From d33385d1b27725247a4a4a32fd2692b45fbd77df Mon Sep 17 00:00:00 2001
From: Greyson Parrelli <greyson@signal.org>
Date: Fri, 5 Jun 2026 20:00:22 +0000
Subject: [PATCH] Improve group story reply and reaction validations.

---
 .../securesms/messages/DataMessageProcessor.kt     | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/app/src/main/java/org/thoughtcrime/securesms/messages/DataMessageProcessor.kt b/app/src/main/java/org/thoughtcrime/securesms/messages/DataMessageProcessor.kt
index 6ddcc92064..dd171f2171 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/messages/DataMessageProcessor.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/messages/DataMessageProcessor.kt
@@ -428,6 +428,14 @@ object DataMessageProcessor {
       try {
         val storyId = SignalDatabase.messages.getStoryId(authorRecipientId, sentTimestamp).id
 
+        val storyThreadRecipient: Recipient = SignalDatabase.threads.getRecipientForThreadId(SignalDatabase.messages.getMessageRecord(storyId).threadId)!!
+        val storyGroupRecord: GroupRecord? = SignalDatabase.groups.getGroup(storyThreadRecipient.id).orNull()
+        val storyGroupId: GroupId? = storyGroupRecord?.id?.takeIf { storyGroupRecord.isActive }
+        if (storyGroupId != groupId) {
+          warn(envelope.clientTimestamp!!, "Story reaction target does not belong to the same conversation as the incoming message. Dropping reaction.")
+          return null
+        }
+
         if (groupId != null) {
           parentStoryId = GroupReply(storyId)
         } else if (SignalDatabase.storySends.canReply(senderRecipientId, sentTimestamp)) {
@@ -748,6 +756,12 @@ object DataMessageProcessor {
         val groupRecord: GroupRecord? = SignalDatabase.groups.getGroup(threadRecipient.id).orNull()
         val groupStory: Boolean = groupRecord?.isActive ?: false
 
+        val storyGroupId: GroupId? = groupRecord?.id?.takeIf { groupStory }
+        if (storyGroupId != groupId) {
+          warn(envelope.clientTimestamp!!, "Story reply target does not belong to the same conversation as the incoming message. Dropping reply.")
+          return null
+        }
+
         if (!groupStory) {
           threadRecipient = senderRecipient
         }