We need to actually check the reference hashes on received events (SYN-185)

[matrixbot]

We don't check that the hash in a reference in the prev_events, auth_events or prev_state actually matches the hash of the referenced event.

This means that the origin server of an event can change the contents if it update the hashes and signatures and synapse won't notice that the event doesn't match.

(Imported from https://matrix.org/jira/browse/SYN-185)

(Reported by @ara4n)

[matrixbot]

Jira watchers: @NegativeMjark @ara4n

[matrixbot]

Do you mean the reference hash rather than the content hash? Cause we check the content hash for events received over federation.

-- @NegativeMjark

[richvdh]

The solution to this is matrix-org/matrix-spec-proposals#1127.

[richvdh]

this is fixed in room v3 and later by MSC1659