From 93ad93a36b551f653dade4553948fa215e36ba43 Mon Sep 17 00:00:00 2001
From: Benjamin Lee <benjamin@computer.surgery>
Date: Thu, 2 May 2024 18:30:39 -0700
Subject: [PATCH] respect filter.limit in the /messages endpoint

As far as I can tell, 'filter.limit' and the 'limit' query parameter are
completely redundant. I've moved the 'take(limit)' call until after
filtering, to ensure that we can return up to 'limit' events even when
some are rejected by the filter. In a future commit, I will add a global
limit on loaded events to avoid DoS.
---
 src/api/client_server/message.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/api/client_server/message.rs b/src/api/client_server/message.rs
index 2b8f7d5a..4244762a 100644
--- a/src/api/client_server/message.rs
+++ b/src/api/client_server/message.rs
@@ -9,7 +9,7 @@ use ruma::{
         message::{get_message_events, send_message_event},
     },
     events::{StateEventType, TimelineEventType},
-    uint,
+    uint, UInt,
 };
 
 use crate::{
@@ -177,6 +177,7 @@ pub(crate) async fn get_message_events_route(
 
     let limit = body
         .limit
+        .min(body.filter.limit.unwrap_or(UInt::MAX))
         .min(uint!(100))
         .try_into()
         .expect("0-100 should fit in usize");
@@ -193,7 +194,6 @@ pub(crate) async fn get_message_events_route(
                 .rooms
                 .timeline
                 .pdus_after(sender_user, &body.room_id, from)?
-                .take(limit)
                 .filter_map(Result::ok)
                 .filter(|(_, pdu)| {
                     services()
@@ -207,6 +207,7 @@ pub(crate) async fn get_message_events_route(
                         .unwrap_or(false)
                 })
                 .take_while(|&(k, _)| Some(k) != to)
+                .take(limit)
                 .collect();
 
             for (_, event) in &events_after {
@@ -249,7 +250,6 @@ pub(crate) async fn get_message_events_route(
                 .rooms
                 .timeline
                 .pdus_until(sender_user, &body.room_id, from)?
-                .take(limit)
                 .filter_map(Result::ok)
                 .filter(|(_, pdu)| {
                     services()
@@ -263,6 +263,7 @@ pub(crate) async fn get_message_events_route(
                         .unwrap_or(false)
                 })
                 .take_while(|&(k, _)| Some(k) != to)
+                .take(limit)
                 .collect();
 
             for (_, event) in &events_before {