We should check whether the IDs are thick - it protects us against an attacker who could try to create operations referencing thin thread entities.
https://linear.app/comm/issue/ENG-9826/validate-the-ids-from-the-dm-operations
Depends on D13848
Paths
| Differential D13858 Authored by tomek on Nov 4 2024, 6:47 AM.
Details
Summary We should check whether the IDs are thick - it protects us against an attacker who could try to create operations referencing thin thread entities. https://linear.app/comm/issue/ENG-9826/validate-the-ids-from-the-dm-operations Depends on D13848 Test Plan Tested a couple of scenarios:
In the cases where another message was a target, tested that it works for both text and edit thread settings messages.
Diff Detail
Event TimelineHerald added a subscriber: ashoat. · View Herald TranscriptNov 4 2024, 6:47 AM2024-11-04 06:47:38 (UTC-8) Harbormaster completed remote builds in B32514: Diff 45580.Nov 4 2024, 7:05 AM2024-11-04 07:05:37 (UTC-8) kamil added inline comments. This revision is now accepted and ready to land.Nov 5 2024, 2:20 AM2024-11-05 02:20:50 (UTC-8)
Harbormaster completed remote builds in B32587: Diff 45706.Nov 8 2024, 3:33 AM2024-11-08 03:33:31 (UTC-8) Closed by commit rCOMMd8ed20cf4b9c: [lib] Validate IDs in DM operations (authored by tomek). · Explain WhyNov 8 2024, 4:29 AM2024-11-08 04:29:46 (UTC-8) This revision was automatically updated to reflect the committed changes.
Revision Contents
Diff 45706 lib/types/dm-ops.js
lib/utils/validation-utils.js
web/redux/initial-state-gate.js
|