From 0105b520bca0e48591f2107751ffbae04a757906 Mon Sep 17 00:00:00 2001 From: Erik Johnston Date: Wed, 27 May 2026 16:58:04 +0100 Subject: [PATCH] Validate that the room ID does actually start with a '!' --- rust/src/events/formats/v4.rs | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/rust/src/events/formats/v4.rs b/rust/src/events/formats/v4.rs index 31132d069f..d09ecaa276 100644 --- a/rust/src/events/formats/v4.rs +++ b/rust/src/events/formats/v4.rs @@ -111,7 +111,16 @@ pub fn validate_optional_room_id( match (is_create_event, room_id) { // For non-create events, room_id must be present. (false, None) => bail!("non-create event must have a room ID"), - (false, Some(_)) => {} + (false, Some(room_id)) => { + // We later derive the create event ID from the room ID by replacing + // the leading '!' with '$', so we require the room ID to start with + // '!'. + ensure!( + room_id.starts_with("!"), + "room_id must start with '!': {}", + room_id + ); + } // For create events, room_id must be absent. (true, Some(_)) => bail!("create event must not have a room ID"),