mirror of
https://github.com/torlando-tech/pyxis.git
synced 2026-09-25 06:04:51 +00:00
Torlando
40c1869765
A message whose source identity is KNOWN but whose signature fails to validate is spoofed or malicious and must not be rendered. The opportunistic (on_packet) and direct (on_resource_concluded) router paths already reject these, but the propagated (store-and-forward) path in process_propagated_lxmf queues them without a signature check, so UIManager::on_message_received is the single choke point that covers all three inbound routes. Drop the message at the top of on_message_received — before the key request, location ingest, persistence, chat render, and notification beep — when !signature_validated() && reason == SIGNATURE_INVALID. SOURCE_UNKNOWN (first contact) is untouched: those still render and trigger the bounded key request from PR #92. Validated messages are unaffected. Add a source-level contract test locking in the drop gate's ordering relative to every side effect and its enum specificity.