mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Claude
277c2d3e76
Critical fixes: - C1: Key holder election now uses lowest-user-ID from voiceStore instead of "am I first in peerPublicKeys" heuristic, preventing simultaneous join race where both participants generate conflicting room keys - C2: TOCTOU race in handleVoiceE2EEOffer — target channel check now happens inside h.mu.RLock() section (atomically with client lookup) - C3: Server now validates base64 encoding for public_key, encrypted_key, and iv before relaying, preventing client-side DoS via malformed payloads High fixes: - H1: ECDH keypair regenerated on reconnect with fresh announce, so stale keys don't persist and key rotation during disconnect is handled - H2: E2EE epoch counter prevents stale offers from overwriting a rotated room key (handleE2EEOffer discards if epoch changed during unwrap) - H3: After key rotation, re-check for peers that arrived during the async wrapping loop and send them the new key too - H4: _ecdhKeyPair and _roomKey captured in local vars before async operations to prevent null dereference if clearE2EEState runs concurrently Medium fixes: - M1: User notified via onErrorCallback when E2EE key exchange times out - M2: Timeout timer properly cleared to prevent leak and unhandled rejection - M3: Duplicate announces deduplicated — same key ignored, changed key logged https://claude.ai/code/session_01KKo3RwjdmcNzkgXNfUkgNT