feat: adds federation files support #36842

coderabbitai · 2025-09-19T20:45:01Z

⚠️ Potential issue

Don’t blindly merge decrypted payload into the message; restrict to allowed keys

Object.assign(data, content) can overwrite reserved fields (e.g., t, rid, _id) if a crafted payload is decrypted. Limit merge to the fields we actually encrypt (msg, attachments, files, file).

Apply this diff:

- async decryptContent<T extends EncryptedMessageContent>(data: T) { - const content = await this.decrypt(data.content.ciphertext); - Object.assign(data, content); - return data; - } + async decryptContent<T extends EncryptedMessageContent>(data: T) { + const content = await this.decrypt(data.content.ciphertext); + const { msg, attachments, files, file } = content as Partial<Pick<IMessage, 'msg' | 'attachments' | 'files' | 'file'>>; + // Only merge known, safe fields produced by encryptMessageContent + if (msg !== undefined) (data as any).msg = msg; + if (attachments !== undefined) (data as any).attachments = attachments; + if (files !== undefined) (data as any).files = files; + if (file !== undefined) (data as any).file = file; + return data; + }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

async decryptContent<T extends EncryptedMessageContent>(data: T) {

const content = await this.decrypt(data.content.ciphertext);

Object.assign(data, content);

async decryptContent<T extends EncryptedMessageContent>(data: T) {

const content = await this.decrypt(data.content.ciphertext);

const { msg, attachments, files, file } = content as Partial<Pick<IMessage, 'msg' | 'attachments' | 'files' | 'file'>>;

// Only merge known, safe fields produced by encryptMessageContent

if (msg !== undefined) (data as any).msg = msg;

if (attachments !== undefined) (data as any).attachments = attachments;

if (files !== undefined) (data as any).files = files;

if (file !== undefined) (data as any).file = file;

return data;

}

🤖 Prompt for AI Agents

In apps/meteor/client/lib/e2ee/rocketchat.e2e.room.ts around lines 674 to 677, the current Object.assign(data, content) blindly merges decrypted payload into the message and can overwrite reserved fields like t, rid, _id; instead, only copy the allowed encrypted fields (msg, attachments, files, file) from the decrypted content into data. Replace the Object.assign call with code that picks those specific keys if they exist on the decrypted content and assigns them to data (e.g., check for each allowed key and set data[key] = content[key] only when defined) so reserved fields cannot be overwritten.

-Original file line number
+Diff line change
@@ Expand Up / @@ -2,7 +2,7 @@ import QueryString from 'querystring'; @@
     import URL from 'url';
     import type { IE2EEMessage, IMessage, IRoom, ISubscription, IUser, IUploadWithUser, MessageAttachment } from '@rocket.chat/core-typings';
-    import { isE2EEMessage } from '@rocket.chat/core-typings';
+    import { isE2EEMessage, isEncryptedMessageContent } from '@rocket.chat/core-typings';
     import { Emitter } from '@rocket.chat/emitter';
     import { imperativeModal } from '@rocket.chat/ui-client';
     import EJSON from 'ejson';
@@ Expand Down Expand Up / @@ -664,7 +664,7 @@ class E2E extends Emitter { @@
     	}
     	async decryptFileContent(file: IUploadWithUser): Promise<IUploadWithUser> {
-    		if (!file.rid) {
+    		if (!file.rid || !isEncryptedMessageContent(file)) {
     			return file;
     		}
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up @@
     		rid,
     		msg,
     		federation_event_id,
+    		file,
+    		files,
+    		attachments,
     		thread,
     	}: {
     		fromId: string;
     		rid: string;
     		msg: string;
     		federation_event_id: string;
+    		file?: IMessage['file'];
+    		files?: IMessage['files'];
+    		attachments?: IMessage['attachments'];
     		thread?: { tmid: string; tshow: boolean };
     	}): Promise<IMessage> {
     		return executeSendMessage(fromId, {
     			rid,
     			msg,
     			...thread,
     			federation: { eventId: federation_event_id },
+    			...(file && { file }),
+    			...(files && { files }),
+    			...(attachments && { attachments }),
     		});
     	}
@@ Expand Down @@

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: adds federation files support #36842

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai bot Sep 19, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

-Original file line number
+Diff line change
@@ Expand Up / @@ -16,6 +16,7 @@ import emojione from 'emojione'; @@
     import { getWellKnownRoutes } from './api/.well-known/server';
     import { getMatrixInviteRoutes } from './api/_matrix/invite';
     import { getKeyServerRoutes } from './api/_matrix/key/server';
+    import { getMatrixMediaRoutes } from './api/_matrix/media';
     import { getMatrixProfilesRoutes } from './api/_matrix/profiles';
     import { getMatrixRoomsRoutes } from './api/_matrix/rooms';
     import { getMatrixSendJoinRoutes } from './api/_matrix/send-join';
@@ Expand All @@
     import { registerEvents } from './events';
     import { saveExternalUserIdForLocalUser } from './helpers/identifiers';
     import { toExternalMessageFormat, toExternalQuoteMessageFormat } from './helpers/message.parsers';
+    import { MatrixMediaService } from './services/MatrixMediaService';
+    type MatrixFileTypes = 'm.image' | 'm.video' | 'm.audio' | 'm.file';
+    export const fileTypes: Record<string, MatrixFileTypes> = {
+    	image: 'm.image',
+    	video: 'm.video',
+    	audio: 'm.audio',
+    	file: 'm.file',
+    };
     export class FederationMatrix extends ServiceClass implements IFederationMatrixService {
     	protected name = 'federation-matrix';
@@ Expand Down Expand Up @@
     		await createFederationContainer(containerOptions, config);
     		instance.homeserverServices = getAllServices();
+    		MatrixMediaService.setHomeserverServices(instance.homeserverServices);
     		instance.buildMatrixHTTPRoutes();
     		instance.onEvent('user.typing', async ({ isTyping, roomId, user: { username } }): Promise<void> => {
     			if (!roomId || !username) {
@@ Expand Down Expand Up @@
     			.use(getMatrixSendJoinRoutes(this.homeserverServices))
     			.use(getMatrixTransactionsRoutes(this.homeserverServices))
     			.use(getKeyServerRoutes(this.homeserverServices))
-    			.use(getFederationVersionsRoutes(this.homeserverServices));
+    			.use(getFederationVersionsRoutes(this.homeserverServices))
+    			.use(getMatrixMediaRoutes(this.homeserverServices));
     		wellKnown.use(isFederationEnabledMiddleware).use(isLicenseEnabledMiddleware).use(getWellKnownRoutes(this.homeserverServices));
@@ Expand Down Expand Up @@
     		}
     	}
+    	private getMatrixMessageType(mimeType?: string): MatrixFileTypes {
+    		const mainType = mimeType?.split('/')[0];
+    		if (!mainType) {
+    			return fileTypes.file;
+    		}
+    		return fileTypes[mainType] ?? fileTypes.file;
+    	}
+    	private async handleFileMessage(
+    		message: IMessage,
+    		matrixRoomId: string,
+    		matrixUserId: string,
+    		matrixDomain: string,
+    	): Promise<{ eventId: string } | null> {
+    		if (!message.files || message.files.length === 0) {
+    			return null;
+    		}
+    		try {
+    			// TODO: Handle multiple files
+    			const file = message.files[0];
+    			const mxcUri = await MatrixMediaService.prepareLocalFileForMatrix(file._id, matrixDomain);
+    			const msgtype = this.getMatrixMessageType(file.type);
+    			const fileContent = {
+    				body: file.name,
+    				msgtype,
+    				url: mxcUri,
+    				info: {
+    					mimetype: file.type,
+    					size: file.size,
+    				},
+    			};
+    			return this.homeserverServices.message.sendFileMessage(matrixRoomId, fileContent, matrixUserId);
+    		} catch (error) {
+    			this.logger.error('Failed to handle file message', {
+    				messageId: message._id,
+    				error,
+    			});
+    			throw error;
+    		}
+    	}
+    	private async handleTextMessage(
+    		message: IMessage,
+    		matrixRoomId: string,
+    		matrixUserId: string,
+    		matrixDomain: string,
+    	): Promise<{ eventId: string } | null> {
+    		const parsedMessage = await toExternalMessageFormat({
+    			message: message.msg,
+    			externalRoomId: matrixRoomId,
+    			homeServerDomain: matrixDomain,
+    		});
+    		if (message.tmid) {
+    			return this.handleThreadedMessage(message, matrixRoomId, matrixUserId, matrixDomain, parsedMessage);
+    		}
+    		if (message.attachments?.some((attachment) => isQuoteAttachment(attachment) && Boolean(attachment.message_link))) {
+    			return this.handleQuoteMessage(message, matrixRoomId, matrixUserId, matrixDomain);
+    		}
+    		return this.homeserverServices.message.sendMessage(matrixRoomId, message.msg, parsedMessage, matrixUserId);
+    	}
+    	private async handleThreadedMessage(
+    		message: IMessage,
+    		matrixRoomId: string,
+    		matrixUserId: string,
+    		matrixDomain: string,
+    		parsedMessage: string,
+    	): Promise<{ eventId: string } | null> {
+    		if (!message.tmid) {
+    			throw new Error('Thread message ID not found');
+    		}
+    		const threadRootMessage = await Messages.findOneById(message.tmid);
+    		const threadRootEventId = threadRootMessage?.federation?.eventId;
+    		if (!threadRootEventId) {
+    			this.logger.warn('Thread root event ID not found, sending as regular message');
+    			if (message.attachments?.some((attachment) => isQuoteAttachment(attachment) && Boolean(attachment.message_link))) {
+    				return this.handleQuoteMessage(message, matrixRoomId, matrixUserId, matrixDomain);
+    			}
+    			return this.homeserverServices.message.sendMessage(matrixRoomId, message.msg, parsedMessage, matrixUserId);
+    		}
+    		const latestThreadMessage = await Messages.findLatestFederationThreadMessageByTmid(message.tmid, message._id);
+    		const latestThreadEventId = latestThreadMessage?.federation?.eventId;
+    		if (message.attachments?.some((attachment) => isQuoteAttachment(attachment) && Boolean(attachment.message_link))) {
+    			const quoteMessage = await this.getQuoteMessage(message, matrixRoomId, matrixUserId, matrixDomain);
+    			if (!quoteMessage) {
+    				throw new Error('Failed to retrieve quote message');
+    			}
+    			return this.homeserverServices.message.sendReplyToInsideThreadMessage(
+    				matrixRoomId,
+    				quoteMessage.rawMessage,
+    				quoteMessage.formattedMessage,
+    				matrixUserId,
+    				threadRootEventId,
+    				quoteMessage.eventToReplyTo,
+    			);
+    		}
+    		return this.homeserverServices.message.sendThreadMessage(
+    			matrixRoomId,
+    			message.msg,
+    			parsedMessage,
+    			matrixUserId,
+    			threadRootEventId,
+    			latestThreadEventId,
+    		);
+    	}
+    	private async handleQuoteMessage(
+    		message: IMessage,
+    		matrixRoomId: string,
+    		matrixUserId: string,
+    		matrixDomain: string,
+    	): Promise<{ eventId: string } | null> {
+    		const quoteMessage = await this.getQuoteMessage(message, matrixRoomId, matrixUserId, matrixDomain);
+    		if (!quoteMessage) {
+    			throw new Error('Failed to retrieve quote message');
+    		}
+    		return this.homeserverServices.message.sendReplyToMessage(
+    			matrixRoomId,
+    			quoteMessage.rawMessage,
+    			quoteMessage.formattedMessage,
+    			quoteMessage.eventToReplyTo,
+    			matrixUserId,
+    		);
+    	}
     	async sendMessage(message: IMessage, room: IRoom, user: IUser): Promise<void> {
     		try {
     			const matrixRoomId = await MatrixBridgedRoom.getExternalRoomId(room._id);
@@ Expand All @@
     			const actualMatrixUserId = existingMatrixUserId || matrixUserId;
     			let result;
-    			const parsedMessage = await toExternalMessageFormat({
-    				message: message.msg,
-    				externalRoomId: matrixRoomId,
-    				homeServerDomain: this.serverName,
-    			});
-    			if (!message.tmid) {
-    				if (message.attachments?.some((attachment) => isQuoteAttachment(attachment) && Boolean(attachment.message_link))) {
-    					const quoteMessage = await this.getQuoteMessage(message, matrixRoomId, actualMatrixUserId, this.serverName);
-    					if (!quoteMessage) {
-    						throw new Error('Failed to retrieve quote message');
-    					}
-    					result = await this.homeserverServices.message.sendReplyToMessage(
-    						matrixRoomId,
-    						quoteMessage.rawMessage,
-    						quoteMessage.formattedMessage,
-    						quoteMessage.eventToReplyTo,
-    						actualMatrixUserId,
-    					);
-    				} else {
-    					result = await this.homeserverServices.message.sendMessage(matrixRoomId, message.msg, parsedMessage, actualMatrixUserId);
-    				}
+    			if (message.files && message.files.length > 0) {
+    				result = await this.handleFileMessage(message, matrixRoomId, actualMatrixUserId, this.serverName);
     			} else {
-    				const threadRootMessage = await Messages.findOneById(message.tmid);
-    				const threadRootEventId = threadRootMessage?.federation?.eventId;
-    				if (threadRootEventId) {
-    					const latestThreadMessage = await Messages.findOne(
-    						{
-    							'tmid': message.tmid,
-    							'federation.eventId': { $exists: true },
-    							'_id': { $ne: message._id }, // Exclude the current message
-    						},
-    						{ sort: { ts: -1 } },
-    					);
-    					const latestThreadEventId = latestThreadMessage?.federation?.eventId;
-    					if (message.attachments?.some((attachment) => isQuoteAttachment(attachment) && Boolean(attachment.message_link))) {
-    						const quoteMessage = await this.getQuoteMessage(message, matrixRoomId, actualMatrixUserId, this.serverName);
-    						if (!quoteMessage) {
-    							throw new Error('Failed to retrieve quote message');
-    						}
-    						result = await this.homeserverServices.message.sendReplyToInsideThreadMessage(
-    							matrixRoomId,
-    							quoteMessage.rawMessage,
-    							quoteMessage.formattedMessage,
-    							actualMatrixUserId,
-    							threadRootEventId,
-    							quoteMessage.eventToReplyTo,
-    						);
-    					} else {
-    						result = await this.homeserverServices.message.sendThreadMessage(
-    							matrixRoomId,
-    							message.msg,
-    							parsedMessage,
-    							actualMatrixUserId,
-    							threadRootEventId,
-    							latestThreadEventId,
-    						);
-    					}
-    				} else {
-    					this.logger.warn('Thread root event ID not found, sending as regular message');
-    					if (message.attachments?.some((attachment) => isQuoteAttachment(attachment) && Boolean(attachment.message_link))) {
-    						const quoteMessage = await this.getQuoteMessage(message, matrixRoomId, actualMatrixUserId, this.serverName);
-    						if (!quoteMessage) {
-    							throw new Error('Failed to retrieve quote message');
-    						}
-    						result = await this.homeserverServices.message.sendReplyToMessage(
-    							matrixRoomId,
-    							quoteMessage.rawMessage,
-    							quoteMessage.formattedMessage,
-    							quoteMessage.eventToReplyTo,
-    							actualMatrixUserId,
-    						);
-    					} else {
-    						result = await this.homeserverServices.message.sendMessage(matrixRoomId, message.msg, parsedMessage, actualMatrixUserId);
-    					}
-    				}
+    				result = await this.handleTextMessage(message, matrixRoomId, actualMatrixUserId, this.serverName);
     			}
     			if (!result) {
@@ Expand Down @@

feat: adds federation files support #36842

Uh oh!

feat: adds federation files support #36842

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai bot Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!