extant2000/flamenet-messenger-android
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

An unproven device may not name a group

Browse Source 
The announcement has always been refused from an unproven sender (audit
C2). An ordinary group envelope carrying `gname` was not — so the weaker
of the two routes decided what a group is called.

On an unproven device `fromUser` is a CLAIM: the binding says that device
belongs to somebody else. The roster check then asks "is the person they
are pretending to be in this group", which answers yes for any member the
attacker cares to name — and the group heading in someone's chat list is a
good place to put a lie, because the reader has no reason to doubt it.

`Received` now carries `senderProven` so a caller acting on the sender can
ask, and `Session.receive` gates the adoption on it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Paul Hitt
2026-08-30 21:38:28 -04:00
co-authored by Claude Opus 4.8
parent fc12aaa591
commit 2162262159
3 changed files with 47 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/main/kotlin/io/flamenet/messenger/app/Session.kt
+13 -4
View File
@@ -753,10 +753,19 @@ class Session(
// the repair path for it. The announcement sent at creation
// reaches only who was online and only the devices that existed
// then; a phone set up later would otherwise sit on the relay's
// generic placeholder for ever. The membership check above has
// already run, so this is not a way in for a stranger.
message.content.raw?.optString("gname")?.takeIf { it.isNotEmpty() }
?.let { adoptGroupName(gid, it) }
// generic placeholder for ever.
//
// 🔴 **Proven senders only, exactly like the announcement.**
// `consumeControl` refuses an unproven device, and for a while
// this path did not — so the weaker of the two routes decided
// what a group is called. On an unproven device `fromUser` is a
// claim, and the roster check above then asks "is the person
// they are pretending to be in this group", which answers yes
// for any member they care to name.
if (message.senderProven) {
message.content.raw?.optString("gname")?.takeIf { it.isNotEmpty() }
?.let { adoptGroupName(gid, it) }
}
}
// 🔴 **A federated message files under its ADDRESS.** Their relay
// told ours nothing about who sent it, so `fromUser` is 0 — filing