Page MenuHomePhabricator

[lib] Tighten utils type to contain only thick threads
ClosedPublic

Authored by tomek on Oct 31 2024, 7:59 AM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Mar 28, 12:33 PM
Unknown Object (File)
Fri, Mar 28, 8:26 AM
Unknown Object (File)
Thu, Mar 27, 11:30 PM
Unknown Object (File)
Thu, Mar 27, 3:52 AM
Unknown Object (File)
Feb 18 2025, 2:36 PM
Unknown Object (File)
Feb 18 2025, 2:36 PM
Unknown Object (File)
Feb 18 2025, 2:36 PM
Unknown Object (File)
Feb 18 2025, 2:36 PM
Subscribers

Details

Summary

It is inconvenient to have the assertions in a lot of places - the issue would become a lot worse after the rest of the stack.

This diff introduces a new risk - an attacker can create a new thread with the same ID as an existing thin thread. Not sure how useful this attack could be. Protecting against it is handled in https://linear.app/comm/issue/ENG-9468/introduce-additional-validation-of-operations.

https://linear.app/comm/issue/ENG-9823/fix-sending-notifs-about-leaving-a-thick-thread

Depends on D13698

Test Plan

Flow

Diff Detail

Repository
rCOMM Comm
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

tomek requested review of this revision.Oct 31 2024, 8:17 AM

This diff introduces a new risk - an attacker can create a new thread with the same ID as an existing thin thread. Not sure how useful this attack could be. Protecting against it is handled in https://linear.app/comm/issue/ENG-9468/introduce-additional-validation-of-operations.

I'm a bit skeptical about introducing this regression. The task you linked is unlikely to be prioritized anytime soon.

This diff introduces a new risk - an attacker can create a new thread with the same ID as an existing thin thread. Not sure how useful this attack could be. Protecting against it is handled in https://linear.app/comm/issue/ENG-9468/introduce-additional-validation-of-operations.

I'm a bit skeptical about introducing this regression. The task you linked is unlikely to be prioritized anytime soon.

Introducing protection against this is a really quick fix (30 min?) to implement, and I think we can create a subtask out of that task and prioritize it.

This revision is now accepted and ready to land.Nov 5 2024, 1:44 AM