element-hq / element-hq/element-ios

Wrong message index when sending an image via Share Extension, message not decryptable in Element-Web, can break rooms when session-ID is affected!

Open
#7,499 21 comments 13 reactions 0 assignees View on GitHub
A-ShareExtension O-Occasional S-Major T-Defect
Dominant language
Swift
Stars
1.8k
Forks
544
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

I've posted the initial issue in Element-Web here: https://github.com/vector-im/element-web/issues/25108

I've seen that sometimes messages can't be decoded in Element-Web. The "Retreieve encryption keys from other device" banner pops up, but does not solve the issue. Neither does clearing the cache. These messages are undecryptable forever in Element-Web and Desktop.

The raw message display in Element-Web shows this error:

```
"msgtype": "m.bad.encrypted",
"body": "** Unable to decrypt: DecryptionError: Duplicate message index, possible replay attack:

```

I was told in the Element-Web issue that this is a sender issue, so I investigated in this direction. I found that this always happens, when someone sends something (i.e. a picture) to the Element-IOS app via the **IOS Share Extension**. The very next message after this message can'be be decrypted in Element-Web:

1. Send an image from the Gallery via the Share Extension to an encrypted room
2. Write a text message afterwards into the same room
3. The text message can't be read in Element-Web and Element-Desktop. Error message "Message decryption not possible".
4. The next text message reads fine

This does not happen when the same picture is sent directly from within Element with the "+"-Button.

Maybe the message index is not updated/incremented after sending something via the Share Extension, causing the "Duplicate Index" error in Element-Web?

Element-IOS and Android are decrypting the message (maybe they don't care about duplicated message indices?)

![image](https://user-images.githubusercontent.com/3321655/232482044-b25aff3f-ea65-44c3-b80a-37182caa2984.png)

![image](https://user-images.githubusercontent.com/3321655/232482171-1b5c9189-a382-489e-9a98-340cad236d17.png)

### Outcome

#### What did you expect?

Even after sending something via the IOS Share Extension, the next message shall be decryptable in all access ways (Element-Web, Element-Dsktop)

#### What happened instead?

The very next message after a message sent via Share Extension can never be decrypted in Element-Web and Element-Desktop, always showing "`DecryptionError: Duplicate message index, possible replay attack`"

### Your phone model

iPhone 14 Pro Max, iPad Pro 10.5

### Operating system version

IOS 16.4.1

### Application version

Element 1.10.10

### Homeserver

Synapse 1.81

### Will you send logs?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.