matrix-org / matrix-org/matrix-rust-sdk
Device | Pitfall with `set_local_trust` on `Device` that is triggering a full `DeviceChange` and can overwrite other changes.
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 2.3k
- Forks
- 500
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 106
Description
There is a pitfall with Device and set_local_trust. If you keep a Device object around for some time then later on do a set_local_trust it is doing a full DeviceChanges that would overwrite changes that could have happens during that time (things like deleted olm_wedging_index withheld_code_sent)
Exposed in sdk here https://github.com/matrix-org/matrix-rust-sdk/blob/65b422312c27a1b7f5a8e25f1156d1a1d6691cc1/crates/matrix-sdk/src/encryption/identities/devices.rs#L548
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked set_local_trust implementation in crates/matrix-sdk-crypto/src/identities/device.rs and its SDK exposure in crates/matrix-sdk/src/encryption/identities/devices.rs. Reproduce or trace the stale Device scenario, then verify that changing local trust does not overwrite later DeviceChanges such as deleted, olm_wedging_index, or withheld_code_sent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100