From 80dab2a822c9bbc2a9b1030ff6778b068da87306 Mon Sep 17 00:00:00 2001 From: Bart Oostveen Date: Wed, 12 Aug 2026 01:12:32 +0200 Subject: [PATCH] matrix-continuwuity: backport SEC28 This is a partial backport of https://github.com/NixOS/nixpkgs/pull/551640, backporting a security fix in release v26.7.3 of Continuwuity to v0.5.10. Original patch: https://forgejo.ellis.link/continuwuation/continuwuity/commit/49a8f6f53b6f86ed6abb8952843cb3a38c530ada See also: https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.7.3 --- .../0002-fix-backport-SEC28.patch | 37 +++++++++++++++++++ .../ma/matrix-continuwuity/package.nix | 1 + 2 files changed, 38 insertions(+) create mode 100644 pkgs/by-name/ma/matrix-continuwuity/0002-fix-backport-SEC28.patch diff --git a/pkgs/by-name/ma/matrix-continuwuity/0002-fix-backport-SEC28.patch b/pkgs/by-name/ma/matrix-continuwuity/0002-fix-backport-SEC28.patch new file mode 100644 index 000000000000..d07419844698 --- /dev/null +++ b/pkgs/by-name/ma/matrix-continuwuity/0002-fix-backport-SEC28.patch @@ -0,0 +1,37 @@ +From dcb079931a929880518015794d709f93651154ca Mon Sep 17 00:00:00 2001 +From: Ginger +Date: Tue, 11 Aug 2026 15:59:26 -0400 +Subject: [PATCH 1/2] fix(backport): SEC28 + +(cherry picked from commit 49a8f6f53b6f86ed6abb8952843cb3a38c530ada) +--- + src/service/threepid/mod.rs | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/service/threepid/mod.rs b/src/service/threepid/mod.rs +index dcc0b58ab..bda80f82e 100644 +--- a/src/service/threepid/mod.rs ++++ b/src/service/threepid/mod.rs +@@ -112,6 +112,10 @@ pub async fn send_validation_email( + // If a validation session already exists for this client secret, we can either + // reuse it with a new token or return early because it's already valid. + | Some(session) => { ++ if session.email != recipient.email { ++ return Err!(Request(InvalidParam("Wrong email for session."))); ++ } ++ + match session.validation_state { + | ValidationState::Validated => { + // If the existing session is already valid, don't send an email. +@@ -119,7 +123,7 @@ pub async fn send_validation_email( + }, + | ValidationState::Pending(ref mut token) => { + // Check ratelimiting for the target address. +- if self.ratelimiter.check_key(&recipient.email).is_err() { ++ if self.ratelimiter.check_key(&session.email).is_err() { + return Err(Error::BadRequest( + ErrorKind::LimitExceeded { retry_after: None }, + "You're sending emails too fast, try again in a few minutes.", +-- +2.55.0 + diff --git a/pkgs/by-name/ma/matrix-continuwuity/package.nix b/pkgs/by-name/ma/matrix-continuwuity/package.nix index 3ba5195b6a6d..4a26f55e818b 100644 --- a/pkgs/by-name/ma/matrix-continuwuity/package.nix +++ b/pkgs/by-name/ma/matrix-continuwuity/package.nix @@ -52,6 +52,7 @@ rustPlatform.buildRustPackage (finalAttrs: { patches = [ ./0001-fix-backport-SEC10.patch + ./0002-fix-backport-SEC28.patch ]; nativeBuildInputs = [