From ec57159b860eca63cdb2a8e5b6c10b1b8ba217dc Mon Sep 17 00:00:00 2001 From: timedout Date: Sat, 20 Jun 2026 15:58:56 +0100 Subject: [PATCH] fix: SEC16 --- CHANGELOG.md | 4 ++-- src/api/router/auth.rs | 3 +++ src/service/users/mod.rs | 1 + 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c087bf8b3..534718d4e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,9 +4,9 @@ - Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a singular transaction. Contributed by @nex. (#1711) -- Fixed a bug that caused the server to panic while handling transactions with malformed events, resulting in a +- Fixed a bug that caused the server to panic while handling transactions with malformed events, resulting in a deadlock that prevented the remote server from federating with us until the server was restarted. Contributed by @nex. -- Fixed a bug that resulted in the `m.federate` field of `m.room.create` being ignored in v12 rooms, allowing remote +- Fixed a bug that resulted in the `m.federate` field of `m.room.create` being ignored in v12 rooms, allowing remote servers to participate in local-only rooms. Contributed by @nex, reported by [@mat:emzee.ee](matrix:u/mat:emzee.ee?action=chat). # Continuwuity 0.5.8 (2026-04-24) diff --git a/src/api/router/auth.rs b/src/api/router/auth.rs index 8f48166df..26e2ad426 100644 --- a/src/api/router/auth.rs +++ b/src/api/router/auth.rs @@ -379,6 +379,9 @@ async fn find_token(services: &Services, token: Option<&str>) -> Result { let Some(token) = token else { return Ok(Token::None); }; + if token.is_empty() { + return Ok(Token::Invalid); + } let user_token = services.users.find_from_token(token).map_ok(Token::User); diff --git a/src/service/users/mod.rs b/src/service/users/mod.rs index 160964761..bc3c20a27 100644 --- a/src/service/users/mod.rs +++ b/src/service/users/mod.rs @@ -339,6 +339,7 @@ impl Service { /// Find out which user an access token belongs to. pub async fn find_from_token(&self, token: &str) -> Result<(OwnedUserId, OwnedDeviceId)> { + assert!(!token.is_empty(), "Empty access token"); self.db.token_userdeviceid.get(token).await.deserialized() }