{"action":"created","issue":{"url":"https://api.github.com/repos/status-im/status-react/issues/6038","repository_url":"https://api.github.com/repos/status-im/status-react","labels_url":"https://api.github.com/repos/status-im/status-react/issues/6038/labels{/name}","comments_url":"https://api.github.com/repos/status-im/status-react/issues/6038/comments","events_url":"https://api.github.com/repos/status-im/status-react/issues/6038/events","html_url":"https://github.com/status-im/status-react/pull/6038","id":364465274,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE4NjQzNzAy","number":6038,"title":"Enabled group chats & propagate signed membership information","user":{"login":"cammellos","id":1017008,"node_id":"MDQ6VXNlcjEwMTcwMDg=","avatar_url":"https://avatars0.githubusercontent.com/u/1017008?v=4","gravatar_id":"","url":"https://api.github.com/users/cammellos","html_url":"https://github.com/cammellos","followers_url":"https://api.github.com/users/cammellos/followers","following_url":"https://api.github.com/users/cammellos/following{/other_user}","gists_url":"https://api.github.com/users/cammellos/gists{/gist_id}","starred_url":"https://api.github.com/users/cammellos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cammellos/subscriptions","organizations_url":"https://api.github.com/users/cammellos/orgs","repos_url":"https://api.github.com/users/cammellos/repos","events_url":"https://api.github.com/users/cammellos/events{/privacy}","received_events_url":"https://api.github.com/users/cammellos/received_events","type":"User","site_admin":false},"labels":[{"id":613726715,"node_id":"MDU6TGFiZWw2MTM3MjY3MTU=","url":"https://api.github.com/repos/status-im/status-react/labels/Tested%20-%20Issues","name":"Tested - Issues","color":"d93f0b","default":false}],"state":"open","locked":false,"assignee":{"login":"cammellos","id":1017008,"node_id":"MDQ6VXNlcjEwMTcwMDg=","avatar_url":"https://avatars0.githubusercontent.com/u/1017008?v=4","gravatar_id":"","url":"https://api.github.com/users/cammellos","html_url":"https://github.com/cammellos","followers_url":"https://api.github.com/users/cammellos/followers","following_url":"https://api.github.com/users/cammellos/following{/other_user}","gists_url":"https://api.github.com/users/cammellos/gists{/gist_id}","starred_url":"https://api.github.com/users/cammellos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cammellos/subscriptions","organizations_url":"https://api.github.com/users/cammellos/orgs","repos_url":"https://api.github.com/users/cammellos/repos","events_url":"https://api.github.com/users/cammellos/events{/privacy}","received_events_url":"https://api.github.com/users/cammellos/received_events","type":"User","site_admin":false},"assignees":[{"login":"cammellos","id":1017008,"node_id":"MDQ6VXNlcjEwMTcwMDg=","avatar_url":"https://avatars0.githubusercontent.com/u/1017008?v=4","gravatar_id":"","url":"https://api.github.com/users/cammellos","html_url":"https://github.com/cammellos","followers_url":"https://api.github.com/users/cammellos/followers","following_url":"https://api.github.com/users/cammellos/following{/other_user}","gists_url":"https://api.github.com/users/cammellos/gists{/gist_id}","starred_url":"https://api.github.com/users/cammellos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cammellos/subscriptions","organizations_url":"https://api.github.com/users/cammellos/orgs","repos_url":"https://api.github.com/users/cammellos/repos","events_url":"https://api.github.com/users/cammellos/events{/privacy}","received_events_url":"https://api.github.com/users/cammellos/received_events","type":"User","site_admin":false},{"login":"lukaszfryc","id":7532782,"node_id":"MDQ6VXNlcjc1MzI3ODI=","avatar_url":"https://avatars3.githubusercontent.com/u/7532782?v=4","gravatar_id":"","url":"https://api.github.com/users/lukaszfryc","html_url":"https://github.com/lukaszfryc","followers_url":"https://api.github.com/users/lukaszfryc/followers","following_url":"https://api.github.com/users/lukaszfryc/following{/other_user}","gists_url":"https://api.github.com/users/lukaszfryc/gists{/gist_id}","starred_url":"https://api.github.com/users/lukaszfryc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukaszfryc/subscriptions","organizations_url":"https://api.github.com/users/lukaszfryc/orgs","repos_url":"https://api.github.com/users/lukaszfryc/repos","events_url":"https://api.github.com/users/lukaszfryc/events{/privacy}","received_events_url":"https://api.github.com/users/lukaszfryc/received_events","type":"User","site_admin":false}],"milestone":null,"comments":12,"created_at":"2018-09-27T13:01:28Z","updated_at":"2018-10-01T14:11:11Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/status-im/status-react/pulls/6038","html_url":"https://github.com/status-im/status-react/pull/6038","diff_url":"https://github.com/status-im/status-react/pull/6038.diff","patch_url":"https://github.com/status-im/status-react/pull/6038.patch"},"body":"### Changes\r\n1) The format of a group-chat id is changed to include the initial admin pk, in order to prevent a member to propagate messages with identical id but different admin.\r\n2) Signed group information are exchanged with each message so that even if the initial message is not received, any user will be able to create a chat if subsequent messages are received.\r\n3) Validate `chat-id` on received messages.\r\n4) Remove `receive` so that all messages go through `receive-many`\r\n\r\n3 is necessary in some cases as it is possible to exploit wrapped messages.\r\n\r\nI used the same strategy as before, to wrap a message into another message and allow to specify `chat-id`, for reference there is a good explanation here:\r\n \r\nhttps://github.com/status-im/status-react/blob/4bd5d986b0669247b631ef1e4ee17b2a96aaec6a/src/status_im/transport/handlers.cljs#L133\r\nhttps://github.com/status-im/status-react/blob/4bd5d986b0669247b631ef1e4ee17b2a96aaec6a/src/status_im/transport/message/v1/group_chat.cljs#L9\r\n\r\nIn the case of group chats, where the chat-id != sender-signature, we need to include the chat-id in the wrapper and then call `receive` on the wrapped message, with the `chat-id` taken from the wrapper.\r\nThis pattern is exploitable potentially by wrapping a `:user-message` with your `pk` as `chat-id` for example, so in order to avoid this care needs to be taken when wrapping messages & chat-id can be manipulated.\r\n\r\nI added a `valid-chat-id?` function to defensively handle this cases.\r\n\r\n### Next steps\r\n\r\n* Handle group leave\r\n* Handle new members\r\n* rationalize the various group-chats files\r\n\r\n### Testing notes\r\n\r\nThis enables group chats in nightlies, the features available:\r\n\r\n1) Create a group chat\r\n2) Exchange messages\r\n3) Delete chat\r\n4) Clean history\r\n\r\n### Desktop known issues\r\n\r\n* UI is not polished\r\n* Missing checkboxes on contacts list, but clicking works\r\n\r\nstatus: ready"},"comment":{"url":"https://api.github.com/repos/status-im/status-react/issues/comments/425922288","html_url":"https://github.com/status-im/status-react/pull/6038#issuecomment-425922288","issue_url":"https://api.github.com/repos/status-im/status-react/issues/6038","id":425922288,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNTkyMjI4OA==","user":{"login":"status-comment-bot","id":39547077,"node_id":"MDQ6VXNlcjM5NTQ3MDc3","avatar_url":"https://avatars0.githubusercontent.com/u/39547077?v=4","gravatar_id":"","url":"https://api.github.com/users/status-comment-bot","html_url":"https://github.com/status-comment-bot","followers_url":"https://api.github.com/users/status-comment-bot/followers","following_url":"https://api.github.com/users/status-comment-bot/following{/other_user}","gists_url":"https://api.github.com/users/status-comment-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/status-comment-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/status-comment-bot/subscriptions","organizations_url":"https://api.github.com/users/status-comment-bot/orgs","repos_url":"https://api.github.com/users/status-comment-bot/repos","events_url":"https://api.github.com/users/status-comment-bot/events{/privacy}","received_events_url":"https://api.github.com/users/status-comment-bot/received_events","type":"User","site_admin":false},"created_at":"2018-10-01T14:11:11Z","updated_at":"2018-10-01T14:11:11Z","author_association":"NONE","body":"#### :white_check_mark: CI BUILD SUCCESSFUL\nJenkins job: [#22](https://ci.status.im/job/status-react/job/pull%20requests/job/PR-6038/22/)\n##### Mobile\n* [Android](https://status-im.ams3.digitaloceanspaces.com/StatusIm-181001-134815-4771aa-pr.apk), ([e2e](https://status-im.ams3.digitaloceanspaces.com/StatusIm-181001-134815-4771aa-e2e.apk))\n* [iOS](https://i.diawi.com/YcoBkq)\n##### Desktop\n* [MacOS](https://status-im.ams3.digitaloceanspaces.com/StatusIm-181001-134815-4771aa-pr.dmg)\n* [AppImage](https://status-im.ams3.digitaloceanspaces.com/StatusIm-181001-134815-4771aa-pr.AppImage)"}}
{"actor":{"display_login":"status-comment-bot"}}