chore: Bump version to 26.7.2

My IDE has beef with pre-commit for some reason

.forgejo/actions/create-docker-manifest/action.yml

@@ -44,7 +44,7 @@ runs:
 
     - name: Login to builtin registry
       if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+      uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
       with:
         registry: ${{ env.BUILTIN_REGISTRY }}
         username: ${{ inputs.registry_user }}

.forgejo/actions/prepare-docker-build/action.yml

@@ -79,7 +79,7 @@ runs:
 
     - name: Login to builtin registry
       if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+      uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
       with:
         registry: ${{ env.BUILTIN_REGISTRY }}
         username: ${{ inputs.registry_user }}

.forgejo/actions/timelord/action.yml

@@ -71,7 +71,7 @@ runs:
 
     - name: Install timelord-cli and git-warp-time
       if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9 # v2
+      uses: https://github.com/taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2
       with:
         tool: git-warp-time,timelord-cli@3.0.1
 

.forgejo/workflows/build-debian.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       matrix:
         container: [ "ubuntu-latest", "ubuntu-previous", "debian-latest", "debian-oldstable" ]
-        arch: ["amd64", "arm64"]
+        arch: [ "amd64", "arm64" ]
     container:
       image: "ghcr.io/tcpipuk/act-runner:${{ matrix.container }}"
 
@@ -165,6 +165,12 @@ jobs:
           apt-get update -y
           # Build dependencies for rocksdb
           apt-get install -y liburing-dev clang
+          # For arm64 builds, install cross-compiled dependencies.
+          # libstdc++6:arm64 is needed by dpkg-shlibdeps to resolve the
+          # dynamically-linked libstdc++ when cargo-deb computes $auto depends.
+          if [ "${{ matrix.arch }}" = "arm64" ]; then
+            apt-get install -y liburing-dev:arm64 libstdc++6:arm64
+          fi
 
       - name: Run cargo-deb
         id: cargo-deb

Cargo.lock

@@ -816,7 +816,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "aws-lc-rs",
  "clap",
@@ -854,7 +854,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_admin"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "assign",
  "clap",
@@ -880,7 +880,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_api"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "assign",
  "async-trait",
@@ -918,7 +918,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_build_metadata"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "built",
  "cargo_metadata",
@@ -926,7 +926,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_core"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "argon2",
  "arrayvec",
@@ -994,7 +994,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_database"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "async-channel",
  "conduwuit_core",
@@ -1015,7 +1015,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_macros"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "cargo_toml",
  "itertools 0.15.0",
@@ -1026,7 +1026,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_router"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "assign",
  "axum",
@@ -1063,7 +1063,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_service"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "askama",
  "assign",
@@ -1115,7 +1115,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_web"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "askama",
  "assign",
@@ -4765,7 +4765,7 @@ dependencies = [
 
 [[package]]
 name = "ruminuwuity"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "assign",
  "ruma",
@@ -6874,7 +6874,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "26.7.0"
+version = "26.7.2"
 dependencies = [
  "askama",
  "cargo_metadata",

Cargo.toml

@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.7.0"
+version = "26.7.2"
 
 [workspace.metadata.crane]
 name = "conduwuit"

changelog.d/sec10.bugfix.md

@@ -0,0 +1 @@
+**TODO - embargoed until next release** (maintainers see security issue 10 when writing rls notes). Contributed by @eleboucher.

src/api/client/sync/v5.rs

@@ -1,6 +1,6 @@
 use std::{
 	cmp::{self, Ordering},
-	collections::{BTreeMap, BTreeSet, HashMap, HashSet, VecDeque},
+	collections::{BTreeMap, BTreeSet, HashMap, HashSet},
 	ops::Deref,
 	time::Duration,
 };
@@ -138,6 +138,13 @@ pub(crate) async fn sync_events_v5_route(
 	let (all_joined_rooms, all_invited_rooms, all_knocked_rooms) =
 		join3(all_joined_rooms, all_invited_rooms, all_knocked_rooms).await;
 
+	let allowed_rooms: BTreeSet<OwnedRoomId> = all_joined_rooms
+		.iter()
+		.chain(all_invited_rooms.iter())
+		.chain(all_knocked_rooms.iter())
+		.cloned()
+		.collect();
+
 	let all_joined_rooms = all_joined_rooms.iter().map(AsRef::as_ref);
 	let all_invited_rooms = all_invited_rooms.iter().map(AsRef::as_ref);
 	let all_knocked_rooms = all_knocked_rooms.iter().map(AsRef::as_ref);
@@ -190,13 +197,14 @@ pub(crate) async fn sync_events_v5_route(
 	)
 	.await;
 
-	fetch_subscriptions(services, sync_info, &known_rooms, &mut todo_rooms).await;
+	fetch_subscriptions(services, sync_info, &known_rooms, &allowed_rooms, &mut todo_rooms).await;
 
 	response.rooms = process_rooms(
 		services,
 		sender_user,
 		next_batch,
 		all_invited_rooms.clone(),
+		all_knocked_rooms.clone(),
 		&todo_rooms,
 		&mut response,
 		&body,
@@ -214,6 +222,7 @@ pub(crate) async fn sync_events_v5_route(
 	let no_room_data = response.rooms.iter().all(|(id, r)| {
 		r.timeline.is_empty()
 			&& r.required_state.is_empty()
+			&& r.invite_state.is_none()
 			&& !response.extensions.receipts.rooms.contains_key(id)
 	});
 
@@ -247,10 +256,17 @@ async fn fetch_subscriptions(
 	services: &Services,
 	(sender_user, sender_device, globalsince, body): SyncInfo<'_>,
 	known_rooms: &KnownRooms,
+	allowed_rooms: &BTreeSet<OwnedRoomId>,
 	todo_rooms: &mut TodoRooms,
 ) {
 	let mut known_subscription_rooms = BTreeSet::new();
 	for (room_id, room) in &body.room_subscriptions {
+		// Silently ignore subscriptions to rooms the user is not a member of
+		// (joined or invited).
+		if !allowed_rooms.contains(room_id) {
+			continue;
+		}
+
 		let not_exists = services.rooms.metadata.exists(room_id).eq(&false);
 
 		let is_disabled = services.rooms.metadata.is_disabled(room_id);
@@ -409,11 +425,13 @@ async fn handle_lists<'a, Rooms, AllRooms>(
 	BTreeMap::default()
 }
 
+#[allow(clippy::too_many_arguments)]
 async fn process_rooms<'a, Rooms>(
 	services: &Services,
 	sender_user: &UserId,
 	next_batch: u64,
 	all_invited_rooms: Rooms,
+	all_knocked_rooms: Rooms,
 	todo_rooms: &TodoRooms,
 	response: &mut sync_events::v5::Response,
 	body: &sync_events::v5::Request,
@@ -426,38 +444,101 @@ async fn process_rooms<'a, Rooms>(
 		let roomsincecount = PduCount::Normal(*roomsince);
 
 		let mut timestamp: Option<_> = None;
-		let mut invite_state = None;
 		let (timeline_pdus, limited);
 		let new_room_id: &RoomId = (*room_id).as_ref();
 		if all_invited_rooms.clone().any(is_equal_to!(new_room_id)) {
+			let Ok(invite_count) = services
+				.rooms
+				.state_cache
+				.get_invite_count(room_id, sender_user)
+				.await
+			else {
+				continue;
+			};
+
+			if *roomsince >= invite_count {
+				continue;
+			}
+
 			// TODO: figure out a timestamp we can use for remote invites
-			invite_state = services
+			let invite_state = services
 				.rooms
 				.state_cache
 				.invite_state(sender_user, room_id)
 				.await
 				.ok();
 
-			(timeline_pdus, limited) = (VecDeque::new(), true);
-		} else {
-			TimelinePdus { pdus: timeline_pdus, limited } = match load_timeline(
-				services,
-				sender_user,
-				room_id,
-				Some(roomsincecount),
-				Some(PduCount::from(next_batch)),
-				*timeline_limit,
-			)
-			.await
-			{
-				| Ok(value) => value,
-				| Err(err) => {
-					warn!("Encountered missing timeline in {}, error {}", room_id, err);
-					continue;
-				},
-			};
+			rooms.insert(
+				room_id.clone(),
+				assign!(sync_events::v5::response::Room::new(), {
+					initial: Some(roomsince == &0),
+					invite_state,
+					limited: true,
+				}),
+			);
+			continue;
 		}
 
+		if all_knocked_rooms.clone().any(is_equal_to!(new_room_id)) {
+			let Ok(knock_count) = services
+				.rooms
+				.state_cache
+				.get_knock_count(room_id, sender_user)
+				.await
+			else {
+				continue;
+			};
+
+			if *roomsince >= knock_count {
+				continue;
+			}
+
+			let Ok(knock_state) = services
+				.rooms
+				.state_cache
+				.knock_state(sender_user, room_id)
+				.await
+			else {
+				continue;
+			};
+
+			rooms.insert(
+				room_id.clone(),
+				assign!(sync_events::v5::response::Room::new(), {
+					initial: Some(roomsince == &0),
+					invite_state: Some(knock_state),
+					limited: true,
+				}),
+			);
+			continue;
+		}
+
+		if !services
+			.rooms
+			.state_cache
+			.is_joined(sender_user, room_id)
+			.await
+		{
+			continue;
+		}
+
+		TimelinePdus { pdus: timeline_pdus, limited } = match load_timeline(
+			services,
+			sender_user,
+			room_id,
+			Some(roomsincecount),
+			Some(PduCount::from(next_batch)),
+			*timeline_limit,
+		)
+		.await
+		{
+			| Ok(value) => value,
+			| Err(err) => {
+				warn!("Encountered missing timeline in {}, error {}", room_id, err);
+				continue;
+			},
+		};
+
 		if body.extensions.account_data.enabled == Some(true) {
 			response.extensions.account_data.rooms.insert(
 				room_id.to_owned(),
@@ -641,7 +722,6 @@ async fn process_rooms<'a, Rooms>(
 				},
 				initial: Some(roomsince == &0),
 				is_dm: None,
-				invite_state,
 				unread_notifications: assign!(UnreadNotificationsCount::new(), {
 					highlight_count: Some(
 						services
@@ -769,6 +849,15 @@ async fn collect_typing_events(
 
 	let mut typing_response = sync_events::v5::response::Typing::default();
 	for (room_id, (_, _, roomsince)) in todo_rooms {
+		if !services
+			.rooms
+			.state_cache
+			.is_joined(sender_user, room_id)
+			.await
+		{
+			continue;
+		}
+
 		if services.rooms.typing.last_typing_update(room_id).await? <= *roomsince {
 			continue;
 		}

src/service/rooms/event_handler/handle_incoming_pdu.rs

@@ -7,7 +7,7 @@
 	Err, Event, Result, debug, debug_error, debug_warn, defer, matrix::PartialPdu, trace,
 	utils::time::jitter,
 };
-use futures::{FutureExt, StreamExt, future::try_join3};
+use futures::{FutureExt, StreamExt, future::try_join4};
 use ruma::{CanonicalJsonValue, EventId, RoomId, ServerName, UserId};
 use tokio::sync::mpsc;
 
@@ -69,9 +69,13 @@ pub async fn handle_incoming_pdu<'a>(
 				.and_then(|s| UserId::parse(s).ok())
 				.is_some_and(|u| self.services.globals.user_is_local(&u));
 
-		let (room_exists, is_disabled, ()) = try_join3(
+		let (room_exists, is_disabled, is_resident, ()) = try_join4(
 			self.services.metadata.exists(room_id).map(Ok),
 			self.services.metadata.is_disabled(room_id).map(Ok),
+			self.services
+				.state_cache
+				.server_in_room(self.services.globals.server_name(), room_id)
+				.map(Ok),
 			self.acl_check(origin, room_id),
 		)
 		.await
@@ -85,12 +89,20 @@ pub async fn handle_incoming_pdu<'a>(
 			)));
 		}
 
+		// If the room doesn't exist (we don't have the create event), there's nothing
+		// we can do.
 		if !room_exists {
+			return Err!(Request(NotFound("Room is unknown to this server")));
+		}
+		// If the room does exist, but we aren't a resident of it, we might be
+		// interested in an out-of-band membership (for example, an inviter rescinding
+		// their invite).
+		if !is_resident {
 			if is_interesting_member_event {
 				// TODO: handle interesting membership events where we aren't in
 				// the room
 			}
-			return Err!(Request(NotFound("Room is unknown to this server")));
+			return Err!(Request(NotFound("This server does not have any members this room")));
 		}
 
 		// Fetch create event

src/service/rooms/event_handler/upgrade_outlier_pdu.rs

@@ -104,24 +104,24 @@ pub(super) async fn upgrade_outlier_to_timeline_pdu(
 		// Determine whether this PDU should be soft-failed.
 		// If the auth check failed, invariably yes. Otherwise, only if the user isn't
 		// allowed to redact the target event (if any).
-		let mut should_soft_fail =
-			match (passes_current_state, incoming_pdu.redacts_id(&room_version_rules)) {
-				| (false, _) => true,
-				| (true, None) => false,
-				| (true, Some(redact_id)) => self
-					.services
+		let redaction_permitted =
+			if let Some(redacted_id) = incoming_pdu.redacts_id(&room_version_rules) {
+				self.services
 					.state_accessor
-					.user_can_redact(&redact_id, incoming_pdu.sender(), room_id, true)
+					.user_can_redact(&redacted_id, incoming_pdu.sender(), room_id, true)
 					.await
-					.is_ok_and(is_true!()),
+					.is_ok_and(is_true!())
+			} else {
+				true
 			};
+		let mut should_soft_fail = !redaction_permitted || !passes_current_state;
 
 		if !should_soft_fail {
 			// Now we can perform check 7, which is ensuring the event passes policy server
 			// checks.
 			// We explicitly only do this if we aren't already going to soft-fail the event,
 			// since the policy server refusing this event also soft-fails it.
-			debug!(event_id = %incoming_pdu.event_id, "Checking policy server for event");
+			debug!("Checking policy server for event");
 			should_soft_fail = !self
 				.policy_server_check_7(&incoming_pdu, &mut val, &room_version_rules)
 				.await
@@ -153,6 +153,12 @@ pub(super) async fn upgrade_outlier_to_timeline_pdu(
 					should_soft_fail = true;
 				}
 			}
+		} else {
+			debug!(
+				%redaction_permitted,
+				%passes_current_state,
+				"Intending to soft-fail event (skipping further PDU checks)"
+			);
 		}
 
 		// The PDU has now passed all checks! We can now promote it (or soft-fail it if

src/service/rooms/state_accessor/user_can.rs

@@ -1,4 +1,4 @@
-use conduwuit::{Err, Result, matrix::Event, pdu::PartialPdu};
+use conduwuit::{Err, Result, matrix::Event, pdu::PartialPdu, trace};
 use ruma::{
 	EventId, RoomId, UserId,
 	events::{
@@ -46,6 +46,7 @@ pub async fn user_can_redact(
 		let power_levels = self.get_room_power_levels(room_id).await;
 
 		if power_levels.user_can_redact_event_of_other(sender) {
+			trace!(%sender, "Sender is allowed to redact other users' events");
 			return Ok(true);
 		}
 
@@ -59,10 +60,12 @@ pub async fn user_can_redact(
 					},
 				| _ => false,
 			};
+			trace!(%is_own_event, "User can redact own event");
 
 			return Ok(is_own_event);
 		}
 
+		trace!("User is not permitted to redact their own event nor others' events");
 		Ok(false)
 	}