Disallow direct events construction from JSON

Direct construction (using makeEvent() or explicitly constructing
an event) from JSON may create an event that has a type conflicting
with that stored in JSON. There's no such problem with loadEvent(),
even though it's considerably slower. Driven by the fact that almost
nowhere in the code direct construction is used on checked JSON
(one test is the only valid case), this commit moves all JSON-loading
constructors to the protected section, thereby disabling usage of
makeEvent() in JSON-loading capacity, and switches such cases across
the library to loadEvent().

1 files changed, 6 insertions, 4 deletions

diff --git a/lib/connection.cpp b/lib/connection.cpp
index 471dc20d..a33ace51 100644
--- a/lib/connection.cpp
+++ b/lib/connection.cpp
@@ -2242,10 +2242,12 @@ void Connection::saveOlmAccount()
 #ifdef Quotient_E2EE_ENABLED
 QJsonObject Connection::decryptNotification(const QJsonObject &notification)
 {
-    auto r = room(notification["room_id"].toString());
-    auto event = makeEvent<EncryptedEvent>(notification["event"].toObject());
-    const auto decrypted = r->decryptMessage(*event);
-    return decrypted ? decrypted->fullJson() : QJsonObject();
+    if (auto r = room(notification["room_id"].toString()))
+        if (auto event =
+                loadEvent<EncryptedEvent>(notification["event"].toObject()))
+            if (const auto decrypted = r->decryptMessage(*event))
+                return decrypted->fullJson();
+    return QJsonObject();
 }
 
 Database* Connection::database() const