mirrors/dendrite
1
0
Fork 0
mirror of https://github.com/matrix-org/dendrite.git synced 2026-01-20 20:43:09 -06:00
Code Issues Packages Projects Releases Wiki Activity

Add validation to relay_txn prev entry id

Browse source
This commit is contained in:
Devon Hudson 2023-01-17 17:22:05 -07:00
parent 41cd9d256e
commit cbad03fc5e
No known key found for this signature in database
GPG key ID: CD06B18E77F6A628
2 changed files with 41 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
relayapi/routing/relaytxn.go
View file

@ -18,6 +18,7 @@ import (
"encoding/json" "encoding/json"
"net/http" "net/http"
"github.com/matrix-org/dendrite/clientapi/jsonerror"
"github.com/matrix-org/dendrite/relayapi/api" "github.com/matrix-org/dendrite/relayapi/api"
"github.com/matrix-org/gomatrixserverlib" "github.com/matrix-org/gomatrixserverlib"
"github.com/matrix-org/util" "github.com/matrix-org/util"
@ -41,9 +42,19 @@ func GetTransactionFromRelay(
logrus.Infof("Handling relay_txn for %s", userID.Raw()) logrus.Infof("Handling relay_txn for %s", userID.Raw())
previousEntry := gomatrixserverlib.RelayEntry{} previousEntry := gomatrixserverlib.RelayEntry{}
if err := json.Unmarshal(fedReq.Content(), &previousEntry); err == nil { if err := json.Unmarshal(fedReq.Content(), &previousEntry); err != nil {
logrus.Infof("Previous entry provided: %v", previousEntry.EntryID) return util.JSONResponse{
Code: http.StatusInternalServerError,
JSON: jsonerror.BadJSON("invalid json provided"),
}
} }
if previousEntry.EntryID < 0 {
return util.JSONResponse{
Code: http.StatusInternalServerError,
JSON: jsonerror.BadJSON("Invalid entry id provided. Must be >= 0."),
}
}
logrus.Infof("Previous entry provided: %v", previousEntry.EntryID)
response, err := relayAPI.QueryTransactions(httpReq.Context(), userID, previousEntry) response, err := relayAPI.QueryTransactions(httpReq.Context(), userID, previousEntry)
if err != nil { if err != nil {

31
relayapi/routing/relaytxn_test.go
View file

@ -60,7 +60,7 @@ func TestGetEmptyDatabaseReturnsNothing(t *testing.T) {
&db, nil, nil, nil, nil, false, "", &db, nil, nil, nil, nil, false, "",
) )
request := createQuery(*userID, gomatrixserverlib.RelayEntry{EntryID: -1}) request := createQuery(*userID, gomatrixserverlib.RelayEntry{})
response := routing.GetTransactionFromRelay(httpReq, &request, relayAPI, *userID) response := routing.GetTransactionFromRelay(httpReq, &request, relayAPI, *userID)
assert.Equal(t, http.StatusOK, response.Code) assert.Equal(t, http.StatusOK, response.Code)
@ -73,6 +73,31 @@ func TestGetEmptyDatabaseReturnsNothing(t *testing.T) {
assert.Zero(t, count) assert.Zero(t, count)
} }
func TestGetInvalidPrevEntryFails(t *testing.T) {
testDB := test.NewInMemoryRelayDatabase()
db := shared.Database{
Writer: sqlutil.NewDummyWriter(),
RelayQueue: testDB,
RelayQueueJSON: testDB,
}
httpReq := &http.Request{}
userID, err := gomatrixserverlib.NewUserID("@local:domain", false)
assert.NoError(t, err, "Invalid userID")
transaction := createTransaction()
_, err = db.StoreTransaction(context.Background(), transaction)
assert.NoError(t, err, "Failed to store transaction")
relayAPI := internal.NewRelayInternalAPI(
&db, nil, nil, nil, nil, false, "",
)
request := createQuery(*userID, gomatrixserverlib.RelayEntry{EntryID: -1})
response := routing.GetTransactionFromRelay(httpReq, &request, relayAPI, *userID)
assert.Equal(t, http.StatusInternalServerError, response.Code)
}
func TestGetReturnsSavedTransaction(t *testing.T) { func TestGetReturnsSavedTransaction(t *testing.T) {
testDB := test.NewInMemoryRelayDatabase() testDB := test.NewInMemoryRelayDatabase()
db := shared.Database{ db := shared.Database{
@ -101,7 +126,7 @@ func TestGetReturnsSavedTransaction(t *testing.T) {
&db, nil, nil, nil, nil, false, "", &db, nil, nil, nil, nil, false, "",
) )
request := createQuery(*userID, gomatrixserverlib.RelayEntry{EntryID: -1}) request := createQuery(*userID, gomatrixserverlib.RelayEntry{})
response := routing.GetTransactionFromRelay(httpReq, &request, relayAPI, *userID) response := routing.GetTransactionFromRelay(httpReq, &request, relayAPI, *userID)
assert.Equal(t, http.StatusOK, response.Code) assert.Equal(t, http.StatusOK, response.Code)
@ -164,7 +189,7 @@ func TestGetReturnsMultipleSavedTransactions(t *testing.T) {
&db, nil, nil, nil, nil, false, "", &db, nil, nil, nil, nil, false, "",
) )
request := createQuery(*userID, gomatrixserverlib.RelayEntry{EntryID: -1}) request := createQuery(*userID, gomatrixserverlib.RelayEntry{})
response := routing.GetTransactionFromRelay(httpReq, &request, relayAPI, *userID) response := routing.GetTransactionFromRelay(httpReq, &request, relayAPI, *userID)
assert.Equal(t, http.StatusOK, response.Code) assert.Equal(t, http.StatusOK, response.Code)