The server request adds from_ts / to_ts to the room_events filter with the comment "valid Matrix spec fields not yet in SDK types". They are not spec fields — RoomEventFilter has no timestamp bounds (see IFilterComponent in matrix-js-sdk/lib/filter-component.d.ts), and Synapse drops unknown filter keys. The server therefore returns results from outside the selected range, and nothing post-filters them client-side (applyResultFilters only handles msgtype + pinned). Only the local/encrypted path (useLocalMessageSearch's inRange) actually honours the range, so the same query gives a correctly-filtered encrypted section next to an unfiltered plaintext section.
How to trigger
Search a term that occurs in a plaintext room, set a date range that excludes those hits — they still appear.
Suggested fix
Drop from_ts/to_ts from the request and post-filter server results by event.origin_server_ts in applyResultFilters (same predicate the local search already uses), so the filter is consistent across both sections.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** high · **Type:** bug · **Confidence:** high
**Location:** `src/app/features/message-search/useMessageSearch.ts:135-140`, `src/app/features/message-search/SearchFilters.tsx:536-556`, `LOTUS_FEATURES.md:745`
### Problem
The server request adds `from_ts` / `to_ts` to the `room_events` filter with the comment "valid Matrix spec fields not yet in SDK types". They are not spec fields — `RoomEventFilter` has no timestamp bounds (see `IFilterComponent` in `matrix-js-sdk/lib/filter-component.d.ts`), and Synapse drops unknown filter keys. The server therefore returns results from outside the selected range, and nothing post-filters them client-side (`applyResultFilters` only handles msgtype + pinned). Only the local/encrypted path (`useLocalMessageSearch`'s `inRange`) actually honours the range, so the same query gives a correctly-filtered encrypted section next to an unfiltered plaintext section.
### How to trigger
Search a term that occurs in a plaintext room, set a date range that excludes those hits — they still appear.
### Suggested fix
Drop `from_ts`/`to_ts` from the request and post-filter server results by `event.origin_server_ts` in `applyResultFilters` (same predicate the local search already uses), so the filter is consistent across both sections.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · High milestone 2026-09-12 01:50:50 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: high · Type: bug · Confidence: high
Location:
src/app/features/message-search/useMessageSearch.ts:135-140,src/app/features/message-search/SearchFilters.tsx:536-556,LOTUS_FEATURES.md:745Problem
The server request adds
from_ts/to_tsto theroom_eventsfilter with the comment "valid Matrix spec fields not yet in SDK types". They are not spec fields —RoomEventFilterhas no timestamp bounds (seeIFilterComponentinmatrix-js-sdk/lib/filter-component.d.ts), and Synapse drops unknown filter keys. The server therefore returns results from outside the selected range, and nothing post-filters them client-side (applyResultFiltersonly handles msgtype + pinned). Only the local/encrypted path (useLocalMessageSearch'sinRange) actually honours the range, so the same query gives a correctly-filtered encrypted section next to an unfiltered plaintext section.How to trigger
Search a term that occurs in a plaintext room, set a date range that excludes those hits — they still appear.
Suggested fix
Drop
from_ts/to_tsfrom the request and post-filter server results byevent.origin_server_tsinapplyResultFilters(same predicate the local search already uses), so the filter is consistent across both sections.Filed from the September 2026 client audit (branch
lotus@4bea4895).