From a5043a38e1b42fcd325c665c3cf1127dee3b52e7 Mon Sep 17 00:00:00 2001 From: strawberry Date: Sun, 26 May 2024 16:26:09 -0400 Subject: [PATCH] only allow membership event types at /send_join Signed-off-by: strawberry --- src/api/server_server.rs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/api/server_server.rs b/src/api/server_server.rs index d9a1072b..ec4bb955 100644 --- a/src/api/server_server.rs +++ b/src/api/server_server.rs @@ -1126,6 +1126,22 @@ async fn create_join_event( )); }; + let event_type: StateEventType = serde_json::from_value( + value + .get("type") + .ok_or_else(|| Error::BadRequest(ErrorKind::InvalidParam, "Join event does not have state event type"))? + .clone() + .into(), + ) + .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "PDU has invalid event type"))?; + + if event_type != StateEventType::RoomMember { + return Err(Error::BadRequest( + ErrorKind::InvalidParam, + "Not allowed to send non-membership state event at join endpoint", + )); + } + // ACL check sender server name let sender: OwnedUserId = serde_json::from_value( value