From c5cd82a6a3c004b9651dc3e86eef30e172053119 Mon Sep 17 00:00:00 2001 From: Jade Ellis Date: Sat, 14 Nov 2026 20:12:45 +0000 Subject: [PATCH] fix: SEC45 Co-authored-by: Henry-Hiles --- src/service/rooms/state_accessor/user_can.rs | 10 ++++++++++ src/service/rooms/timeline/redact.rs | 8 +++++++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/src/service/rooms/state_accessor/user_can.rs b/src/service/rooms/state_accessor/user_can.rs index 7e7340bc6..2a6d52515 100644 --- a/src/service/rooms/state_accessor/user_can.rs +++ b/src/service/rooms/state_accessor/user_can.rs @@ -33,6 +33,16 @@ impl super::Service { return Err!(Request(Forbidden("Redacting m.room.create is not safe, forbidding."))); } + // Defense in depth, shouldn't be reachable + if redacting_event + .as_ref() + .is_ok_and(|pdu| pdu.room_id() != Some(room_id)) + { + return Err!(Request(Forbidden( + "Cannot redact an event that belongs to a different room." + ))); + } + if redacting_event .as_ref() .is_ok_and(|pdu| *pdu.kind() == TimelineEventType::RoomServerAcl) diff --git a/src/service/rooms/timeline/redact.rs b/src/service/rooms/timeline/redact.rs index af69fcb36..905cd40c7 100644 --- a/src/service/rooms/timeline/redact.rs +++ b/src/service/rooms/timeline/redact.rs @@ -1,6 +1,6 @@ use conduwuit::config::experiments::ToggledExperiment; use conduwuit_core::{ - Result, err, + Err, Result, err, matrix::event::Event, utils::{self}, warn, @@ -33,6 +33,12 @@ impl super::Service { err!(Database(error!(?pdu_id, %event_id, ?e, "PDU ID points to invalid PDU."))) })?; + if pdu.room_id() != reason.room_id() { + return Err!(Request(Forbidden( + "Cannot redact an event that belongs to a different room." + ))); + } + let thread_root = match pdu.get_content::() { | Ok(ExtractRelatesTo { relates_to: Relation::Thread(thread) }) => Some(thread.event_id),