Signal/Android
1
0
Fork 0
mirror of https://github.com/signalapp/Signal-Android.git synced 2026-04-21 09:20:19 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add additional protections around recipientIds and threadIds matching.

Browse Source
This commit is contained in:
Greyson Parrelli
2022-12-23 11:26:36 -05:00
parent 4dd8e81db7
commit 3708cc5583
3 changed files with 36 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
app/src/main/java/org/thoughtcrime/securesms/database/ThreadTable.kt
View File

@@ -12,6 +12,7 @@ import org.jsoup.helper.StringUtil
import org.signal.core.util.CursorUtil
import org.signal.core.util.SqlUtil
import org.signal.core.util.delete
import org.signal.core.util.exists
import org.signal.core.util.logging.Log
import org.signal.core.util.or
import org.signal.core.util.readToList
@@ -1078,7 +1079,11 @@ class ThreadTable(context: Context, databaseHelper: SignalDatabase) : DatabaseTa
Log.i(TAG, "Using remapped threadId: " + candidateId + " -> " + remapped.get())
remapped.get()
} else {
candidateId
if (areThreadIdAndRecipientAssociated(candidateId, recipient)) {
candidateId
} else {
throw IllegalArgumentException()
}
}
} else {
getOrCreateThreadIdFor(recipient, distributionType)
@@ -1094,6 +1099,13 @@ class ThreadTable(context: Context, databaseHelper: SignalDatabase) : DatabaseTa
return threadId ?: createThreadForRecipient(recipient.id, recipient.isGroup, distributionType)
}
fun areThreadIdAndRecipientAssociated(threadId: Long, recipient: Recipient): Boolean {
return readableDatabase
.exists(TABLE_NAME)
.where("$ID = ? AND $RECIPIENT_ID = ?", threadId, recipient.id)
.run()
}
fun getThreadIdFor(recipientId: RecipientId): Long? {
return readableDatabase
.select(ID)