Protect against chat message spoofing.

74b3683c · Juliusz Chroboczek · f9e05736 · 74b3683c
Commit 74b3683c authored Nov 30, 2020 by Juliusz Chroboczek
Hide whitespace changes
Inline Side-by-side

Showing with 7 additions and 0 deletions

rtpconn/webclient.go rtpconn/webclient.go +7 -0

No files found.
--- a/rtpconn/webclient.go
+++ b/rtpconn/webclient.go
@@ -1069,6 +1069,13 @@ func handleClientMessage(c *webClient, m clientMessage) error {
 			log.Printf("ICE: %v", err)
 		}
 	case "chat", "usermessage":
+		if m.Id != c.id {
+			return group.UserError("wrong sender id")
+		}
+		if m.Username != "" && m.Username != c.username {
+			return group.UserError("wrong sender username")
+		}
+
 		tm := group.ToJSTime(time.Now())
 		if m.Type == "chat" {
 			if m.Dest == "" {