Enforce state key matches sender

matrix-org · Jan 4, 2022 · e6be7f0 · e6be7f0
1 parent 85ede6d
commit e6be7f0
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/federationapi/routing/join.go b/federationapi/routing/join.go
@@ -194,6 +194,12 @@ func SendJoin(
 			JSON: jsonerror.BadJSON("No state key was provided in the join event."),
 		}
 	}
+	if !event.StateKeyEquals(event.Sender()) {
+		return util.JSONResponse{
+			Code: http.StatusBadRequest,
+			JSON: jsonerror.BadJSON("Event state key must match the event sender."),
+		}
+	}
 
 	// Check that the room ID is correct.
 	if event.RoomID() != roomID {