From 4af97d93769a6a135b2dedca9e7b6e1daf8b55a6 Mon Sep 17 00:00:00 2001
From: Till Faelligen <2353100+S7evinK@users.noreply.github.com>
Date: Thu, 10 Nov 2022 11:41:51 +0100
Subject: [PATCH] Deny guest access

---
 clientapi/routing/joinroom.go               | 10 +++++++++-
 roomserver/api/perform.go                   |  1 +
 roomserver/internal/perform/perform_join.go | 18 ++++++++++++++++++
 sytest-blacklist                            |  5 ++++-
 sytest-whitelist                            |  3 ++-
 5 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/clientapi/routing/joinroom.go b/clientapi/routing/joinroom.go
index c50e552bd..e371d9214 100644
--- a/clientapi/routing/joinroom.go
+++ b/clientapi/routing/joinroom.go
@@ -37,6 +37,7 @@ func JoinRoomByIDOrAlias(
 	joinReq := roomserverAPI.PerformJoinRequest{
 		RoomIDOrAlias: roomIDOrAlias,
 		UserID:        device.UserID,
+		IsGuest:       device.AccountType == api.AccountTypeGuest,
 		Content:       map[string]interface{}{},
 	}
 	joinRes := roomserverAPI.PerformJoinResponse{}
@@ -84,7 +85,14 @@ func JoinRoomByIDOrAlias(
 		if err := rsAPI.PerformJoin(req.Context(), &joinReq, &joinRes); err != nil {
 			done <- jsonerror.InternalAPIError(req.Context(), err)
 		} else if joinRes.Error != nil {
-			done <- joinRes.Error.JSONResponse()
+			if joinRes.Error.Code == roomserverAPI.PerformErrorNotAllowed && device.AccountType == api.AccountTypeGuest {
+				done <- util.JSONResponse{
+					Code: http.StatusForbidden,
+					JSON: jsonerror.GuestAccessForbidden(joinRes.Error.Msg),
+				}
+			} else {
+				done <- joinRes.Error.JSONResponse()
+			}
 		} else {
 			done <- util.JSONResponse{
 				Code: http.StatusOK,
diff --git a/roomserver/api/perform.go b/roomserver/api/perform.go
index 2536a4bb5..bec08da47 100644
--- a/roomserver/api/perform.go
+++ b/roomserver/api/perform.go
@@ -78,6 +78,7 @@ const (
 type PerformJoinRequest struct {
 	RoomIDOrAlias string                         `json:"room_id_or_alias"`
 	UserID        string                         `json:"user_id"`
+	IsGuest       bool                           `json:"is_guest"`
 	Content       map[string]interface{}         `json:"content"`
 	ServerNames   []gomatrixserverlib.ServerName `json:"server_names"`
 	Unsigned      map[string]interface{}         `json:"unsigned"`
diff --git a/roomserver/internal/perform/perform_join.go b/roomserver/internal/perform/perform_join.go
index 9d596ab30..0f5cfcfd2 100644
--- a/roomserver/internal/perform/perform_join.go
+++ b/roomserver/internal/perform/perform_join.go
@@ -271,6 +271,24 @@ func (r *Joiner) performJoinRoomByID(
 		}
 	}
 
+	// If a guest is trying to join a room, check that the room has a m.room.guest_access event
+	if req.IsGuest {
+		guestAccess := "forbidden"
+		guestAccessEvent, err := r.DB.GetStateEvent(ctx, req.RoomIDOrAlias, gomatrixserverlib.MRoomGuestAccess, "")
+		if err == nil && guestAccessEvent != nil {
+			guestAccess = gjson.GetBytes(guestAccessEvent.Content(), "guest_access").String()
+		}
+
+		// Servers MUST only allow guest users to join rooms if the m.room.guest_access state event
+		// is present on the room and has the guest_access value can_join.
+		if guestAccess != "can_join" {
+			return "", "", &rsAPI.PerformError{
+				Code: rsAPI.PerformErrorNotAllowed,
+				Msg:  fmt.Sprintf("Guest access is forbidden"),
+			}
+		}
+	}
+
 	// If we should do a forced federated join then do that.
 	var joinedVia gomatrixserverlib.ServerName
 	if forceFederatedJoin {
diff --git a/sytest-blacklist b/sytest-blacklist
index c35b03bd7..99cfbabc8 100644
--- a/sytest-blacklist
+++ b/sytest-blacklist
@@ -48,4 +48,7 @@ If a device list update goes missing, the server resyncs on the next one
 Leaves are present in non-gapped incremental syncs
 
 # Below test was passing for the wrong reason, failing correctly since #2858
-New federated private chats get full presence information (SYN-115)
\ No newline at end of file
+New federated private chats get full presence information (SYN-115)
+
+# We don't have any state to calculate m.room.guest_access when accepting invites
+Guest users can accept invites to private rooms over federation
\ No newline at end of file
diff --git a/sytest-whitelist b/sytest-whitelist
index bb4f0a279..37888182a 100644
--- a/sytest-whitelist
+++ b/sytest-whitelist
@@ -761,4 +761,5 @@ AS can publish rooms in their own list
 AS and main public room lists are separate
 /upgrade preserves direct room state
 local user has tags copied to the new room
-remote user has tags copied to the new room
\ No newline at end of file
+remote user has tags copied to the new room
+Guest users denied access over federation if guest access prohibited
\ No newline at end of file