Skip to content

Fix state_after for left rooms including post-leave lazy-loaded memberships - #20169

Open
barodeur wants to merge 5 commits into
element-hq:developfrom
barodeur:fix-state-after-left-rooms
Open

Fix state_after for left rooms including post-leave lazy-loaded memberships#20169
barodeur wants to merge 5 commits into
element-hq:developfrom
barodeur:fix-state-after-left-rooms

Conversation

@barodeur

@barodeur barodeur commented Aug 31, 2026

Copy link
Copy Markdown
Collaborator

The bug

TL;DR: with the experimental MSC4222 implementation enabled (use_state_after) and lazy-loading of room members, an incremental /sync could disclose state from after the user's leave in a left room's state_after.

  1. Alice syncs with lazy_load_members: true and use_state_after=true.
  2. Bob sends a message in a room they share.
  3. Alice leaves the room.
  4. Bob updates his per-room displayname
  5. Alice does an incremental sync covering steps 2–3. Alice's state_after contains Bob's post-leave membership event from step 4

Alice should not see the new per-room display name of Bob.

The fix

Copy what has been done for _compute_state_delta_for_full_sync: pass joined down and, for rooms the user is no longer joined to, fetch the memberships as of end_token via state groups (get_state_ids_at) instead of current state.

Pull Request Checklist

  • Pull request is based on the develop branch
  • Pull request includes a changelog file. The entry should:
    • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
    • Use markdown where necessary, mostly for code blocks.
    • End with either a period (.) or an exclamation mark (!).
    • Start with a capital letter.
    • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
  • Code style is correct (run the linters)

…rships

In the incremental-sync path with MSC4222 (use_state_after) and lazy-loading
of members enabled, the membership events of timeline senders were fetched
from the room's *current* state. For a room the user has left, current state
can include state from after the leave, which must not be disclosed.

Mirror _compute_state_delta_for_full_sync: pass `joined` down and, for
non-joined rooms, fetch the memberships as of `end_token` (the user's leave
point) via state groups instead.
@barodeur
barodeur marked this pull request as ready for review September 1, 2026 16:29
@barodeur
barodeur requested review from a team as code owners September 1, 2026 16:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant