Thore Cimbal
42285021cb
Synapse's own check_media_file_for_spam module can never see E2EE attachment content - only the client ever holds the decryption key. Adds two hooks that call a self-hosted scan service (https://axion1337.chat/_scan, deployed separately in the gitops repo): - DecryptFile.ts: scans every decrypted attachment (image/audio/video/ file all funnel through this one function via MediaEventHelper) before returning it as a Blob. - ContentMessages.ts: scans plaintext before encryption/upload in uploadFile(), the shared function behind all attachment uploads (main file, thumbnails, voice messages), regardless of room encryption state. New ContentScanRejectedError surfaces through the existing error- rendering paths (MediaProcessingError, upload failure dialog) using the same pattern as DecryptError/DownloadError/UploadFailedError. Live-tested: EICAR blocked pre-upload in encrypted rooms and DMs; receive-side hook also blocks EICAR sent by an unpatched client (app.element.io), confirming it isn't just self-protection for our own uploads. Fails open on scanner errors so an outage can't block all uploads/downloads.
90 lines
3.5 KiB
TypeScript
90 lines
3.5 KiB
TypeScript
/*
|
|
Copyright 2024 New Vector Ltd.
|
|
Copyright 2016-2018 , 2021 The Matrix.org Foundation C.I.C.
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
|
|
Please see LICENSE files in the repository root for full details.
|
|
*/
|
|
|
|
// Pull in the encryption lib so that we can decrypt attachments.
|
|
import encrypt from "matrix-encrypt-attachment";
|
|
import { parseErrorResponse } from "matrix-js-sdk/src/matrix";
|
|
import { type EncryptedFile, type MediaEventInfo } from "matrix-js-sdk/src/types";
|
|
|
|
import { mediaFromContent } from "../customisations/Media";
|
|
import { getBlobSafeMimeType } from "./blobs";
|
|
import { MatrixClientPeg } from "../MatrixClientPeg";
|
|
import { scanContent, ContentScanRejectedError } from "./ContentScanner";
|
|
|
|
export class DownloadError extends Error {
|
|
public constructor(e: Error) {
|
|
super(e.message);
|
|
this.name = "DownloadError";
|
|
this.stack = e.stack;
|
|
}
|
|
}
|
|
|
|
export class DecryptError extends Error {
|
|
public constructor(e: Error) {
|
|
super(e.message);
|
|
this.name = "DecryptError";
|
|
this.stack = e.stack;
|
|
}
|
|
}
|
|
|
|
export { ContentScanRejectedError };
|
|
|
|
/**
|
|
* Decrypt a file attached to a matrix event.
|
|
* @param {EncryptedFile} file The encrypted file information taken from the matrix event.
|
|
* This passed to [link]{@link https://github.com/matrix-org/matrix-encrypt-attachment}
|
|
* as the encryption info object, so will also have the those keys in addition to
|
|
* the keys below.
|
|
* @param {MediaEventInfo} info The info parameter taken from the matrix event.
|
|
* @returns {Promise<Blob>} Resolves to a Blob of the file.
|
|
*/
|
|
export async function decryptFile(file?: EncryptedFile, info?: MediaEventInfo): Promise<Blob> {
|
|
// throws if file is falsy
|
|
const media = mediaFromContent({ file });
|
|
|
|
let responseData: ArrayBuffer;
|
|
try {
|
|
// Download the encrypted file as an array buffer.
|
|
const response = await media.downloadSource();
|
|
if (!response.ok) {
|
|
throw parseErrorResponse(response, await response.text());
|
|
}
|
|
responseData = await response.arrayBuffer();
|
|
} catch (e) {
|
|
throw new DownloadError(e as Error);
|
|
}
|
|
|
|
let dataArray: ArrayBuffer;
|
|
let mimetype: string;
|
|
try {
|
|
// Decrypt the array buffer using the information taken from the event content.
|
|
dataArray = await encrypt.decryptAttachment(responseData, file!);
|
|
|
|
// IMPORTANT: we must not allow scriptable mime-types into Blobs otherwise
|
|
// they introduce XSS attacks if the Blob URI is viewed directly in the
|
|
// browser (e.g. by copying the URI into a new tab or window.)
|
|
// See warning at top of file.
|
|
mimetype = getBlobSafeMimeType(info?.mimetype?.split(";")[0].trim() ?? "");
|
|
} catch (e) {
|
|
throw new DecryptError(e as Error);
|
|
}
|
|
|
|
// Issue #19 extension: Synapse's own media scanner never sees this content (it's
|
|
// ciphertext to the server) - this is the one place in the whole app where decrypted
|
|
// plaintext for *every* attachment type first exists, so scanning here covers all of
|
|
// them in one spot. Deliberately outside the try/catch above: a scan rejection is a
|
|
// distinct outcome from a decrypt failure, not wrapped as a DecryptError.
|
|
const accessToken = MatrixClientPeg.safeGet()?.getAccessToken();
|
|
if (accessToken) {
|
|
await scanContent(dataArray, accessToken);
|
|
}
|
|
|
|
// Turn the array into a Blob and give it the correct MIME-type.
|
|
return new Blob([dataArray], { type: mimetype });
|
|
}
|