matrix-org / matrix-org/matrix-rust-sdk
OlmSession: Sanity/Validation when importing olm session pickle
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 2.3k
- Forks
- 500
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 106
Description
Currently when importing an olm session, the `last_use_time` and `creation_time` are blindly copied without checks:
https://github.com/matrix-org/matrix-rust-sdk/blob/75fe874cae8424ec09a869b62ed6719115eaa91a/crates/matrix-sdk-crypto/src/olm/session.rs#L251-L261
It maybe reasonable to check that these timestamps are not in the future.
As an example (developer error), the `creation_time` of the pickle could be set in millis. That would mean that if some unwedging occurs this session will ~always be seen is the most recent session and will be wrongly used.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in crates/matrix-sdk-crypto/src/olm/session.rs at the session pickle import around lines 251-261 and trace how last_use_time and creation_time are copied. Define and add validation for timestamps that are in the future, including the millis-versus-seconds example; done means malformed imports are rejected without affecting valid sessions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100