Resolve over old and new extremities (#2457)

* Feed existing state into state res when calculating state from new extremities

* Remove duplicates

* Fix bug

* Sort and unique

* Update to matrix-org/gomatrixserverlib#308

* Trim the slice properly

* Update gomatrixserverlib again

* Update to matrix-org/gomatrixserverlib#308

2 files changed, 28 insertions, 6 deletions

diff --git a/roomserver/internal/input/input_latest_events.go b/roomserver/internal/input/input_latest_events.go
index 9ad8b042..e4c138d5 100644
--- a/roomserver/internal/input/input_latest_events.go
+++ b/roomserver/internal/input/input_latest_events.go
@@ -233,12 +233,19 @@ func (u *latestEventsUpdater) latestState() error {
 		}
 	}
 
-	// Get a list of the current latest events. This may or may not
-	// include the new event from the input path, depending on whether
-	// it is a forward extremity or not.
-	latestStateAtEvents := make([]types.StateAtEvent, len(u.latest))
-	for i := range u.latest {
-		latestStateAtEvents[i] = u.latest[i].StateAtEvent
+	// Take the old set of extremities and the new set of extremities and
+	// mash them together into a list. This may or may not include the new event
+	// from the input path, depending on whether it became a forward extremity
+	// or not. We'll then run state resolution across all of them to determine
+	// the new current state of the room. Including the old extremities here
+	// ensures that new forward extremities with bad state snapshots (from
+	// possible malicious actors) can't completely corrupt the room state
+	// away from what it was before.
+	combinedExtremities := types.StateAtEventAndReferences(append(u.oldLatest, u.latest...))
+	combinedExtremities = combinedExtremities[:util.SortAndUnique(combinedExtremities)]
+	latestStateAtEvents := make([]types.StateAtEvent, len(combinedExtremities))
+	for i := range combinedExtremities {
+		latestStateAtEvents[i] = combinedExtremities[i].StateAtEvent
 	}
 
 	// Takes the NIDs of the latest events and creates a state snapshot
diff --git a/roomserver/types/types.go b/roomserver/types/types.go
index 65fbee04..ce4e5fd1 100644
--- a/roomserver/types/types.go
+++ b/roomserver/types/types.go
@@ -18,6 +18,7 @@ package types
 import (
 	"encoding/json"
 	"sort"
+	"strings"
 
 	"github.com/matrix-org/gomatrixserverlib"
 	"golang.org/x/crypto/blake2b"
@@ -166,6 +167,20 @@ type StateAtEventAndReference struct {
 	gomatrixserverlib.EventReference
 }
 
+type StateAtEventAndReferences []StateAtEventAndReference
+
+func (s StateAtEventAndReferences) Less(a, b int) bool {
+	return strings.Compare(s[a].EventID, s[b].EventID) < 0
+}
+
+func (s StateAtEventAndReferences) Len() int {
+	return len(s)
+}
+
+func (s StateAtEventAndReferences) Swap(a, b int) {
+	s[a], s[b] = s[b], s[a]
+}
+
 // An Event is a gomatrixserverlib.Event with the numeric event ID attached.
 // It is when performing bulk event lookup in the database.
 type Event struct {