From 17ddd3966d8e3c5749119b63803c9e52248e8341 Mon Sep 17 00:00:00 2001 From: timedout Date: Fri, 16 Oct 2026 18:19:22 +0100 Subject: [PATCH] fix: Apply proper limits to get_missing_events --- src/api/server/get_missing_events.rs | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/src/api/server/get_missing_events.rs b/src/api/server/get_missing_events.rs index a1c9b0496..335e8fc09 100644 --- a/src/api/server/get_missing_events.rs +++ b/src/api/server/get_missing_events.rs @@ -1,7 +1,7 @@ use std::collections::{HashSet, VecDeque}; use axum::extract::State; -use conduwuit::{debug, debug_warn, info, trace, utils::to_canonical_object, Err, Event, Result}; +use conduwuit::{Err, Event, Result, debug, debug_warn, info, trace, utils::to_canonical_object}; use ruma::{OwnedEventId, api::federation::event::get_missing_events}; use serde_json::value::RawValue; use service::rooms::event_handler::GET_MISSING_EVENTS_MAX_BATCH_SIZE; @@ -44,6 +44,13 @@ pub(crate) async fn get_missing_events_route( .unwrap_or(10) .min(GET_MISSING_EVENTS_MAX_BATCH_SIZE); + if body.latest_events.len() > limit { + return Err!(Request(InvalidParam("Too many latest_events"))); + } + if body.earliest_events.len() > limit { + return Err!(Request(InvalidParam("Too many earliest_events"))); + } + let room_version = services.rooms.state.get_room_version(&body.room_id).await?; let mut queue: VecDeque = VecDeque::from(body.latest_events.clone()); @@ -64,7 +71,9 @@ pub(crate) async fn get_missing_events_route( let mut pdu = match services.rooms.timeline.get_pdu(&next_event_id).await { | Ok(pdu) => pdu, | Err(e) => { - debug_warn!("could not find event {next_event_id} while walking missing events: {e}"); + debug_warn!( + "could not find event {next_event_id} while walking missing events: {e}" + ); continue; }, }; @@ -74,6 +83,10 @@ pub(crate) async fn get_missing_events_route( body.room_id ))); } + if pdu.depth < body.min_depth { + debug!(%next_event_id, %pdu.depth, %body.min_depth, "event is below minimum depth, not traversing"); + continue; + } if services .rooms .pdu_metadata