Merge branch 'develop' into renovate/eslint-monorepo

CHANGELOG.md

@@ -1,3 +1,22 @@
+Changes in [34.8.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.8.0) (2024-10-15)
+==================================================================================================
+This release removes insecure functionality, resolving CVE-2024-47080 / GHSA-4jf8-g8wp-cx7c.
+
+Changes in [34.7.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.7.0) (2024-10-08)
+==================================================================================================
+## 🦖 Deprecations
+
+* RTCSession cleanup: deprecate getKeysForParticipant() and getEncryption(); add emitEncryptionKeys() ([#4427](https://github.com/matrix-org/matrix-js-sdk/pull/4427)). Contributed by @hughns.
+
+## ✨ Features
+
+* Bump matrix-rust-sdk to 9.1.0 ([#4435](https://github.com/matrix-org/matrix-js-sdk/pull/4435)). Contributed by @richvdh.
+* Rotate Matrix RTC media encryption key when a new member joins a call for Post Compromise Security ([#4422](https://github.com/matrix-org/matrix-js-sdk/pull/4422)). Contributed by @hughns.
+* Update media event content types to include captions ([#4403](https://github.com/matrix-org/matrix-js-sdk/pull/4403)). Contributed by @tulir.
+* Update OIDC registration types to match latest MSC2966 state ([#4432](https://github.com/matrix-org/matrix-js-sdk/pull/4432)). Contributed by @t3chguy.
+* Add `CryptoApi.pinCurrentUserIdentity` and `UserIdentity.needsUserApproval` ([#4415](https://github.com/matrix-org/matrix-js-sdk/pull/4415)). Contributed by @richvdh.
+
+
 Changes in [34.6.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.6.0) (2024-09-24)
 ==================================================================================================
 ## 🦖 Deprecations

babel.config.cjs

@@ -31,5 +31,22 @@ module.exports = {
         "@babel/plugin-transform-object-rest-spread",
         "@babel/plugin-syntax-dynamic-import",
         "@babel/plugin-transform-runtime",
+        [
+            "search-and-replace",
+            {
+                // Since rewriteImportExtensions doesn't work on dynamic imports (yet), we need to manually replace
+                // the dynamic rust-crypto import.
+                // (see https://github.com/babel/babel/issues/16750)
+                rules:
+                    process.env.NODE_ENV !== "test"
+                        ? [
+                              {
+                                  search: "./rust-crypto/index.ts",
+                                  replace: "./rust-crypto/index.js",
+                              },
+                          ]
+                        : [],
+            },
+        ],
     ],
 };

package.json

@@ -1,6 +1,6 @@
 {
     "name": "matrix-js-sdk",
-    "version": "34.6.0",
+    "version": "34.8.0",
     "description": "Matrix Client-Server SDK for Javascript",
     "engines": {
         "node": ">=20.0.0"
@@ -91,6 +91,7 @@
         "@typescript-eslint/eslint-plugin": "^7.0.0",
         "@typescript-eslint/parser": "^7.0.0",
         "babel-jest": "^29.0.0",
+        "babel-plugin-search-and-replace": "^1.1.1",
         "debug": "^4.3.4",
         "eslint": "8.57.1",
         "eslint-config-google": "^0.14.0",
@@ -104,7 +105,7 @@
         "eslint-plugin-tsdoc": "^0.3.0",
         "eslint-plugin-unicorn": "^55.0.0",
         "fake-indexeddb": "^5.0.2",
-        "fetch-mock": "11.1.3",
+        "fetch-mock": "11.1.5",
         "fetch-mock-jest": "^1.5.1",
         "husky": "^9.0.0",
         "jest": "^29.0.0",

spec/unit/matrixrtc/MatrixRTCSession.spec.ts

@@ -1010,6 +1010,48 @@ describe("MatrixRTCSession", () => {
             }
         });
 
+        it("Wraps key index around to 0 when it reaches the maximum", async () => {
+            // this should give us keys with index [0...255, 0, 1]
+            const membersToTest = 258;
+            const members: CallMembershipData[] = [];
+            for (let i = 0; i < membersToTest; i++) {
+                members.push(Object.assign({}, membershipTemplate, { device_id: `DEVICE${i}` }));
+            }
+            jest.useFakeTimers();
+            try {
+                // start with a single member
+                const mockRoom = makeMockRoom(members.slice(0, 1));
+
+                for (let i = 0; i < membersToTest; i++) {
+                    const keysSentPromise = new Promise<EncryptionKeysEventContent>((resolve) => {
+                        sendEventMock.mockImplementation((_roomId, _evType, payload) => resolve(payload));
+                    });
+
+                    if (i === 0) {
+                        // if first time around then set up the session
+                        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+                        sess.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
+                    } else {
+                        // otherwise update the state
+                        mockRoom.getLiveTimeline().getState = jest
+                            .fn()
+                            .mockReturnValue(makeMockRoomState(members.slice(0, i + 1), mockRoom.roomId));
+                    }
+
+                    sess!.onMembershipUpdate();
+
+                    // advance time to avoid key throttling
+                    jest.advanceTimersByTime(10000);
+
+                    const keysPayload = await keysSentPromise;
+                    expect(keysPayload.keys).toHaveLength(1);
+                    expect(keysPayload.keys[0].index).toEqual(i % 256);
+                }
+            } finally {
+                jest.useRealTimers();
+            }
+        });
+
         it("Doesn't re-send key immediately", async () => {
             const realSetTimeout = setTimeout;
             jest.useFakeTimers();

spec/unit/models/MSC3089TreeSpace.spec.ts

@@ -107,7 +107,7 @@ describe("MSC3089TreeSpace", () => {
             return Promise.resolve();
         });
         client.invite = fn;
-        await tree.invite(target, false, false);
+        await tree.invite(target, false);
         expect(fn).toHaveBeenCalledTimes(1);
     });
 
@@ -120,7 +120,7 @@ describe("MSC3089TreeSpace", () => {
             return Promise.resolve();
         });
         client.invite = fn;
-        await tree.invite(target, false, false);
+        await tree.invite(target, false);
         expect(fn).toHaveBeenCalledTimes(2);
     });
 
@@ -133,7 +133,7 @@ describe("MSC3089TreeSpace", () => {
         });
         client.invite = fn;
 
-        await expect(tree.invite(target, false, false)).rejects.toThrow("MatrixError: Sample Failure");
+        await expect(tree.invite(target, false)).rejects.toThrow("MatrixError: Sample Failure");
 
         expect(fn).toHaveBeenCalledTimes(1);
     });
@@ -155,61 +155,10 @@ describe("MSC3089TreeSpace", () => {
             { invite: (userId) => fn(tree.roomId, userId) } as MSC3089TreeSpace,
         ];
 
-        await tree.invite(target, true, false);
+        await tree.invite(target, true);
         expect(fn).toHaveBeenCalledTimes(4);
     });
 
-    it("should share keys with invitees", async () => {
-        const target = targetUser;
-        const sendKeysFn = jest.fn().mockImplementation((inviteRoomId: string, userIds: string[]) => {
-            expect(inviteRoomId).toEqual(roomId);
-            expect(userIds).toMatchObject([target]);
-            return Promise.resolve();
-        });
-        client.invite = () => Promise.resolve({}); // we're not testing this here - see other tests
-        client.sendSharedHistoryKeys = sendKeysFn;
-
-        // Mock the history check as best as possible
-        const historyVis = "shared";
-        const historyFn = jest.fn().mockImplementation((eventType: string, stateKey?: string) => {
-            // We're not expecting a super rigid test: the function that calls this internally isn't
-            // really being tested here.
-            expect(eventType).toEqual(EventType.RoomHistoryVisibility);
-            expect(stateKey).toEqual("");
-            return { getContent: () => ({ history_visibility: historyVis }) }; // eslint-disable-line camelcase
-        });
-        room.currentState.getStateEvents = historyFn;
-
-        // Note: inverse test is implicit from other tests, which disable the call stack of this
-        // test in order to pass.
-        await tree.invite(target, false, true);
-        expect(sendKeysFn).toHaveBeenCalledTimes(1);
-        expect(historyFn).toHaveBeenCalledTimes(1);
-    });
-
-    it("should not share keys with invitees if inappropriate history visibility", async () => {
-        const target = targetUser;
-        const sendKeysFn = jest.fn().mockImplementation((inviteRoomId: string, userIds: string[]) => {
-            expect(inviteRoomId).toEqual(roomId);
-            expect(userIds).toMatchObject([target]);
-            return Promise.resolve();
-        });
-        client.invite = () => Promise.resolve({}); // we're not testing this here - see other tests
-        client.sendSharedHistoryKeys = sendKeysFn;
-
-        const historyVis = "joined"; // NOTE: Changed.
-        const historyFn = jest.fn().mockImplementation((eventType: string, stateKey?: string) => {
-            expect(eventType).toEqual(EventType.RoomHistoryVisibility);
-            expect(stateKey).toEqual("");
-            return { getContent: () => ({ history_visibility: historyVis }) }; // eslint-disable-line camelcase
-        });
-        room.currentState.getStateEvents = historyFn;
-
-        await tree.invite(target, false, true);
-        expect(sendKeysFn).toHaveBeenCalledTimes(0);
-        expect(historyFn).toHaveBeenCalledTimes(1);
-    });
-
     async function evaluatePowerLevels(pls: any, role: TreePermissions, expectedPl: number) {
         makePowerLevels(pls);
         const fn = jest

spec/unit/rust-crypto/PerSessionKeyBackupDownloader.spec.ts

@@ -26,7 +26,6 @@ import { RustBackupCryptoEventMap, RustBackupCryptoEvents, RustBackupManager } f
 import * as TestData from "../../test-utils/test-data";
 import {
     ConnectionError,
-    CryptoEvent,
     HttpApiEvent,
     HttpApiEventHandlerMap,
     IHttpOpts,
@@ -37,6 +36,7 @@ import {
 import * as testData from "../../test-utils/test-data";
 import { BackupDecryptor } from "../../../src/common-crypto/CryptoBackend";
 import { KeyBackupSession } from "../../../src/crypto-api/keybackup";
+import { CryptoEvent } from "../../../src/crypto-api/index.ts";
 
 describe("PerSessionKeyBackupDownloader", () => {
     /** The downloader under test */

spec/unit/rust-crypto/backup.spec.ts

@@ -2,7 +2,8 @@ import { Mocked } from "jest-mock";
 import fetchMock from "fetch-mock-jest";
 import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
 
-import { CryptoEvent, HttpApiEvent, HttpApiEventHandlerMap, MatrixHttpApi, TypedEventEmitter } from "../../../src";
+import { HttpApiEvent, HttpApiEventHandlerMap, MatrixHttpApi, TypedEventEmitter } from "../../../src";
+import { CryptoEvent } from "../../../src/crypto-api/index.ts";
 import { OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
 import * as testData from "../../test-utils/test-data";
 import * as TestData from "../../test-utils/test-data";

spec/unit/rust-crypto/rust-crypto.spec.ts

@@ -30,7 +30,6 @@ import fetchMock from "fetch-mock-jest";
 import { RustCrypto } from "../../../src/rust-crypto/rust-crypto";
 import { initRustCrypto } from "../../../src/rust-crypto";
 import {
-    CryptoEvent,
     Device,
     DeviceVerification,
     encodeBase64,
@@ -71,6 +70,7 @@ import { ClientEvent, ClientEventHandlerMap } from "../../../src/client";
 import { Curve25519AuthData } from "../../../src/crypto-api/keybackup";
 import encryptAESSecretStorageItem from "../../../src/utils/encryptAESSecretStorageItem.ts";
 import { CryptoStore, SecretStorePrivateKeys } from "../../../src/crypto/store/base";
+import { CryptoEvent } from "../../../src/crypto-api/index.ts";
 
 const TEST_USER = "@alice:example.com";
 const TEST_DEVICE_ID = "TEST_DEVICE";

spec/unit/secret-storage.spec.ts

@@ -18,6 +18,7 @@ import { Mocked } from "jest-mock";
 
 import {
     AccountDataClient,
+    calculateKeyCheck,
     PassphraseInfo,
     SecretStorageCallbacks,
     SecretStorageKeyDescriptionAesV1,
@@ -26,7 +27,6 @@ import {
     trimTrailingEquals,
 } from "../../src/secret-storage";
 import { randomString } from "../../src/randomstring";
-import { calculateKeyCheck } from "../../src/calculateKeyCheck.ts";
 
 describe("ServerSideSecretStorageImpl", function () {
     describe(".addKey", function () {

src/@types/requests.ts

@@ -111,18 +111,16 @@ type DelayedPartialTimelineEvent = {
 
 type DelayedPartialStateEvent = DelayedPartialTimelineEvent & {
     state_key: string;
-    transaction_id: string;
 };
 
 type DelayedPartialEvent = DelayedPartialTimelineEvent | DelayedPartialStateEvent;
 
 export type DelayedEventInfo = {
-    delayed_events: DelayedPartialEvent &
+    delayed_events: (DelayedPartialEvent &
         SendDelayedEventResponse &
-        SendDelayedEventRequestOpts &
-        {
+        SendDelayedEventRequestOpts & {
             running_since: number;
-        }[];
+        })[];
     next_batch?: string;
 };