[INTERNAL][CORE] Adds security check for received activities

core/src/saros/session/ISarosSession.java

@@ -235,7 +235,7 @@ void changePermission(User user, Permission permission)
  Set<Integer> getUnavailableColors();
 
  /** FOR INTERNAL USE ONLY ! */
- void exec(List<IActivity> activities);
+ void exec(JID jid, List<IActivity> activities);
 
  /**
  * Adds an {@link IActivityProducer} so the production of its activities will be noticed.

core/src/saros/session/internal/ActivitySequencer.java

@@ -339,7 +339,7 @@ private void executeActivities(
  return;
  }
 
- sarosSession.exec(activities);
+ sarosSession.exec(sender, activities);
  }
 
  /** Sends an activity to the given recipients. */
@@ -359,7 +359,7 @@ public void sendActivity(List<User> recipients, final IActivity activity) {
  new Runnable() {
  @Override
  public void run() {
- sarosSession.exec(Collections.singletonList(activity));
+ sarosSession.exec(user.getJID(), Collections.singletonList(activity));
  }
  });
  }

core/src/saros/session/internal/SarosSession.java

@@ -638,23 +638,38 @@ public ConcurrentDocumentClient getConcurrentDocumentClient() {
  }
 
  @Override
- public void exec(List<IActivity> activities) {
+ public void exec(JID jid, List<IActivity> activities) {
  /**
  * @JTourBusStop 7, Activity sending, Incoming activities:
  *
  * <p>Incoming activities will arrive here. The ActivitySequencer calls this method for
  * activities received over the Network Layer.
  */
- final List<IActivity> valid = new ArrayList<IActivity>();
+ final List<IActivity> validActivities = new ArrayList<IActivity>();
 
  // Check every incoming activity for validity
  for (IActivity activity : activities) {
- if (activity.isValid()) valid.add(activity);
- else log.error("could not handle incoming activity: " + activity);
+
+ if (!activity.isValid()) {
+ log.error("could not handle incoming activity: " + activity);
+ continue;
+ }
+
+ final User source = activity.getSource();
+
+ assert jid != null && source != null;
+
+ if (isHost() && !source.getJID().strictlyEquals(jid)) {
+ log.warn("detected spoofed activity from: " + jid + " -> " + activity);
+ // TODO kick the user
+ continue;
+ }
+
+ validActivities.add(activity);
  }
 
- List<IActivity> processed = activityQueuer.process(valid);
- activityHandler.handleIncomingActivities(processed);
+ final List<IActivity> executableActivites = activityQueuer.process(validActivities);
+ activityHandler.handleIncomingActivities(executableActivites);
  }
 
  /*

core/test/junit/saros/session/internal/ActivitySequencerTest.java

@@ -289,7 +289,7 @@ private static ISarosSession createSessionMock(
 
  final Capture<List<IActivity>> capture = Capture.newInstance();
 
- session.exec(EasyMock.capture(capture));
+ session.exec(EasyMock.anyObject(JID.class), EasyMock.capture(capture));
 
  EasyMock.expectLastCall()
  .andAnswer(() -> receivedActivitiesBuffer.addAll(capture.getValue()))