Security fix: require that state events have state_key

This has been fixed in the past but got undone after the great remaking of the event types system. Further commits will introduce tests to make sure this does not get undone again.

# Conflicts:
#	lib/events/stateevent.cpp

1 files changed, 11 insertions, 1 deletions

diff --git a/lib/events/stateevent.cpp b/lib/events/stateevent.cpp
index fd5d2642..877d0fae 100644
--- a/lib/events/stateevent.cpp
+++ b/lib/events/stateevent.cpp
@@ -21,7 +21,17 @@
 using namespace QMatrixClient;
 
 [[gnu::unused]] static auto stateEventTypeInitialised =
-        RoomEvent::factory_t::chainFactory<StateEventBase>();
+    RoomEvent::factory_t::addMethod(
+        [] (const QJsonObject& json, const QString& matrixType) -> StateEventPtr
+        {
+            if (!json.contains("state_key"))
+                return nullptr;
+
+            if (auto e = StateEventBase::factory_t::make(json, matrixType))
+                return e;
+
+            return nullptr;
+        });
 
 bool StateEventBase::repeatsState() const
 {