Skip to content
Snippets Groups Projects
  • Patrick Cloke's avatar
    e746f80b
    Do not accept pattern_type from user input in push rules. (#15088) · e746f80b
    Patrick Cloke authored
    Internally the push rules module uses a `pattern_type` property for `event_match`
    conditions (and `related_event_match`) to mark the condition as matching the
    current user's Matrix ID or localpart.
    
    This is leaky to the Client-Server API where a user can successfully set a condition
    which provides `pattern_type` instead of `pattern` (note that there's no benefit to
    doing this -- the user can just use their own Matrix ID or localpart instead). When
    serializing back to the client the `pattern_type` property is converted into a proper
    `pattern`.
    
    The following changes are made to avoid this:
    
    * Separate the `KnownCondition::EventMatch` enum value into `EventMatch`
      and `EventMatchType`, each with their own expected properties. (Note that a
      similar change is made for `RelatedEventMatch`.)
    * Make it such that the `pattern_type` variants serialize to the same condition kind,
      but cannot be deserialized (since they're only provided by base rules).
    * As a final tweak, convert `user_id` vs. `user_localpart` values into an enum.
    e746f80b
    History
    Do not accept pattern_type from user input in push rules. (#15088)
    Patrick Cloke authored
    Internally the push rules module uses a `pattern_type` property for `event_match`
    conditions (and `related_event_match`) to mark the condition as matching the
    current user's Matrix ID or localpart.
    
    This is leaky to the Client-Server API where a user can successfully set a condition
    which provides `pattern_type` instead of `pattern` (note that there's no benefit to
    doing this -- the user can just use their own Matrix ID or localpart instead). When
    serializing back to the client the `pattern_type` property is converted into a proper
    `pattern`.
    
    The following changes are made to avoid this:
    
    * Separate the `KnownCondition::EventMatch` enum value into `EventMatch`
      and `EventMatchType`, each with their own expected properties. (Note that a
      similar change is made for `RelatedEventMatch`.)
    * Make it such that the `pattern_type` variants serialize to the same condition kind,
      but cannot be deserialized (since they're only provided by base rules).
    * As a final tweak, convert `user_id` vs. `user_localpart` values into an enum.