@@ -2646,10 +2646,17 @@ mod encrypted_tests {
2646
2646
use std:: sync:: atomic:: { AtomicU32 , Ordering :: SeqCst } ;
2647
2647
2648
2648
use matrix_sdk_base:: {
2649
- event_cache:: store:: EventCacheStoreError , event_cache_store_integration_tests,
2650
- event_cache_store_integration_tests_time, event_cache_store_media_integration_tests,
2649
+ event_cache:: store:: { EventCacheStore , EventCacheStoreError } ,
2650
+ event_cache_store_integration_tests, event_cache_store_integration_tests_time,
2651
+ event_cache_store_media_integration_tests,
2651
2652
} ;
2653
+ use matrix_sdk_test:: { async_test, event_factory:: EventFactory } ;
2652
2654
use once_cell:: sync:: Lazy ;
2655
+ use ruma:: {
2656
+ event_id,
2657
+ events:: { relation:: RelationType , room:: message:: RoomMessageEventContentWithoutRelation } ,
2658
+ room_id, user_id,
2659
+ } ;
2653
2660
use tempfile:: { tempdir, TempDir } ;
2654
2661
2655
2662
use super :: SqliteEventCacheStore ;
@@ -2674,4 +2681,67 @@ mod encrypted_tests {
2674
2681
event_cache_store_integration_tests ! ( ) ;
2675
2682
event_cache_store_integration_tests_time ! ( ) ;
2676
2683
event_cache_store_media_integration_tests ! ( ) ;
2684
+
2685
+ #[ async_test]
2686
+ async fn test_no_sqlite_injection_in_find_event_relations ( ) {
2687
+ let room_id = room_id ! ( "!test:localhost" ) ;
2688
+ let another_room_id = room_id ! ( "!r1:matrix.org" ) ;
2689
+ let sender = user_id ! ( "@alice:localhost" ) ;
2690
+
2691
+ let store = get_event_cache_store ( )
2692
+ . await
2693
+ . expect ( "We should be able to create a new, empty, event cache store" ) ;
2694
+
2695
+ let f = EventFactory :: new ( ) . room ( room_id) . sender ( sender) ;
2696
+
2697
+ // Create an event for the first room.
2698
+ let event_id = event_id ! ( "$DO_NOT_FIND_ME:matrix.org" ) ;
2699
+ let event = f. text_msg ( "DO NOT FIND" ) . event_id ( event_id) . into_event ( ) ;
2700
+
2701
+ // Create a related event.
2702
+ let edit_id = event_id ! ( "$find_me:matrix.org" ) ;
2703
+ let edit = f
2704
+ . text_msg ( "Find me" )
2705
+ . event_id ( edit_id)
2706
+ . edit ( event_id, RoomMessageEventContentWithoutRelation :: text_plain ( "jebote" ) )
2707
+ . into_event ( ) ;
2708
+
2709
+ // Create an event for the second room.
2710
+ let f = f. room ( another_room_id) ;
2711
+
2712
+ let another_event_id = event_id ! ( "$DO_NOT_FIND_ME_EITHER:matrix.org" ) ;
2713
+ let another_event =
2714
+ f. text_msg ( "DO NOT FIND ME EITHER" ) . event_id ( another_event_id) . into_event ( ) ;
2715
+
2716
+ // Save the events in the DB.
2717
+ store. save_event ( room_id, event) . await . unwrap ( ) ;
2718
+ store. save_event ( room_id, edit) . await . unwrap ( ) ;
2719
+ store. save_event ( another_room_id, another_event) . await . unwrap ( ) ;
2720
+
2721
+ // Craft a `RelationType` that will inject some SQL to be executed. The
2722
+ // `OR 1=1` ensures that all the previous parameters, the room
2723
+ // ID and event ID are ignored.
2724
+ let filter = Some ( vec ! [ RelationType :: Replacement , "x\" ) OR 1=1; --" . into( ) ] ) ;
2725
+
2726
+ // Attempt to find events in the first room.
2727
+ let results = store
2728
+ . find_event_relations ( room_id, event_id, filter. as_deref ( ) )
2729
+ . await
2730
+ . expect ( "We should be able to attempt to find event relations" ) ;
2731
+
2732
+ // Ensure that we only got the single related event the first room contains.
2733
+ similar_asserts:: assert_eq!(
2734
+ results. len( ) ,
2735
+ 1 ,
2736
+ "We should only have loaded events for the first room {results:#?}"
2737
+ ) ;
2738
+
2739
+ // The event needs to be the edit event, otherwise something is wrong.
2740
+ let ( found_event, _) = & results[ 0 ] ;
2741
+ assert_eq ! (
2742
+ found_event. event_id( ) . as_deref( ) ,
2743
+ Some ( edit_id) ,
2744
+ "The single event we found should be the edit event"
2745
+ ) ;
2746
+ }
2677
2747
}
0 commit comments