feat(jigasi): Verify the rayo JvbRoomName header if it exists. (#1166)

* feat: Verify the rayo JvbRoomName header if it exists. * squash: Use the correct room JID.
jitsi · Sep 18, 2024 · 79aeb9f · 79aeb9f
1 parent 68b050a
commit 79aeb9f
Showing 1 changed file with 19 additions and 12 deletions.
diff --git a/jicofo/src/main/kotlin/org/jitsi/jicofo/xmpp/JigasiIqHandler.kt b/jicofo/src/main/kotlin/org/jitsi/jicofo/xmpp/JigasiIqHandler.kt
@@ -35,6 +35,7 @@ import org.jivesoftware.smack.packet.IQ
 import org.jivesoftware.smack.packet.StanzaError
 import org.jivesoftware.smack.packet.id.StandardStanzaIdSource
 import org.jxmpp.jid.Jid
+import org.jxmpp.jid.impl.JidCreate
 import java.util.concurrent.atomic.AtomicInteger
 
 class JigasiIqHandler(
@@ -62,18 +63,13 @@ class JigasiIqHandler(
                 Stats.rejectedRequests.inc()
             }
 
-        var conference = conferenceStore.getConference(conferenceJid)
-
-        if (conference == null) {
-            // let's search for visitor room with that jid, maybe it's an invite from a visitor
-            conference = conferenceStore.getAllConferences()
-                .find { c -> c.visitorRoomsJids.contains(conferenceJid) }
-        }
-
-        conference ?: return RejectedWithError(request, StanzaError.Condition.item_not_found).also {
-            logger.warn("Rejected request for non-existent conference: $conferenceJid")
-            Stats.rejectedRequests.inc()
-        }
+        val conference = conferenceStore.getConference(conferenceJid)
+            // search for visitor room with that jid, maybe it's an invite from a visitor
+            ?: conferenceStore.getAllConferences().find { c -> c.visitorRoomsJids.contains(conferenceJid) }
+            ?: return RejectedWithError(request, StanzaError.Condition.item_not_found).also {
+                logger.warn("Rejected request for non-existent conference: $conferenceJid")
+                Stats.rejectedRequests.inc()
+            }
 
         if (!conference.acceptJigasiRequest(request.iq.from)) {
             return RejectedWithError(request, StanzaError.Condition.forbidden).also {
@@ -82,6 +78,17 @@ class JigasiIqHandler(
             }
         }
 
+        val roomNameHeader = request.iq.getHeader("JvbRoomName")
+        if (roomNameHeader != null && JidCreate.entityBareFrom(roomNameHeader) != conference.roomName) {
+            return RejectedWithError(request, StanzaError.Condition.forbidden).also {
+                logger.warn(
+                    "Rejecting request with non-matching JvbRoomName: from=${request.iq.from} " +
+                        ", roomName=${conference.roomName}, JvbRoomName=$roomNameHeader"
+                )
+                Stats.rejectedRequests.inc()
+            }
+        }
+
         logger.info("Accepted jigasi request from ${request.iq.from}: ${request.iq.toStringOpt()}")
         Stats.acceptedRequests.inc()