feat(common): Partially protect against malicious origin_server_ts
#5648
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CodSpeed Performance ReportMerging #5648 will not alter performanceComparing Summary
|
Hywan
force-pushed
the
fix-origin-server-ts
branch
3 times, most recently
from
43029f5 to
31a0943
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #5648 +/- ##
========================================
Coverage 88.35% 88.36%
========================================
Files 354 354
Lines 97059 97218 +159
Branches 97059 97218 +159
========================================
+ Hits 85752 85902 +150
- Misses 7261 7269 +8
- Partials 4046 4047 +1 ☔ View full report in Codecov by Sentry. |
Hywan
force-pushed
the
fix-origin-server-ts
branch
from
31a0943 to
dae438b
Compare
This patch adds the `timestamp` field to `TimelineEvent`. It's a copy of the `origin_server_ts` value, parsed as an `Option<MilliSecondsSinceUnixEpoch>`. It's `None` if the parsing failed, or if the `TimelineEvent` was deserialised from a version before this new field was added. A new `extract_timestamp` function is added for this purpose. It protects against malicious `origin_server_ts` where the value can be set to year 2100 for example. The only protection we are adding here is to take the `min(origin_server_ts, now())`, so that the event can never been “in the future”. It doesn't protect against a malicious value like 0. It's non-trivial to define a minimum timestamp for an event. When a `TimelineEvent` is mapped from one kind to another kind, the `timestamp` is carried over. To achieve that, new `to_decrypted` and `to_utd` methods are added. The rest of the code is updated accordingly.
Hywan
force-pushed
the
fix-origin-server-ts
branch
from
dae438b to
e89f368
Compare
…:timestamp` method. This patch updates `LatestEventValue::timestamp` to use the new `TimelineEvent::timestamp` method in case of a `LatestEventValue::Remote`.
Hywan
force-pushed
the
fix-origin-server-ts
branch
from
e89f368 to
a4348d4
Compare
stefanceriu
reviewed
Sep 11, 2025
Hywan
added a commit
to Hywan/matrix-rust-sdk
that referenced
this pull request
Sep 12, 2025
…::timestamp`. After the merge of matrix-org#5648, we want all events to get a `TimelineEvent::timestamp` value (extracted from `origin_server_ts`). To accomplish that, we are emptying the event cache. New synced events will be built correctly, with a valid `TimelineEvent::timestamp`, allowing a clear, stable situation.
Hywan
added a commit
to Hywan/matrix-rust-sdk
that referenced
this pull request
Sep 12, 2025
…::timestamp`. After the merge of matrix-org#5648, we want all events to get a `TimelineEvent::timestamp` value (extracted from `origin_server_ts`). To accomplish that, we are emptying the event cache. New synced events will be built correctly, with a valid `TimelineEvent::timestamp`, allowing a clear, stable situation.
Hywan
added a commit
that referenced
this pull request
Sep 12, 2025
…::timestamp`. After the merge of #5648, we want all events to get a `TimelineEvent::timestamp` value (extracted from `origin_server_ts`). To accomplish that, we are emptying the event cache. New synced events will be built correctly, with a valid `TimelineEvent::timestamp`, allowing a clear, stable situation.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The first patch adds the
timestampfield toTimelineEvent. It's a copy of theorigin_server_tsvalue, parsed as anOption<MilliSecondsSinceUnixEpoch>. It'sNoneif the parsing failed, or if theTimelineEventwas deserialised from a version before this new field was added.A new
extract_timestampfunction is added for this purpose. It protects against maliciousorigin_server_tswhere the value can be set to year 2100 for example. The only protection we are adding here is to take themin(origin_server_ts, now()), so that the event can never been “in the future”.It doesn't protect against a malicious value like 0. It's non-trivial to define a minimum timestamp for an event.
When a
TimelineEventis mapped from one kind to another kind, thetimestampis carried over. To achieve that, newto_decryptedandto_utdmethods are added.The second patch updates
LatestEventValue::timestampto use the newTimelineEvent::timestampmethod in case of aLatestEventValue::Remote. As such, it fixes the comment in #5617 (comment).latest_eventroom list sorter, and update therecencysorter #5617