`
586+
RoomVersion *RoomVersion `json:"room_version"`
587+
}{}
588+
if err := json.Unmarshal(event.Content(), &c); err != nil {
589+
return errorf("create event has invalid content: %s", err.Error())
590+
}
591+
if c.Creator == nil {
592+
return errorf("create event has no creator field")
593+
}
594+
if c.RoomVersion != nil {
595+
if !knownRoomVersion(*c.RoomVersion) {
596+
return errorf("create event has unrecognised room version %q", *c.RoomVersion)
597+
}
598+
}
599+
600+
return nil
601+
}

‎eventcontent_test.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -217,11 +217,13 @@ func TestMXIDMapping_SignValidate(t *testing.T) {
217217
assert.NoError(t, err)
218218

219219
// this should pass
220-
err = validateMXIDMappingSignature(context.Background(), ev, &StubVerifier{}, verImpl)
220+
evMapping, err := getMXIDMapping(ev)
221+
assert.NoError(t, err)
222+
err = validateMXIDMappingSignatures(context.Background(), ev, *evMapping, &StubVerifier{}, verImpl)
221223
assert.NoError(t, err)
222224

223225
// this fails, for some random reason
224-
err = validateMXIDMappingSignature(context.Background(), ev, &StubVerifier{
226+
err = validateMXIDMappingSignatures(context.Background(), ev, *evMapping, &StubVerifier{
225227
results: []VerifyJSONResult{{Error: fmt.Errorf("err")}},
226228
}, verImpl)
227229
assert.Error(t, err)
@@ -231,7 +233,6 @@ func TestMXIDMapping_SignValidate(t *testing.T) {
231233
ev, err = eb.Build(time.Now(), serverName, keyID, priv)
232234
assert.NoError(t, err)
233235

234-
err = validateMXIDMappingSignature(context.Background(), ev, &StubVerifier{}, verImpl)
236+
_, err = getMXIDMapping(ev)
235237
assert.Error(t, err)
236-
237238
}

‎eventcrypto.go‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,11 @@ func VerifyEventSignatures(ctx context.Context, e PDU, verifier JSONVerifier, us
8585

8686
// Validate the MXIDMapping is signed correctly
8787
if verImpl.Version() == RoomVersionPseudoIDs && membership == spec.Join {
88-
err = validateMXIDMappingSignature(ctx, e, verifier, verImpl)
88+
mapping, err := getMXIDMapping(e)
89+
if err != nil {
90+
return err
91+
}
92+
err = validateMXIDMappingSignatures(ctx, e, *mapping, verifier, verImpl)
8993
if err != nil {
9094
return err
9195
}
@@ -154,28 +158,32 @@ func VerifyEventSignatures(ctx context.Context, e PDU, verifier JSONVerifier, us
154158
return nil
155159
}
156160

157-
// validateMXIDMappingSignature validates that the MXIDMapping is correctly signed
158-
func validateMXIDMappingSignature(ctx context.Context, e PDU, verifier JSONVerifier, verImpl IRoomVersion) error {
161+
func getMXIDMapping(e PDU) (*MXIDMapping, error) {
159162
var content MemberContent
160163
err := json.Unmarshal(e.Content(), &content)
161164
if err != nil {
162-
return err
165+
return nil, err
163166
}
164167

165168
// if there is no mapping, we can't check the signature
166169
if content.MXIDMapping == nil {
167-
return fmt.Errorf("missing mxid_mapping, unable to validate event")
170+
return nil, fmt.Errorf("missing mxid_mapping")
168171
}
169172

170-
var toVerify []VerifyJSONRequest
173+
return content.MXIDMapping, nil
174+
}
171175

172-
mapping, err := json.Marshal(content.MXIDMapping)
176+
// validateMXIDMappingSignatures validates that the MXIDMapping is correctly signed
177+
func validateMXIDMappingSignatures(ctx context.Context, e PDU, mapping MXIDMapping, verifier JSONVerifier, verImpl IRoomVersion) error {
178+
mappingBytes, err := json.Marshal(mapping)
173179
if err != nil {
174180
return err
175181
}
176-
for s := range content.MXIDMapping.Signatures {
182+
183+
var toVerify []VerifyJSONRequest
184+
for s := range mapping.Signatures {
177185
v := VerifyJSONRequest{
178-
Message: mapping,
186+
Message: mappingBytes,
179187
AtTS: e.OriginServerTS(),
180188
ServerName: s,
181189
ValidityCheckingFunc: verImpl.SignatureValidityCheck,

‎eventversion.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,11 @@ type IRoomVersion interface {
3333
CheckNotificationLevels(senderLevel int64, oldPowerLevels, newPowerLevels PowerLevelContent) error
3434
CheckCanonicalJSON(input []byte) error
3535
ParsePowerLevels(contentBytes []byte, c *PowerLevelContent) error
36+
CheckCreateEvent(event PDU, knownRoomVersion knownRoomVersionFunc) error
3637
}
3738

39+
type knownRoomVersionFunc func(RoomVersion) bool
40+
3841
// StateResAlgorithm refers to a version of the state resolution algorithm.
3942
type StateResAlgorithm int
4043

@@ -58,6 +61,7 @@ const (
5861
RoomVersionV8 RoomVersion = "8"
5962
RoomVersionV9 RoomVersion = "9"
6063
RoomVersionV10 RoomVersion = "10"
64+
RoomVersionV11 RoomVersion = "11"
6165
RoomVersionPseudoIDs RoomVersion = "org.matrix.msc4014"
6266
)
6367

@@ -96,6 +100,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
96100
parsePowerLevelsFunc: parsePowerLevels,
97101
checkKnockingAllowedFunc: disallowKnocking,
98102
checkRestrictedJoinAllowedFunc: disallowRestrictedJoins,
103+
checkCreateEvent: checkCreateEvent,
99104
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV1,
100105
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV1,
101106
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV1,
@@ -115,6 +120,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
115120
parsePowerLevelsFunc: parsePowerLevels,
116121
checkKnockingAllowedFunc: disallowKnocking,
117122
checkRestrictedJoinAllowedFunc: disallowRestrictedJoins,
123+
checkCreateEvent: checkCreateEvent,
118124
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV1,
119125
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV1,
120126
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV1,
@@ -134,6 +140,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
134140
parsePowerLevelsFunc: parsePowerLevels,
135141
checkKnockingAllowedFunc: disallowKnocking,
136142
checkRestrictedJoinAllowedFunc: disallowRestrictedJoins,
143+
checkCreateEvent: checkCreateEvent,
137144
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
138145
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
139146
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -153,6 +160,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
153160
parsePowerLevelsFunc: parsePowerLevels,
154161
checkKnockingAllowedFunc: disallowKnocking,
155162
checkRestrictedJoinAllowedFunc: disallowRestrictedJoins,
163+
checkCreateEvent: checkCreateEvent,
156164
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
157165
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
158166
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -172,6 +180,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
172180
parsePowerLevelsFunc: parsePowerLevels,
173181
checkKnockingAllowedFunc: disallowKnocking,
174182
checkRestrictedJoinAllowedFunc: disallowRestrictedJoins,
183+
checkCreateEvent: checkCreateEvent,
175184
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
176185
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
177186
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -191,6 +200,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
191200
parsePowerLevelsFunc: parsePowerLevels,
192201
checkKnockingAllowedFunc: disallowKnocking,
193202
checkRestrictedJoinAllowedFunc: disallowRestrictedJoins,
203+
checkCreateEvent: checkCreateEvent,
194204
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
195205
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
196206
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -210,6 +220,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
210220
parsePowerLevelsFunc: parsePowerLevels,
211221
checkKnockingAllowedFunc: checkKnocking,
212222
checkRestrictedJoinAllowedFunc: disallowRestrictedJoins,
223+
checkCreateEvent: checkCreateEvent,
213224
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
214225
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
215226
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -229,6 +240,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
229240
parsePowerLevelsFunc: parsePowerLevels,
230241
checkKnockingAllowedFunc: checkKnocking,
231242
checkRestrictedJoinAllowedFunc: allowRestrictedJoins,
243+
checkCreateEvent: checkCreateEvent,
232244
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
233245
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
234246
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -248,6 +260,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
248260
parsePowerLevelsFunc: parsePowerLevels,
249261
checkKnockingAllowedFunc: checkKnocking,
250262
checkRestrictedJoinAllowedFunc: allowRestrictedJoins,
263+
checkCreateEvent: checkCreateEvent,
251264
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
252265
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
253266
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -267,6 +280,27 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
267280
parsePowerLevelsFunc: parseIntegerPowerLevels,
268281
checkKnockingAllowedFunc: checkKnocking,
269282
checkRestrictedJoinAllowedFunc: allowRestrictedJoins,
283+
checkCreateEvent: checkCreateEvent,
284+
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
285+
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
286+
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
287+
},
288+
RoomVersionV11: RoomVersionImpl{
289+
ver: RoomVersionV11,
290+
stable: true,
291+
stateResAlgorithm: StateResV2,
292+
eventFormat: EventFormatV2,
293+
eventIDFormat: EventIDFormatV3,
294+
redactionAlgorithm: redactEventJSONV5,
295+
signatureValidityCheckFunc: StrictValiditySignatureCheck,
296+
canonicalJSONCheck: verifyEnforcedCanonicalJSON,
297+
notificationLevelCheck: checkNotificationLevels,
298+
restrictedJoinServernameFunc: extractAuthorisedViaServerName,
299+
checkRestrictedJoin: checkRestrictedJoin,
300+
parsePowerLevelsFunc: parseIntegerPowerLevels,
301+
checkKnockingAllowedFunc: checkKnocking,
302+
checkRestrictedJoinAllowedFunc: allowRestrictedJoins,
303+
checkCreateEvent: noCheckCreateEvent,
270304
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
271305
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
272306
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -286,6 +320,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
286320
parsePowerLevelsFunc: parseIntegerPowerLevels,
287321
checkKnockingAllowedFunc: checkKnocking,
288322
checkRestrictedJoinAllowedFunc: allowRestrictedJoins,
323+
checkCreateEvent: checkCreateEvent,
289324
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
290325
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
291326
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -305,6 +340,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
305340
parsePowerLevelsFunc: parseIntegerPowerLevels,
306341
checkKnockingAllowedFunc: checkKnocking,
307342
checkRestrictedJoinAllowedFunc: disallowRestrictedJoins,
343+
checkCreateEvent: checkCreateEvent,
308344
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
309345
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
310346
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -323,6 +359,7 @@ var roomVersionMeta = map[RoomVersion]IRoomVersion{
323359
checkRestrictedJoin: checkRestrictedJoin,
324360
parsePowerLevelsFunc: parsePowerLevels,
325361
checkKnockingAllowedFunc: checkKnocking,
362+
checkCreateEvent: checkCreateEvent,
326363
newEventFromUntrustedJSONFunc: newEventFromUntrustedJSONV2,
327364
newEventFromTrustedJSONFunc: newEventFromTrustedJSONV2,
328365
newEventFromTrustedJSONWithEventIDFunc: newEventFromTrustedJSONWithEventIDV2,
@@ -404,6 +441,7 @@ type RoomVersionImpl struct {
404441
restrictedJoinServernameFunc func(content []byte) (spec.ServerName, error)
405442
checkRestrictedJoinAllowedFunc func() error
406443
checkKnockingAllowedFunc func(m *membershipAllower) error
444+
checkCreateEvent func(e PDU, knownRoomVersion knownRoomVersionFunc) error
407445
newEventFromUntrustedJSONFunc func(eventJSON []byte, roomVersion IRoomVersion) (result PDU, err error)
408446
newEventFromTrustedJSONFunc func(eventJSON []byte, redacted bool, roomVersion IRoomVersion) (result PDU, err error)
409447
newEventFromTrustedJSONWithEventIDFunc func(eventID string, eventJSON []byte, redacted bool, roomVersion IRoomVersion) (result PDU, err error)
@@ -470,6 +508,10 @@ func (v RoomVersionImpl) ParsePowerLevels(contentBytes []byte, c *PowerLevelCont
470508
return v.parsePowerLevelsFunc(contentBytes, c)
471509
}
472510

511+
func (v RoomVersionImpl) CheckCreateEvent(event PDU, knownRoomVersion knownRoomVersionFunc) error {
512+
return v.checkCreateEvent(event, knownRoomVersion)
513+
}
514+
473515
func (v RoomVersionImpl) CheckRestrictedJoin(
474516
ctx context.Context,
475517
localServerName spec.ServerName,

‎handlejoin.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import (
2222

2323
"github.com/matrix-org/gomatrixserverlib/spec"
2424
"github.com/matrix-org/util"
25-
"github.com/tidwall/gjson"
2625
)
2726

2827
type HandleMakeJoinInput struct {
@@ -351,15 +350,14 @@ func HandleSendJoin(input HandleSendJoinInput) (*HandleSendJoinResponse, error)
351350
// validate the mxid_mapping of the event
352351
if input.RoomVersion == RoomVersionPseudoIDs {
353352
// validate the signature first
354-
if err = validateMXIDMappingSignature(input.Context, event, input.Verifier, verImpl); err != nil {
353+
mapping, err := getMXIDMapping(event)
354+
if err != nil {
355+
return nil, spec.BadJSON(err.Error())
356+
}
357+
if err = validateMXIDMappingSignatures(input.Context, event, *mapping, input.Verifier, verImpl); err != nil {
355358
return nil, spec.Forbidden(err.Error())
356359
}
357360

358-
mapping := MXIDMapping{}
359-
err = json.Unmarshal([]byte(gjson.GetBytes(input.JoinEvent, "content.mxid_mapping").Raw), &mapping)
360-
if err != nil {
361-
return nil, err
362-
}
363361
// store the user room public key -> userID mapping
364362
if err = input.StoreSenderIDFromPublicID(input.Context, mapping.UserRoomKey, mapping.UserID, input.RoomID); err != nil {
365363
return nil, err

‎performjoin.go‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -304,20 +304,17 @@ func storeMXIDMappings(
304304
if ev.Type() != spec.MRoomMember {
305305
continue
306306
}
307-
mapping := MemberContent{}
308-
if err := json.Unmarshal(ev.Content(), &mapping); err != nil {
307+
mapping, err := getMXIDMapping(ev)
308+
if err != nil {
309309
return err
310310
}
311-
if mapping.MXIDMapping == nil {
312-
continue
313-
}
314311
// we already validated it is a valid roomversion, so this should be safe to use.
315312
verImpl := MustGetRoomVersion(ev.Version())
316-
if err := validateMXIDMappingSignature(ctx, ev, keyRing, verImpl); err != nil {
313+
if err := validateMXIDMappingSignatures(ctx, ev, *mapping, keyRing, verImpl); err != nil {
317314
logrus.WithError(err).Error("invalid signature for mxid_mapping")
318315
continue
319316
}
320-
if err := storeSenderID(ctx, ev.SenderID(), mapping.MXIDMapping.UserID, roomID); err != nil {
317+
if err := storeSenderID(ctx, ev.SenderID(), mapping.UserID, roomID); err != nil {
321318
return err
322319
}
323320
}

0 commit comments

Comments
 (0)