fix: SEC45

Co-authored-by: Henry-Hiles <henry@henryhiles.com>

src/service/rooms/state_accessor/user_can.rs

@@ -33,6 +33,16 @@ impl super::Service {
 			return Err!(Request(Forbidden("Redacting m.room.create is not safe, forbidding.")));
 		}
 
+		// Defense in depth, shouldn't be reachable
+		if redacting_event
+			.as_ref()
+			.is_ok_and(|pdu| pdu.room_id() != Some(room_id))
+		{
+			return Err!(Request(Forbidden(
+				"Cannot redact an event that belongs to a different room."
+			)));
+		}
+
 		if redacting_event
 			.as_ref()
 			.is_ok_and(|pdu| *pdu.kind() == TimelineEventType::RoomServerAcl)

src/service/rooms/timeline/redact.rs

@@ -1,6 +1,6 @@
 use conduwuit::config::experiments::ToggledExperiment;
 use conduwuit_core::{
-	Result, err,
+	Err, Result, err,
 	matrix::event::Event,
 	utils::{self},
 	warn,
@@ -33,6 +33,12 @@ impl super::Service {
 				err!(Database(error!(?pdu_id, %event_id, ?e, "PDU ID points to invalid PDU.")))
 			})?;
 
+		if pdu.room_id() != reason.room_id() {
+			return Err!(Request(Forbidden(
+				"Cannot redact an event that belongs to a different room."
+			)));
+		}
+
 		let thread_root = match pdu.get_content::<ExtractRelatesTo>() {
 			| Ok(ExtractRelatesTo { relates_to: Relation::Thread(thread) }) =>
 				Some(thread.event_id),