element-hq / element-hq/element-web

Element-web makes invalid assumptions about room membership changes with lazy-loading

Open
#27,285 2 comments 0 reactions 0 assignees View on GitHub
A-E2EE A-Lazy-Loading O-Uncommon S-Minor T-Defect Z-UISI
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

Consider:
* Alice joins a room and gets an initial `/sync` response in that room. Due to lazy-loading, the membership list is incomplete.
* We decide to load the full membership list (eg, Alice opens the user list, or sends an encrypted message).
* Alice closes the tab for a while.
* Bob joins the room and sends a bunch of messages.
* Alice opens the tab again, and does an incremental `/sync`; she gets a gappy `/sync` result.
* Alice sends an encrypted message.

Now, the problem is that we do not refresh the membership list on the gappy sync result. The spec for lazy-loading is [unclear](https://github.com/matrix-org/matrix-spec/issues/942#issuecomment-1961038725) about exactly what assumptions we can make, but it seems that, whilst Synapse disables lazy-loading for incremental syncs, Conduit does not.

I'm filing this here as the net effect is that, when used against Conduit, Element-Web will send undecryptable events. It's to be determined whether this should be considered a bug in Element or Conduit.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.