LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Forwarding out of an encrypted room gives no warning: the text (and a re-uploaded plaintext attachment) becomes server-readable, and the original author's ID goes along #330

New Issue
Closed
opened 2026-10-05 22:58:03 -04:00 by jared · 1 comment
jared commented 2026-10-05 22:58:03 -04:00
Owner
Copy Link
Copy Source

ForwardMessageDialog (src/app/features/room/message/ForwardMessageDialog.tsx) can forward a message from an encrypted room into any room, including public, unencrypted ones. Two things happen silently.

  1. Encryption is lost. For an unencrypted destination the attachment is decrypted and re-uploaded in plaintext (lines 323-356; correct, given #63's key leak), and the text is posted unencrypted. Nothing in the dialog says the destination isn't encrypted.
  2. Attribution travels with it. buildForwardContent stamps io.lotus.forwarded = { sender, origin_server_ts, room_id, event_id } (forwardContent.ts:24-81). The source room's name is deliberately left out, but the original author's MXID and the source room_id are attached, and Lotus renders "Forwarded from ". The preview shows the author, but nothing says their identity will be published with the forward.

For example, forwarding a line from a private encrypted DM into a public space channel publishes both the text and who wrote it, in a room the original author may not be in, and the server can read it.

Suggestions:

  • When the source room is encrypted and any picked destination isn't, show an inline note in the dialog: "#general isn't encrypted. The forwarded message (and attachment) will be readable by the server and everyone in that room."
  • Add a "Include original sender" toggle, on by default as now and remembered. Or default it off when forwarding from a DM.
  • Give the original author a matching opt-out, if attribution is meant to stay Discord-like.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

`ForwardMessageDialog` (src/app/features/room/message/ForwardMessageDialog.tsx) can forward a message from an **encrypted** room into any room, including public, unencrypted ones. Two things happen silently. 1. **Encryption is lost.** For an unencrypted destination the attachment is decrypted and **re-uploaded in plaintext** (lines 323-356; correct, given #63's key leak), and the text is posted unencrypted. Nothing in the dialog says the destination isn't encrypted. 2. **Attribution travels with it.** `buildForwardContent` stamps `io.lotus.forwarded = { sender, origin_server_ts, room_id, event_id }` (forwardContent.ts:24-81). The source room's *name* is deliberately left out, but the **original author's MXID** and the source `room_id` are attached, and Lotus renders "Forwarded from <author>". The preview shows the author, but nothing says their identity will be published with the forward. For example, forwarding a line from a private encrypted DM into a public space channel publishes both the text and who wrote it, in a room the original author may not be in, and the server can read it. **Suggestions:** - When the source room is encrypted and any picked destination isn't, show an inline note in the dialog: "**#general isn't encrypted.** The forwarded message (and attachment) will be readable by the server and everyone in that room." - Add a "Include original sender" toggle, on by default as now and remembered. Or default it off when forwarding from a DM. - Give the original author a matching opt-out, if attribution is meant to stay Discord-like. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._
jared added the priority: lowuxarea: messaging labels 2026-10-05 22:58:03 -04:00
jared commented 2026-10-19 12:16:09 -04:00
Author
Owner
Copy Link
Copy Source

Done: #400. Forwarding from an encrypted room into an unencrypted one now shows a note naming the room(s), and says the server and everyone there will see the message and its original author. The optional "include original sender" toggle wasn't requested; open a new issue if it's wanted.

🤖 Claude Code

Done: #400. Forwarding from an encrypted room into an unencrypted one now shows a note naming the room(s), and says the server and everyone there will see the message and its original author. The optional "include original sender" toggle wasn't requested; open a new issue if it's wanted. 🤖 Claude Code
jared closed this issue 2026-10-19 12:16:09 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: messaging priority: low ux
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#330