Gapfilling from a server that can't check history visibility results in erroneously redacted events being persisted #1989

New issue

Open

opened 2026-07-14 17:44:59 +00:00 by nex · 4 comments

nex commented

2026-07-14 17:44:59 +00:00

Owner

This is a known problem with Matrix (bad remote can serve you redacted events and you just have to trust them), but I think we should at least attempt to fetch the redacted events individually before just accepting that they're redacted

image.png

97 KiB

nex added the

labels

2026-07-14 17:44:59 +00:00

Crazy_Nicc commented

2026-07-14 18:21:09 +00:00

Wouldn't this be even more risky? If we fetch every redacted event the remote server sends, couldn't this end in a very easy DoS? Or am I misunderstanding the point of this issue?

Hm, but just persisting them without checking will also lead to a DoS by disk space exhaustion

Wouldn't this be even more risky? If we fetch every redacted event the remote server sends, couldn't this end in a very easy DoS? Or am I misunderstanding the point of this issue? Hm, but just persisting them without checking will also lead to a DoS by disk space exhaustion

nex commented

2026-07-17 23:10:46 +00:00

Author

Owner

what?

Crazy_Nicc commented

2026-07-18 00:51:58 +00:00

I was referring to this:

bad remote can serve you redacted events and you just have to trust them

Though it seems I have misunderstood the nature of this Issue

I was referring to this: > bad remote can serve you redacted events and you just have to trust them Though it seems I have misunderstood the nature of this Issue

nex commented

2026-07-19 23:04:16 +00:00

Author

Owner

Ah yeah. I mean that you just have to trust that the event is redacted, not that the event is authentic.
Since servers are supposed to serve redacted versions of events over federation if the requesting server can't see them, the only way to verify that the event is actually supposed to be redacted is by asking another server who might serve you an unredacted copy. There's no way to know if an event was redacted because a. you weren't allowed to see it, b. the event was actually redacted by a redaction event, or c. the remote decided it doesn't like you (malicious)

You can still verify redacted events and whatnot, you just can't see their contents (almost all event bodies just become {})

Ah yeah. I mean that you just have to trust that the event is redacted, not that the event is authentic. Since servers are supposed to serve redacted versions of events over federation if the requesting server can't see them, the only way to verify that the event is actually supposed to be redacted is by asking another server who might serve you an unredacted copy. There's no way to know if an event was redacted because a. you weren't allowed to see it, b. the event was actually redacted by a redaction event, or c. the remote decided it doesn't like you (malicious) You can still verify redacted events and whatnot, you just can't see their contents (almost all event bodies just become `{}`)

👍 1