From 7b3e3a26bb1a77d33697c4b80d41bb1d26fdafd6 Mon Sep 17 00:00:00 2001 From: timedout Date: Tue, 18 Aug 2026 17:50:18 +0100 Subject: [PATCH] fix: Don't panic when receiving PDUs with illegal auth events Apparently some servers do this?? --- .../rooms/event_handler/handle_outlier_pdu.rs | 13 +++++++------ src/web/pages/account/register.rs | 2 +- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/src/service/rooms/event_handler/handle_outlier_pdu.rs b/src/service/rooms/event_handler/handle_outlier_pdu.rs index 843dea038..379341fab 100644 --- a/src/service/rooms/event_handler/handle_outlier_pdu.rs +++ b/src/service/rooms/event_handler/handle_outlier_pdu.rs @@ -170,12 +170,13 @@ pub async fn handle_outlier_pdu<'a, Pdu>( .expect("we just checked that we have all auth events") .to_owned(); - let key = auth_event.kind().with_state_key( - auth_event - .state_key - .clone() - .expect("all auth events must have state keys"), - ); + let Some(state_key) = auth_event.state_key() else { + self.reject_and_persist(event_id, &incoming_pdu); + return Err!(Request(Forbidden(debug_warn!( + "Event references non-state event as an auth event: {id}", + )))); + }; + let key = auth_event.kind().with_state_key(state_key); match auth_events_by_key.entry(key) { | hash_map::Entry::Vacant(v) => { v.insert(auth_event); diff --git a/src/web/pages/account/register.rs b/src/web/pages/account/register.rs index 9572fc263..4f5f4f11a 100644 --- a/src/web/pages/account/register.rs +++ b/src/web/pages/account/register.rs @@ -7,7 +7,7 @@ routing::{get, on}, }; use conduwuit_api::client_ip::ClientIp; -use conduwuit_core::{config::TermsDocument, info, warn}; +use conduwuit_core::{config::TermsDocument, warn}; use conduwuit_service::{ mailer::messages, registration_tokens::ValidToken,