matrix-org / matrix-org/matrix-rust-sdk

OlmSession: Sanity/Validation when importing olm session pickle

Open
#2,973 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

A-Encryption
Dominant language
Rust
Stars
2.3k
Forks
500
Avg merge
1d 16h
Merged PRs (30d)
106

Description

Currently when importing an olm session, the `last_use_time` and `creation_time` are blindly copied without checks:
https://github.com/matrix-org/matrix-rust-sdk/blob/75fe874cae8424ec09a869b62ed6719115eaa91a/crates/matrix-sdk-crypto/src/olm/session.rs#L251-L261

It maybe reasonable to check that these timestamps are not in the future.
As an example (developer error), the `creation_time` of the pickle could be set in millis. That would mean that if some unwedging occurs this session will ~always be seen is the most recent session and will be wrongly used.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in crates/matrix-sdk-crypto/src/olm/session.rs at the session pickle import around lines 251-261 and trace how last_use_time and creation_time are copied. Define and add validation for timestamps that are in the future, including the millis-versus-seconds example; done means malformed imports are rejected without affecting valid sessions.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cryptography
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.