matrix-org / matrix-org/matrix-js-sdk
CVE-2023-28427 fixes leave state unable to sync
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 2.2k
- Forks
- 704
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 40
Description
Originally reported at https://github.com/cinnyapp/cinny/issues/1179 as I was unable to repro syncing an element client even after upgrade, but today realized the issue also appears on element, but only if syncing a new element login from scratch.
On Element Web 1.11.35, I see the following trying to sync fresh, which as a result leaves only about 10% of chats loaded and the rest don't receive messages and don't appear in the UI.
```
aught /sync error Error: Unable to encrypt with m.megaolm.v1.aes-sha2
setRoomEncryptionImpl index.ts:2689
onCryptoEvent index.ts:3081
processSyncResponse sync.ts:1431
L utils.ts:425
processSyncResponse sync.ts:1293
doSync sync.ts:915
sync sync.ts:798
startClient client.ts:1515
start MatrixClientPeg.ts:334
me Lifecycle.ts:818
ie Lifecycle.ts:639
te Lifecycle.ts:460
$ Lifecycle.ts:147
loadSession MatrixChat.tsx:496
promise callback*loadSession MatrixChat.tsx:495
Ye MatrixChat.tsx:343
promise callback*Ye MatrixChat.tsx:323
React 13
oe init.tsx:150
async* SecretSharing.ts:185
async* SecretSharing.ts:198
```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing a fresh Element Web login on version 1.11.35 and inspect the sync failure around index.ts, sync.ts, and client.ts named in the stack trace. Done means the m.megaolm.v1.aes-sha2 error no longer stops synchronization and all chats load and receive messages.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100