char/conduit
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

fix: unauthorized pdus will be responded to with FORBIDDEN

Browse source
This commit is contained in:
Timo Kösters 2021-05-21 18:12:02 +02:00
parent 09157b2096
commit 989d843c40
No known key found for this signature in database
GPG key ID: 24DA7517711A2BA4
3 changed files with 6 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/client_server/membership.rs
View file

@ -569,13 +569,7 @@ async fn join_room_by_id_helper(
{
let (event_id, value) = match result {
Ok(t) => t,
Err(e) => {
warn!(
"PDU could not be verified: {:?} {:?} {:?}",
e, event_id, pdu
);
continue;
}
Err(_) => continue,
};
let pdu = PduEvent::from_id_val(&event_id, value.clone()).map_err(|e| {
@ -701,7 +695,7 @@ async fn validate_and_add_event_id(
db: &Database,
) -> Result<(EventId, CanonicalJsonObject)> {
let mut value = serde_json::from_str::<CanonicalJsonObject>(pdu.json().get()).map_err(|e| {
error!("{:?}: {:?}", pdu, e);
error!("Invalid PDU in server response: {:?}: {:?}", pdu, e);
Error::BadServerResponse("Invalid PDU in server response")
})?;
let event_id = EventId::try_from(&*format!(
@ -745,7 +739,7 @@ async fn validate_and_add_event_id(
&value,
room_version,
) {
warn!("Event {} failed verification: {}", event_id, e);
warn!("Event {} failed verification {:?} {}", event_id, pdu, e);
back_off(event_id);
return Err(Error::BadServerResponse("Event failed verification."));
}

2
src/database/rooms.rs
View file

@ -1309,7 +1309,7 @@ impl Rooms {
if !auth_check {
return Err(Error::BadRequest(
ErrorKind::InvalidParam,
ErrorKind::Forbidden,
"Event is not authorized.",
));
}

4
src/server_server.rs
View file

@ -1484,7 +1484,7 @@ pub(crate) async fn fetch_signing_keys(
}
}
debug!("Loading signing keys for {}", origin);
trace!("Loading signing keys for {}", origin);
let mut result = db
.globals
@ -1943,7 +1943,7 @@ pub fn create_join_event_template_route<'a>(
if !auth_check {
return Err(Error::BadRequest(
ErrorKind::InvalidParam,
ErrorKind::Forbidden,
"Event is not authorized.",
));
}