matrix-org / matrix-org/matrix-rust-sdk

Incoming verification requests can race with `/keys/query` operations

Open
#2,896 2 comments 0 reactions 1 assignee Claimed by @andybalaam View on GitHub
Dominant language
Rust
Stars
2.3k
Forks
500
Avg merge
1d 16h
Merged PRs (30d)
106

Description

Suppose Bob receives a verification request from Alice, which he accepts.

Alice can then choose to generate a QR code for Alice to scan with [`VerificationRequest::generate_qr_code`](https://matrix-org.github.io/matrix-rust-sdk/matrix_sdk_crypto/struct.VerificationRequest.html#method.generate_qr_code), or transition to a SAS flow with [`VerificationRequest::start_sas`](https://matrix-org.github.io/matrix-rust-sdk/matrix_sdk_crypto/struct.VerificationRequest.html#method.start_sas).

The problem is that this whole process can race with Alice's `/keys/query` request for Bob's devices, and if `generate_qr_code` or `start_sas` is called before the query completes, they fail with

```
WARN matrix_sdk_crypto::verification::requests: Can't create a QR code, the device that accepted the verification doesn't exist
user_id="@bob_41:localhost" device_id="QTRATQPRBO"
at /home/rav/work/matrix-rust-sdk/crates/matrix-sdk-crypto/src/verification/requests.rs:1217
```

(or `Can't start the SAS verification flow, the device that accepted the verification doesn't exist`).

It seems like there should be a call to `KeyQueryManager::wait_if_user_key_query_pending` somewhere in here.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.