diff --git a/.github/actions/build-docker/action.yml b/.github/actions/build-docker/action.yml index 5bc982877ad0f..60d197325bed8 100644 --- a/.github/actions/build-docker/action.yml +++ b/.github/actions/build-docker/action.yml @@ -85,11 +85,6 @@ runs: - run: yarn build if: inputs.setup == 'true' shell: bash - - if: ${{ inputs.platform == 'alpine' }} - uses: actions/cache@v4 - with: - path: /tmp/build/matrix-sdk-crypto.linux-x64-musl.node - key: matrix-rust-sdk-crypto-nodejs-v0.2.0-beta.1 - name: Build Docker images shell: bash diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7d94af3025df4..cbc88a65a7461 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -247,54 +247,9 @@ jobs: deno-version: ${{ needs.release-versions.outputs.deno-version }} coverage: false - # TODO: this should go away once upstream builds are fixed - build-matrix-rust-bindings-for-alpine: - name: Builds matrix rust bindings against alpine - runs-on: ubuntu-24.04 - steps: - - name: check cache for matrix-rust-sdk-crypto-nodejs - id: matrix-rust-sdk-crypto-nodejs - uses: actions/cache@v4 - with: - path: /tmp/build/matrix-sdk-crypto.linux-x64-musl.node - key: matrix-rust-sdk-crypto-nodejs-v0.2.0-beta.1 - - - uses: actions/checkout@v4 - with: - repository: matrix-org/matrix-rust-sdk-crypto-nodejs - ref: v0.2.0-beta.1 # https://github.com/element-hq/matrix-bot-sdk/blob/e72a4c498e00c6c339a791630c45d00a351f56a8/package.json#L58 - - - if: steps.matrix-rust-sdk-crypto-nodejs.outputs.cache-hit != 'true' - run: sudo apt-get install -y musl-tools libunwind-dev && find /usr/include -name stdarg.h 2>/dev/null || true - - - if: steps.matrix-rust-sdk-crypto-nodejs.outputs.cache-hit != 'true' - uses: actions/setup-node@v4.4.0 - with: - node-version: 22.16.0 - - - if: steps.matrix-rust-sdk-crypto-nodejs.outputs.cache-hit != 'true' - uses: actions-rust-lang/setup-rust-toolchain@v1 - with: - toolchain: '1.76' - target: x86_64-unknown-linux-musl - - - if: steps.matrix-rust-sdk-crypto-nodejs.outputs.cache-hit != 'true' - name: Install ziglang - uses: mlugg/setup-zig@v1 - with: - version: 0.13.0 - - - if: steps.matrix-rust-sdk-crypto-nodejs.outputs.cache-hit != 'true' - name: Build - run: | - npm install --ignore-scripts - npx napi build --release --target x86_64-unknown-linux-musl --platform --zig - mkdir -p /tmp/build - mv matrix-sdk-crypto.linux-x64-musl.node /tmp/build/matrix-sdk-crypto.linux-x64-musl.node - build-gh-docker-coverage: name: 🚢 Build Docker Images for Testing - needs: [build, release-versions, build-matrix-rust-bindings-for-alpine] + needs: [build, release-versions] runs-on: ubuntu-24.04 env: @@ -323,11 +278,6 @@ jobs: build-containers: ${{ matrix.platform == needs.release-versions.outputs.official-platform && 'authorization-service account-service ddp-streamer-service presence-service stream-hub-service queue-worker-service omnichannel-transcript-service' || '' }} NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - - name: Make sure matrix bindings load - if: (github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'release' || github.ref == 'refs/heads/develop') && matrix.platform == 'alpine' && github.actor != 'dependabot[bot]' - run: | - docker run --rm -w /app/bundle/programs/server/npm/node_modules/matrix-appservice-bridge ghcr.io/rocketchat/rocket.chat:$RC_DOCKER_TAG -e 'require(".")' - - name: Rename official Docker tag to GitHub Container Registry if: matrix.platform == needs.release-versions.outputs.official-platform && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'release' || github.ref == 'refs/heads/develop') && github.actor != 'dependabot[bot]' run: | diff --git a/apps/meteor/.docker/Dockerfile.alpine b/apps/meteor/.docker/Dockerfile.alpine index 5f36d353ba054..0576b843f0ce1 100644 --- a/apps/meteor/.docker/Dockerfile.alpine +++ b/apps/meteor/.docker/Dockerfile.alpine @@ -41,8 +41,6 @@ RUN cd /app/bundle/programs/server \ && npm install sharp@0.32.6 --no-save \ && mv node_modules/sharp npm/node_modules/sharp \ # End hack for sharp - && cd /app/bundle/programs/server/npm/node_modules/@vector-im/matrix-bot-sdk \ - && npm install \ # # Start hack for isolated-vm... # && rm -rf npm/node_modules/isolated-vm \ # && npm install isolated-vm@4.6.0 \ @@ -58,10 +56,6 @@ RUN apk del deps USER rocketchat -# TODO: remove hack once upstream builds are fixed -COPY --chown=rocketchat:rocketchat matrix-sdk-crypto.linux-x64-musl.node /app/bundle/programs/server/npm/node_modules/@matrix-org/matrix-sdk-crypto-nodejs -COPY --chown=rocketchat:rocketchat matrix-sdk-crypto.linux-x64-musl.node /app/bundle/programs/server/npm/node_modules/@vector-im/matrix-bot-sdk/node_modules/@matrix-org/matrix-sdk-crypto-nodejs - VOLUME /app/uploads WORKDIR /app/bundle diff --git a/apps/meteor/package.json b/apps/meteor/package.json index 79d327ce24378..90012cd37bc47 100644 --- a/apps/meteor/package.json +++ b/apps/meteor/package.json @@ -315,7 +315,6 @@ "@slack/rtm-api": "^7.0.3", "@tanstack/react-query": "~5.65.1", "@types/meteor": "^2.9.9", - "@vector-im/matrix-bot-sdk": "0.7.1-element.11", "@xmldom/xmldom": "^0.8.10", "adm-zip": "0.5.16", "ajv": "^8.17.1", @@ -396,8 +395,6 @@ "lodash.get": "^4.4.2", "mailparser": "^3.7.3", "marked": "^4.3.0", - "matrix-appservice": "^2.0.0", - "matrix-appservice-bridge": "^10.3.3", "mem": "^8.1.1", "meteor-node-stubs": "^1.2.19", "mime-db": "^1.52.0", diff --git a/ee/packages/federation-matrix/package.json b/ee/packages/federation-matrix/package.json index 8b51664ef4290..781ccca196a0b 100644 --- a/ee/packages/federation-matrix/package.json +++ b/ee/packages/federation-matrix/package.json @@ -10,7 +10,7 @@ "@rocket.chat/eslint-config": "workspace:^", "@types/emojione": "^2.2.9", "@types/node": "~22.14.0", - "@types/sanitize-html": "^2", + "@types/sanitize-html": "^2.13.0", "babel-jest": "~30.0.0", "eslint": "~8.45.0", "jest": "~30.0.0", @@ -44,7 +44,6 @@ "@rocket.chat/models": "workspace:^", "@rocket.chat/network-broker": "workspace:^", "@rocket.chat/rest-typings": "workspace:^", - "@vector-im/matrix-bot-sdk": "^0.7.1-element.6", "emojione": "^4.5.0", "marked": "^16.1.2", "mongodb": "6.10.0", diff --git a/ee/packages/federation-matrix/src/helpers/message.parsers.spec.ts b/ee/packages/federation-matrix/src/helpers/message.parsers.spec.ts index 7076a8f472310..93f49a8729f39 100644 --- a/ee/packages/federation-matrix/src/helpers/message.parsers.spec.ts +++ b/ee/packages/federation-matrix/src/helpers/message.parsers.spec.ts @@ -1016,6 +1016,24 @@ describe('Federation - Infrastructure - Matrix - RocketTextParser', () => { 😀 😀`); }); + + it('should properly sanitize malicious HTML that could bypass regex-based stripping', async () => { + const rawMessage = '> <@originalEventSender:localDomain.com> Quoted message\n\n test message'; + const formattedMessage = `${quotedMessage}

test message

ipt>alert('xss')`; + + const result = await toInternalQuoteMessageFormat({ + homeServerDomain, + rawMessage, + formattedMessage, + messageToReplyToUrl: 'http://localhost:3000/group/1?msg=2354543564', + senderExternalId: '@user:externalDomain.com', + }); + + expect(result).not.toContain('