`prev_content` can leak the content of redacted state events #1103

New issue

Open

opened 2025-10-06 13:59:40 +00:00 by ginger · 1 comment

ginger commented

2025-10-06 13:59:40 +00:00

Member

Suppose this scenario occurs:

A malicious user joins a room with an offensive avatar.
The user is banned from the room.
A room administrator redacts the user's joining m.room.member event to hide their avatar.

Currently, continuwuity will preserve the content of the redacted joining m.room.member event in the prev_content field of the banning m.room.member event, causing the avatars and display names of banned users with redacted join events to appear in clients which check prev_content to determine the avatars of users which are no longer in the room. This behavior conflicts with the specification, which states that prev_content "is only returned if [...] the client has permission to see the previous content". Synapse does not exhibit this behavior.

Suppose this scenario occurs: 1. A malicious user joins a room with an offensive avatar. 2. The user is banned from the room. 3. A room administrator redacts the user's joining `m.room.member` event to hide their avatar. Currently, continuwuity will preserve the content of the redacted joining `m.room.member` event in the `prev_content` field of the banning `m.room.member` event, causing the avatars and display names of banned users with redacted join events to appear in clients which check `prev_content` to determine the avatars of users which are no longer in the room. This behavior conflicts with the specification, which states that `prev_content` "is only returned if [...] the client has permission to see the previous content". Synapse does not exhibit this behavior.

ginger added the

Bug

Matrix/Core

labels

2025-10-06 13:59:40 +00:00

nex commented

2025-10-08 22:53:59 +00:00

Owner

can repro

{
  "auth_events": [
    "$OcsO8wejKyYBpS6JjBlEBQqrQ8esi9X79ByQ_mlYIxw",
    "$jSsvNLmPCbQ6Is5TyTi9zzhowRtLCQE_eX45JV79GPo",
    "$sI1y-xQsDSVrBc8GiYCVP_d2RF0A-eHHlB2F3DAiJjI",
    "$ewGsSWe8gDldvyKPeiYXcvMGUQp9xlSLT7ZYwXDbUUc"
  ],
  "content": {
    "membership": "ban",
    "org.matrix.msc4293.redact_events": true
  },
  "depth": 16,
  "event_id": "$FaFo6uUlsocg-iJP0yCsItEMQ5i0sqXhsprQXLxIIeg",
  "hashes": {
    "sha256": "MUuw7uTtJ/o513mCehGNtE51J5agPAXTtYrmFGJndu4"
  },
  "origin": "nexy7574.co.uk",
  "origin_server_ts": 1759963992381,
  "prev_events": [
    "$jSsvNLmPCbQ6Is5TyTi9zzhowRtLCQE_eX45JV79GPo"
  ],
  "room_id": "!XmPx0DGCp3fAP8Zfdi:nexy7574.co.uk",
  "sender": "@nex:nexy7574.co.uk",
  "signatures": {
    "nexy7574.co.uk": {
      "ed25519:efn3fIVR": "zuHrNYNJcH668sn4fAfFrEjmqKPWVNnirEZAX/4l/ztFNKbP3hCK2wEqGMliZYSJxvxL2O9qm2vxS84YTWrtCA"
    }
  },
  "state_key": "@test:nexy7574.co.uk",
  "type": "m.room.member",
  "unsigned": {
    "prev_content": {
      "displayname": "Should be redacted by ban",
      "membership": "invite"
    },
    "prev_sender": "@nex:nexy7574.co.uk",
    "replaces_state": "$jSsvNLmPCbQ6Is5TyTi9zzhowRtLCQE_eX45JV79GPo"
  }
}

can repro ```json { "auth_events": [ "$OcsO8wejKyYBpS6JjBlEBQqrQ8esi9X79ByQ_mlYIxw", "$jSsvNLmPCbQ6Is5TyTi9zzhowRtLCQE_eX45JV79GPo", "$sI1y-xQsDSVrBc8GiYCVP_d2RF0A-eHHlB2F3DAiJjI", "$ewGsSWe8gDldvyKPeiYXcvMGUQp9xlSLT7ZYwXDbUUc" ], "content": { "membership": "ban", "org.matrix.msc4293.redact_events": true }, "depth": 16, "event_id": "$FaFo6uUlsocg-iJP0yCsItEMQ5i0sqXhsprQXLxIIeg", "hashes": { "sha256": "MUuw7uTtJ/o513mCehGNtE51J5agPAXTtYrmFGJndu4" }, "origin": "nexy7574.co.uk", "origin_server_ts": 1759963992381, "prev_events": [ "$jSsvNLmPCbQ6Is5TyTi9zzhowRtLCQE_eX45JV79GPo" ], "room_id": "!XmPx0DGCp3fAP8Zfdi:nexy7574.co.uk", "sender": "@nex:nexy7574.co.uk", "signatures": { "nexy7574.co.uk": { "ed25519:efn3fIVR": "zuHrNYNJcH668sn4fAfFrEjmqKPWVNnirEZAX/4l/ztFNKbP3hCK2wEqGMliZYSJxvxL2O9qm2vxS84YTWrtCA" } }, "state_key": "@test:nexy7574.co.uk", "type": "m.room.member", "unsigned": { "prev_content": { "displayname": "Should be redacted by ban", "membership": "invite" }, "prev_sender": "@nex:nexy7574.co.uk", "replaces_state": "$jSsvNLmPCbQ6Is5TyTi9zzhowRtLCQE_eX45JV79GPo" } } ```

nex added the

Status

Confirmed

label

2025-10-08 22:54:08 +00:00

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

continuwuation/continuwuity#1103

No description provided.

Rows
Columns

prev_content can leak the content of redacted state events #1103

`prev_content` can leak the content of redacted state events #1103