12 lines
733 B
Diff
12 lines
733 B
Diff
# UNDF: UNDF-2026-000000306
|
|
--- a/synapse/handlers/sync.py
|
|
+++ b/synapse/handlers/sync.py
|
|
@@ -1437,7 +1437,8 @@ class SyncHandler:
|
|
if event.membership == Membership.JOIN:
|
|
- user_ids_in_room = await self.store.get_users_in_room(room_id)
|
|
- if user_id in user_ids_in_room:
|
|
+ # CWE-407 fix: get_users_in_room returns Sequence[str] (List); convert to set
|
|
+ # for O(1) membership test instead of O(n) linear scan over all room members.
|
|
+ user_ids_in_room = frozenset(await self.store.get_users_in_room(room_id))
|
|
+ if user_id in user_ids_in_room:
|
|
mutable_joined_room_ids.add(room_id)
|