web/timeline: add validation for per-message profiles

tulir · Jan 13, 2025 · f94d84b · f94d84b
1 parent 9e63da1
commit f94d84b
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/web/src/ui/timeline/content/index.ts b/web/src/ui/timeline/content/index.ts
@@ -118,5 +118,13 @@ export function getPerMessageProfile(evt: MemDBEvent | null): BeeperPerMessagePr
 	if (evt === null || evt.type !== "m.room.message" && evt.type !== "m.sticker") {
 		return undefined
 	}
-	return (evt.content as MessageEventContent)["com.beeper.per_message_profile"]
+	const profile = (evt.content as MessageEventContent)["com.beeper.per_message_profile"]
+	if (profile?.displayname && typeof profile.displayname !== "string") {
+		return undefined
+	} else if (profile?.avatar_url && typeof profile.avatar_url !== "string") {
+		return undefined
+	} else if (profile?.id && typeof profile.id !== "string") {
+		return undefined
+	}
+	return profile
 }
diff --git a/web/src/util/validation.ts b/web/src/util/validation.ts
@@ -88,7 +88,7 @@ export function getServerName(userID: UserID): string {
 }
 
 export function getDisplayname(userID: UserID, profile?: UserProfile | null): string {
-	return profile?.displayname || getLocalpart(userID)
+	return ensureString(profile?.displayname) || getLocalpart(userID)
 }
 
 export function parseMXC(mxc: unknown): [string, string] | [] {