From 5aaa539e3eb8ef1f1f601468c786f2d7f891394f Mon Sep 17 00:00:00 2001 From: Devon Hudson Date: Wed, 14 Jun 2023 16:42:09 +0100 Subject: [PATCH 1/4] Fix senderID/key conversions --- roomserver/internal/perform/perform_create_room.go | 3 ++- roomserver/storage/postgres/user_room_keys_table.go | 2 +- roomserver/storage/sqlite3/user_room_keys_table.go | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/roomserver/internal/perform/perform_create_room.go b/roomserver/internal/perform/perform_create_room.go index fd8055e09..dcaf8dca6 100644 --- a/roomserver/internal/perform/perform_create_room.go +++ b/roomserver/internal/perform/perform_create_room.go @@ -16,6 +16,7 @@ package perform import ( "context" + "crypto/ed25519" "encoding/json" "fmt" "net/http" @@ -74,7 +75,7 @@ func (c *Creator) PerformCreateRoom(ctx context.Context, userID spec.UserID, roo JSON: spec.InternalServerError{}, } } - senderID = spec.SenderID(spec.Base64Bytes(key).Encode()) + senderID = spec.SenderID(spec.Base64Bytes(key.Public().(ed25519.PublicKey)).Encode()) } else { senderID = spec.SenderID(userID.String()) } diff --git a/roomserver/storage/postgres/user_room_keys_table.go b/roomserver/storage/postgres/user_room_keys_table.go index dbb4af34a..dd4d9ab13 100644 --- a/roomserver/storage/postgres/user_room_keys_table.go +++ b/roomserver/storage/postgres/user_room_keys_table.go @@ -145,7 +145,7 @@ func (s *userRoomKeysStatements) BulkSelectUserNIDs(ctx context.Context, txn *sq if err = rows.Scan(&userRoomKeyPair.EventStateKeyNID, &userRoomKeyPair.RoomNID, &publicKey); err != nil { return nil, err } - result[string(publicKey)] = userRoomKeyPair + result[spec.Base64Bytes(publicKey).Encode()] = userRoomKeyPair } return result, rows.Err() } diff --git a/roomserver/storage/sqlite3/user_room_keys_table.go b/roomserver/storage/sqlite3/user_room_keys_table.go index 84c8b54ec..d58b8ac3f 100644 --- a/roomserver/storage/sqlite3/user_room_keys_table.go +++ b/roomserver/storage/sqlite3/user_room_keys_table.go @@ -25,6 +25,7 @@ import ( "github.com/matrix-org/dendrite/internal/sqlutil" "github.com/matrix-org/dendrite/roomserver/storage/tables" "github.com/matrix-org/dendrite/roomserver/types" + "github.com/matrix-org/gomatrixserverlib/spec" ) const userRoomKeysSchema = ` @@ -159,7 +160,7 @@ func (s *userRoomKeysStatements) BulkSelectUserNIDs(ctx context.Context, txn *sq if err = rows.Scan(&userRoomKeyPair.EventStateKeyNID, &userRoomKeyPair.RoomNID, &publicKey); err != nil { return nil, err } - result[string(publicKey)] = userRoomKeyPair + result[spec.Base64Bytes(publicKey).Encode()] = userRoomKeyPair } return result, rows.Err() } From 3f4df25b31a403e936488a1920d1aed3de471a71 Mon Sep 17 00:00:00 2001 From: Devon Hudson Date: Wed, 14 Jun 2023 17:04:19 +0100 Subject: [PATCH 2/4] Add missing dep --- roomserver/storage/postgres/user_room_keys_table.go | 1 + 1 file changed, 1 insertion(+) diff --git a/roomserver/storage/postgres/user_room_keys_table.go b/roomserver/storage/postgres/user_room_keys_table.go index dd4d9ab13..202b0abc1 100644 --- a/roomserver/storage/postgres/user_room_keys_table.go +++ b/roomserver/storage/postgres/user_room_keys_table.go @@ -25,6 +25,7 @@ import ( "github.com/matrix-org/dendrite/internal/sqlutil" "github.com/matrix-org/dendrite/roomserver/storage/tables" "github.com/matrix-org/dendrite/roomserver/types" + "github.com/matrix-org/gomatrixserverlib/spec" ) const userRoomKeysSchema = ` From 8cf6c381e21d0710f0290c97dfa5616036749a81 Mon Sep 17 00:00:00 2001 From: Devon Hudson Date: Wed, 14 Jun 2023 17:11:27 +0100 Subject: [PATCH 3/4] Fix senderID/key conversion unit tests --- roomserver/storage/shared/storage_test.go | 2 +- roomserver/storage/tables/user_room_keys_table_test.go | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/roomserver/storage/shared/storage_test.go b/roomserver/storage/shared/storage_test.go index c7b915c7d..612e4ef06 100644 --- a/roomserver/storage/shared/storage_test.go +++ b/roomserver/storage/shared/storage_test.go @@ -183,7 +183,7 @@ func TestUserRoomKeys(t *testing.T) { assert.NoError(t, err) wantKeys := map[spec.RoomID]map[string]string{ *roomID: { - string(key.Public().(ed25519.PublicKey)): userID.String(), + spec.Base64Bytes(key.Public().(ed25519.PublicKey)).Encode(): userID.String(), }, } assert.Equal(t, wantKeys, userIDs) diff --git a/roomserver/storage/tables/user_room_keys_table_test.go b/roomserver/storage/tables/user_room_keys_table_test.go index 8802a3c6e..2809771b4 100644 --- a/roomserver/storage/tables/user_room_keys_table_test.go +++ b/roomserver/storage/tables/user_room_keys_table_test.go @@ -13,6 +13,7 @@ import ( "github.com/matrix-org/dendrite/roomserver/types" "github.com/matrix-org/dendrite/setup/config" "github.com/matrix-org/dendrite/test" + "github.com/matrix-org/gomatrixserverlib/spec" "github.com/stretchr/testify/assert" ed255192 "golang.org/x/crypto/ed25519" ) @@ -101,8 +102,8 @@ func TestUserRoomKeysTable(t *testing.T) { assert.NotNil(t, gotKeys) wantKeys := map[string]types.UserRoomKeyPair{ - string(key2.Public().(ed25519.PublicKey)): {RoomNID: roomNID, EventStateKeyNID: userNID}, - string(key3.Public().(ed25519.PublicKey)): {RoomNID: roomNID, EventStateKeyNID: userNID2}, + string(spec.Base64Bytes(key2.Public().(ed25519.PublicKey)).Encode()): {RoomNID: roomNID, EventStateKeyNID: userNID}, + string(spec.Base64Bytes(key3.Public().(ed25519.PublicKey)).Encode()): {RoomNID: roomNID, EventStateKeyNID: userNID2}, } assert.Equal(t, wantKeys, gotKeys) From 420e7ec81fedf9ff531c75ece4c80a9b63046ba9 Mon Sep 17 00:00:00 2001 From: Josh Qou <97894002+joshqou@users.noreply.github.com> Date: Thu, 15 Jun 2023 12:28:34 +0100 Subject: [PATCH 4/4] Fix unsafe hotserving behaviour for multimedia uploads. (#3113) Return multimedia with a disposition type of attachment instead of inline. NVT#1548992 Signed-off-by: Josh Qou [jqou@icloud.com](mailto:jqou@icloud.com) Co-authored-by: Jon --- mediaapi/routing/download.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mediaapi/routing/download.go b/mediaapi/routing/download.go index e9f161a3c..8fb1b6534 100644 --- a/mediaapi/routing/download.go +++ b/mediaapi/routing/download.go @@ -341,6 +341,7 @@ func (r *downloadRequest) addDownloadFilenameToHeaders( } if len(filename) == 0 { + w.Header().Set("Content-Disposition", "attachment") return nil } @@ -376,13 +377,13 @@ func (r *downloadRequest) addDownloadFilenameToHeaders( // that would otherwise be parsed as a control character in the // Content-Disposition header w.Header().Set("Content-Disposition", fmt.Sprintf( - `inline; filename=%s%s%s`, + `attachment; filename=%s%s%s`, quote, unescaped, quote, )) } else { // For UTF-8 filenames, we quote always, as that's the standard w.Header().Set("Content-Disposition", fmt.Sprintf( - `inline; filename*=utf-8''%s`, + `attachment; filename*=utf-8''%s`, url.QueryEscape(unescaped), )) }