macltok

public

Star0

Fork 0

Watch0

32 commits 3 branches 0 tags 0 releases3.0 MiB

Commit `9c05b1dd327a`

tarball

atagen <boss@atagen.co>2026-10-08 13:08 UTC

5 files changed+108-7

account: check homeserver input before discovery sees it

Modified file: docs/design-decisions.md+8 additions@@ -213,6 +213,14 @@ engine stopping ends nothing, `Stopped` covers it
 with an encrypted store, refresh tokens and threads. the store is sqlite
 natively and indexeddb in a browser. secret-bearing inputs don't derive `Clone`
 
+the homeserver a person typed is checked before the client sees it, and a bad
+one is `AccountError::InvalidHomeserver`. a bare server name passes untouched,
+since that's what sends the sdk to `.well-known`, and a host that "helpfully"
+adds `https://` turns `example.org` into a homeserver url and skips discovery.
+a url needs a host, no userinfo, and https. plain http needs
+`allow_insecure_loopback` and a loopback host. `SoftLogout::password_login` sets
+it, since its homeserver passed once already
+
 a `SessionStore` owns one login's record and its store. login saves the first
 record, `restore` loads it, and the engine a `Session` builds saves every token
 rotation after that, since a refresh token works once and a host that missed one

Modified file: harness/web/src/lib.rs+1−1

@@ -33,7 +33,7 @@ pub async fn smoke(

3333 let sessions = Arc::new(EncryptedSessionStore::indexeddb(

3434 StoreConfig::indexeddb(store_name.clone(), "macltok-web"),

3535 ));

36- let login = PasswordLogin::new(homeserver, username, password);

36+ let login = PasswordLogin::new(homeserver, username, password).allow_insecure_loopback(true);

3737 let session = Session::login_password(login, sessions).await?;

3838 let (engine, handle, events) = session.build(EngineConfig::default()).await?;

3939 let (panicked, panics) = mpsc::unbounded();

Modified file: harness/web/tests/worker.rs+1

@@ -95,6 +95,7 @@ fn login() -> PasswordLogin {

9595 env!("MACLTOK_USERNAME"),

9696 env!("MACLTOK_PASSWORD"),

9797 )

98+ .allow_insecure_loopback(true)

9899 }

99100

100101 fn sessions(store: &str) -> Arc<dyn SessionStore> {

Modified file: src/account.rs+63 additions−2 deletions@@ -55,6 +55,8 @@ pub struct PasswordLogin {
     pub device_display_name: Option<String>,
     /// set after a soft logout so the store's keys still belong to us
     pub device_id: Option<OwnedDeviceId>,
+    /// let plain http through, for loopback hosts only
+    pub allow_insecure_loopback: bool,
 }
 
 impl PasswordLogin {
@@ -70,6 +72,7 @@ impl PasswordLogin {
             password: password.into(),
             device_display_name: None,
             device_id: None,
+            allow_insecure_loopback: false,
         }
     }
 
@@ -84,6 +87,12 @@ impl PasswordLogin {
         self.device_id = Some(device_id);
         self
     }
+
+    #[must_use]
+    pub fn allow_insecure_loopback(mut self, allow: bool) -> Self {
+        self.allow_insecure_loopback = allow;
+        self
+    }
 }
 
 #[non_exhaustive]
@@ -95,6 +104,8 @@ pub struct OAuthLogin {
     pub client_id: Option<String>,
     pub device_id: Option<OwnedDeviceId>,
     pub application_type: OAuthApplicationType,
+    /// let plain http through, for loopback hosts only
+    pub allow_insecure_loopback: bool,
 }
 
 impl OAuthLogin {
@@ -113,6 +124,7 @@ impl OAuthLogin {
             client_id: None,
             device_id: None,
             application_type,
+            allow_insecure_loopback: false,
         }
     }
 
@@ -134,6 +146,12 @@ impl OAuthLogin {
         self.device_id = Some(device_id);
         self
     }
+
+    #[must_use]
+    pub fn allow_insecure_loopback(mut self, allow: bool) -> Self {
+        self.allow_insecure_loopback = allow;
+        self
+    }
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -341,6 +359,7 @@ impl SoftLogout {
     pub fn password_login(&self, password: impl Into<String>) -> PasswordLogin {
         PasswordLogin::new(self.homeserver.clone(), self.user_id.as_str(), password)
             .with_device_id(self.device_id.clone())
+            .allow_insecure_loopback(true)
     }
 }
 
@@ -360,6 +379,9 @@ pub enum AccountError {
     UnsupportedAuthentication,
     #[error("the OAuth callback was already submitted")]
     OAuthCallbackAlreadySubmitted,
+    /// what was typed can't name a homeserver, so nothing was sent anywhere
+    #[error("that isn't a usable homeserver, {0}")]
+    InvalidHomeserver(&'static str),
     /// an IndexedDB delete is waiting on the store's other connections. it goes through
     /// once they close, and opening the store again waits behind it
     #[error("the store is still open elsewhere, it will be deleted once that closes")]
@@ -431,9 +453,10 @@ impl Session {
         login: PasswordLogin,
         sessions: Arc<dyn SessionStore>,
     ) -> Result<Self, AccountError> {
+        let homeserver = homeserver_input(&login.homeserver, login.allow_insecure_loopback)?;
         let store_lock = sessions.store().lock().await?;
         let client = matrix_client_builder(sessions.store())
-            .server_name_or_homeserver_url(login.homeserver.trim())
+            .server_name_or_homeserver_url(homeserver)
             .build()
             .await
             .map_err(|error| account_error("building the Matrix client", error))?;
@@ -464,9 +487,10 @@ impl Session {
             .map_err(|error| account_error("parsing the OAuth redirect URI", error))?;
         let client_uri = Url::parse(login.client_uri.trim())
             .map_err(|error| account_error("parsing the OAuth client URI", error))?;
+        let homeserver = homeserver_input(&login.homeserver, login.allow_insecure_loopback)?;
         let store_lock = sessions.store().lock().await?;
         let client = matrix_client_builder(sessions.store())
-            .server_name_or_homeserver_url(login.homeserver.trim())
+            .server_name_or_homeserver_url(homeserver)
             .build()
             .await
             .map_err(|error| account_error("building the Matrix client", error))?;
@@ -693,6 +717,43 @@ fn matrix_client_builder(store: &StoreConfig) -> ClientBuilder {
     }
 }
 
+/// a bare server name goes through untouched, since that's what makes the sdk try `.well-known`
+fn homeserver_input(input: &str, allow_insecure_loopback: bool) -> Result<&str, AccountError> {
+    let input = input.trim();
+    let invalid = |reason| Err(AccountError::InvalidHomeserver(reason));
+    if input.is_empty() {
+        return invalid("it's empty");
+    }
+    if input.contains(char::is_whitespace) {
+        return invalid("it has spaces in it");
+    }
+    if !input.contains("://") {
+        return match <&ruma::ServerName>::try_from(input) {
+            Ok(_) => Ok(input),
+            Err(_) => invalid("it's neither a server name nor a url"),
+        };
+    }
+    let Ok(url) = Url::parse(input) else {
+        return invalid("it isn't a valid url");
+    };
+    if !url.username().is_empty() || url.password().is_some() {
+        return invalid("it has a username in it");
+    }
+    let loopback = match url.host() {
+        None => return invalid("it has no host"),
+        Some(url::Host::Domain(domain)) => domain.eq_ignore_ascii_case("localhost"),
+        Some(url::Host::Ipv4(address)) => address.is_loopback(),
+        Some(url::Host::Ipv6(address)) => address.is_loopback(),
+    };
+    match url.scheme() {
+        "https" => Ok(input),
+        "http" if allow_insecure_loopback && loopback => Ok(input),
+        "http" if allow_insecure_loopback => invalid("plain http only reaches loopback hosts"),
+        "http" => invalid("it isn't https"),
+        _ => invalid("only http and https are spoken"),
+    }
+}
+
 pub(crate) fn account_error(
     context: &'static str,
     source: impl std::error::Error + SendOutsideWasm + SyncOutsideWasm + 'static,

Modified file: tests/account.rs+35 additions−4 deletions@@ -36,6 +36,7 @@ async fn password_session_round_trips_and_discards_with_its_store() {
     let config = EngineConfig::default().with_initial_history_limit(0);
     let session = Session::login_password(
         PasswordLogin::new(server.uri(), "example", "wordpass")
+            .allow_insecure_loopback(true)
             .with_device_display_name("macltok test"),
         Arc::new(sessions()),
     )
@@ -89,7 +90,7 @@ async fn a_restart_after_a_soft_logout_still_knows_the_device() {
         )
     };
     Session::login_password(
-        PasswordLogin::new(server.uri(), "example", "wordpass"),
+        PasswordLogin::new(server.uri(), "example", "wordpass").allow_insecure_loopback(true),
         Arc::new(sessions()),
     )
     .await
@@ -140,7 +141,7 @@ async fn a_login_whose_first_save_fails_can_still_be_saved() {
     std::fs::set_permissions(&records, read_only).unwrap();
 
     let login = Session::login_password(
-        PasswordLogin::new(server.uri(), "example", "wordpass"),
+        PasswordLogin::new(server.uri(), "example", "wordpass").allow_insecure_loopback(true),
         Arc::new(sessions()),
     )
     .await;
@@ -169,7 +170,7 @@ async fn a_store_takes_one_session_at_a_time() {
         )
     };
     let (engine, handle, events) = Session::login_password(
-        PasswordLogin::new(server.uri(), "example", "wordpass"),
+        PasswordLogin::new(server.uri(), "example", "wordpass").allow_insecure_loopback(true),
         Arc::new(sessions()),
     )
     .await
@@ -279,7 +280,7 @@ async fn a_refresh_is_saved_before_anyone_hears_of_it() {
         StoreConfig::sqlite(root.join("store"), "test store passphrase"),
     ));
     let session = Session::login_password(
-        PasswordLogin::new(server.uri(), "example", "wordpass"),
+        PasswordLogin::new(server.uri(), "example", "wordpass").allow_insecure_loopback(true),
         sessions.clone(),
     )
     .await
@@ -300,6 +301,36 @@ async fn a_refresh_is_saved_before_anyone_hears_of_it() {
     std::fs::remove_dir_all(root).unwrap();
 }
 
+#[tokio::test]
+async fn a_homeserver_that_cant_be_one_is_refused_before_anything_is_sent() {
+    let root = temporary_path();
+    let sessions: Arc<dyn SessionStore> = Arc::new(EncryptedSessionStore::file(
+        root.join("session"),
+        StoreConfig::sqlite(root.join("store"), "test store passphrase"),
+    ));
+    for (homeserver, loopback) in [
+        ("", true),
+        ("  ", true),
+        ("example .org", true),
+        ("ftp://example.org", true),
+        ("https://user@example.org", true),
+        ("https://", true),
+        ("example.org/path", true),
+        ("http://example.org", false),
+        ("http://example.org", true),
+        ("http://localhost:8008", false),
+    ] {
+        let login =
+            PasswordLogin::new(homeserver, "example", "wordpass").allow_insecure_loopback(loopback);
+        let refused = Session::login_password(login, sessions.clone()).await;
+        assert!(
+            matches!(refused, Err(AccountError::InvalidHomeserver(_))),
+            "{homeserver:?} got through"
+        );
+    }
+    assert!(!root.exists());
+}
+
 fn record(homeserver: &str) -> SessionRecord {
     serde_json::from_value(serde_json::json!({
         "homeserver": homeserver,

macltok

Commit 9c05b1dd327a

Commit `9c05b1dd327a`