fix: SEC36

Reviewed-By: Jacob Taylor <jacob@explodie.org>
Reviewed-By: Jade Ellis <jade@ellis.link>
Reviewed-By: Ginger <ginger@gingershaped.computer>

src/api/client/keys.rs

@@ -523,7 +523,22 @@ where
 	for (server, response) in futures {
 		match response {
 			| Ok(response) => {
-				for (user, master_key) in response.master_keys {
+				let is_wanted = |user_id: &UserId| {
+					user_id.server_name() == server && device_keys_input.contains_key(user_id)
+				};
+				let filtered_master_keys = response
+					.master_keys
+					.into_iter()
+					.filter(|(user_id, _)| is_wanted(user_id));
+				let filtered_self_signing_keys = response
+					.self_signing_keys
+					.into_iter()
+					.filter(|(user_id, _)| is_wanted(user_id));
+				let filtered_device_keys = response
+					.device_keys
+					.into_iter()
+					.filter(|(user_id, _)| is_wanted(user_id));
+				for (user, master_key) in filtered_master_keys {
 					let (master_key_id, mut master_key) = parse_master_key(&user, &master_key)?;
 
 					if let Ok(our_master_key) = services
@@ -549,8 +564,8 @@ where
 					}
 				}
 
-				self_signing_keys.extend(response.self_signing_keys);
-				device_keys.extend(response.device_keys);
+				self_signing_keys.extend(filtered_self_signing_keys);
+				device_keys.extend(filtered_device_keys);
 			},
 			| Err(e) => {
 				failures.insert(server.to_string(), json!({ "error": e.to_string() }));