Skip to content

Commit dc98bf7

Browse files
committed
test: Add a test for GHSA-275g-g844-73jh
1 parent ae57156 commit dc98bf7

File tree

1 file changed

+72
-2
lines changed

1 file changed

+72
-2
lines changed

crates/matrix-sdk-sqlite/src/event_cache_store.rs

Lines changed: 72 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2646,10 +2646,17 @@ mod encrypted_tests {
26462646
use std::sync::atomic::{AtomicU32, Ordering::SeqCst};
26472647

26482648
use matrix_sdk_base::{
2649-
event_cache::store::EventCacheStoreError, event_cache_store_integration_tests,
2650-
event_cache_store_integration_tests_time, event_cache_store_media_integration_tests,
2649+
event_cache::store::{EventCacheStore, EventCacheStoreError},
2650+
event_cache_store_integration_tests, event_cache_store_integration_tests_time,
2651+
event_cache_store_media_integration_tests,
26512652
};
2653+
use matrix_sdk_test::{async_test, event_factory::EventFactory};
26522654
use once_cell::sync::Lazy;
2655+
use ruma::{
2656+
event_id,
2657+
events::{relation::RelationType, room::message::RoomMessageEventContentWithoutRelation},
2658+
room_id, user_id,
2659+
};
26532660
use tempfile::{tempdir, TempDir};
26542661

26552662
use super::SqliteEventCacheStore;
@@ -2674,4 +2681,67 @@ mod encrypted_tests {
26742681
event_cache_store_integration_tests!();
26752682
event_cache_store_integration_tests_time!();
26762683
event_cache_store_media_integration_tests!();
2684+
2685+
#[async_test]
2686+
async fn test_no_sqlite_injection_in_find_event_relations() {
2687+
let room_id = room_id!("!test:localhost");
2688+
let another_room_id = room_id!("!r1:matrix.org");
2689+
let sender = user_id!("@alice:localhost");
2690+
2691+
let store = get_event_cache_store()
2692+
.await
2693+
.expect("We should be able to create a new, empty, event cache store");
2694+
2695+
let f = EventFactory::new().room(room_id).sender(sender);
2696+
2697+
// Create an event for the first room.
2698+
let event_id = event_id!("$DO_NOT_FIND_ME:matrix.org");
2699+
let event = f.text_msg("DO NOT FIND").event_id(event_id).into_event();
2700+
2701+
// Create a related event.
2702+
let edit_id = event_id!("$find_me:matrix.org");
2703+
let edit = f
2704+
.text_msg("Find me")
2705+
.event_id(edit_id)
2706+
.edit(event_id, RoomMessageEventContentWithoutRelation::text_plain("jebote"))
2707+
.into_event();
2708+
2709+
// Create an event for the second room.
2710+
let f = f.room(another_room_id);
2711+
2712+
let another_event_id = event_id!("$DO_NOT_FIND_ME_EITHER:matrix.org");
2713+
let another_event =
2714+
f.text_msg("DO NOT FIND ME EITHER").event_id(another_event_id).into_event();
2715+
2716+
// Save the events in the DB.
2717+
store.save_event(room_id, event).await.unwrap();
2718+
store.save_event(room_id, edit).await.unwrap();
2719+
store.save_event(another_room_id, another_event).await.unwrap();
2720+
2721+
// Craft a `RelationType` that will inject some SQL to be executed. The
2722+
// `OR 1=1` ensures that all the previous parameters, the room
2723+
// ID and event ID are ignored.
2724+
let filter = Some(vec![RelationType::Replacement, "x\") OR 1=1; --".into()]);
2725+
2726+
// Attempt to find events in the first room.
2727+
let results = store
2728+
.find_event_relations(room_id, event_id, filter.as_deref())
2729+
.await
2730+
.expect("We should be able to attempt to find event relations");
2731+
2732+
// Ensure that we only got the single related event the first room contains.
2733+
similar_asserts::assert_eq!(
2734+
results.len(),
2735+
1,
2736+
"We should only have loaded events for the first room {results:#?}"
2737+
);
2738+
2739+
// The event needs to be the edit event, otherwise something is wrong.
2740+
let (found_event, _) = &results[0];
2741+
assert_eq!(
2742+
found_event.event_id().as_deref(),
2743+
Some(edit_id),
2744+
"The single event we found should be the edit event"
2745+
);
2746+
}
26772747
}

0 commit comments

Comments
 (0)